Why do DDoS attacks spoof DNS source IPs?

Question

Recently, a lot of my friends have been talking about botnets. They said they've created their own.‌‌ Obviously, I ​​know this is all illegal so I try not to take part in any of it.

But I've been wondering how they work. I've read some articles online and the basics on the control server and peer-to-peer communicating but I still don't really understand. Sometimes my friends ask about what hosting companies support UDP spoofing and I don't understand that. C‌‌‌an't they just send UDP data from the devices that I'm assuming they have ​​​compromised instead of spoofing the source IP when sending data to a DNS server (for example)?

Answer 1

I think you are confusing creating and using a botnet in general vs. using it for specific attacks. Spoofing the source IP address to the one of the victim is a common attack pattern in DDoS amplification attacks, where a small request will result in a bigger response - which because of the spoofed source IP address is then directed to the victim. This way the power of the botnet can be amplified, i.e. attacks can be much larger compared to to direct DDoS to the target from the botnets compromised computers.

For more see DNS amplification or NTP amplification.