IP booters have unfortunately become a popular way for malicious actors to overload and take down networks and servers through abusive UDP flooding. Using booter services, attackers essentially “rent” access to an army of compromised devices that will bombard targets with UDP packets, potentially overloading bandwidth and resources. To understand how these powerful but disruptive attacks work on a technical level, we must understand UDP and why it is prone to flooding issues compared to other protocols.
Role of UDP in network communications
UDP (User Datagram Protocol) is the core member of the Internet protocol suite. It allows computers and devices to transmit data packets quickly between one another without many formalities. It makes UDP very fast and efficient for things like streaming video/audio, online gaming, Voice over IP calls, and DNS lookups. However, this efficiency comes with some tradeoffs compared to other protocols like TCP (Transmission Control Protocol). This lack of congestion and error control makes UDP well-suited for speed but also vulnerable to being overloaded with traffic. Senders can pump out huge volumes of UDP data without regard for the recipient’s ability to keep up. This brings us to IP booters and why they leverage UDP floods.
Inside the IP booters supplying firepower
IP booters, also known as “IP Stresser”, offer to pay customers the ability to direct overwhelming floods of junk UDP traffic toward any target IP address or domain. The goal is achieved using large botnets or networks of thousands to millions of compromised machines and vulnerable IoT devices scattered across the globe. The owners of booters continually scan for and break into new systems to infect and add to their zombie armies. Methods range from phishing attacks to exploiting known security flaws. Once infected, the devices are configured to listen for remote commands over the internet. When customers rent a booter’s firepower, the botnet owner simply orders their global network of compromised devices to barrage the target address with UDP packet traffic generated from random spoofed IP addresses. This masks the true geographic origins of each device in the attack.
Unleashing a potent UDP flood attack
Equipped with extensive botnets, IP booters can cripple targets through raw bandwidth overload. A single booter reportedly supplies upwards of 150-300+ Gigabits per second of junk UDP traffic from hundreds of thousands of manipulated devices. When coordinating a UDP flood, the booter controller instructs bots to send continuous streams of evenly sized UDP packets to the victim’s IP address using randomized source ports and spoofed source IP addresses. This ensures new UDP flows are constantly opened faster than the target can close them.
With so many new fake flows bombarding the target per second, critical network infrastructure like firewalls and load balancers struggle to keep up with session tracking. The target’s bandwidth capacity starts to choke as the incoming traffic exceeds what their systems can handle or passes through barriers to the backend servers/applications. The results are usually sluggish performance, timeouts, and total denial of service to legitimate users as the flood persists. The damage can extend beyond just the directly targeted IP to surrounding infrastructure. For example, floods meant for a website may also cripple an entire hosting provider.
