Where is the limit between an attacker and a victim (zombie) in a DDoS attack

Question

Let's say that A is DDoSing B and I'm a member of his botnet. Who says that I'm not a real attacker but a victim? How you determine it?

Answer 1

There is no absolute way of identifying the person behind a machine and his true intentions.

You can't find out if the person in front of the keyboard has the intention of performing a DoS attack. A forensic investigation of a computer can reduce this uncertainty. People with intention of doing DoS will leave certain traces behind while tools for turning computers into zombies that perform distributed DoS will leave different traces.

Tracking down a person and proving he is responsible for controlling a botnet is easier than the reverse - proving a person innocent because he is a victim of malware. The legal system uses the presumption of innocence so a person is considered innocent until proven guilty.

The attribution problem is particularly thorny in information security. Attributing intention becomes particularly difficult when the attacker is skilled.

Answer 2

Difference between a zombie and an accomplice is not technical. If your machine is is hijacked and used for attacks, and you are not aware of it, then this is a zombie and you are a co-victim. BUT if you agree with the attack, at least conceptually (i.e. you would have voluntarily granted access to your machine to the attacker, if given the choice) then you are an accomplice. It is all about intent, and it is ultimately a law matter. The difference is even fuzzier than that: apparently, in Germany, you can be fined for failing to apply appropriate protections to your WiFi router -- in other words, you can be both a zombie and an accomplice at the same time.

Answer 3

Depending if you are talking legally or conceptually, the answer can be a bit different. Conceptually, an attacker is any rogue system trying to do harm, so the bot is an attacker in the conceptual sense because defenses need to engage that system. Thus, for the server being DDoSed, the bot would be an attacker, but for the person who's computer is a bot, the person controlling the bot (or doing the infecting) would be the attacker.

Legally, it would depend entirely on the jurisdiction and what the lawyers can argue and can't really be answered well here as there isn't a globally correct answer, but it can be rather tricky to establish what intent is. Sure there are some indications that might help you guess, but then again, a smart attacker could simply rig up their command and control to look like it was just another victim and then try to deny the whole thing.