After some days of thinking that my internet was just much slower than usual, I started considering the possibility of someone ddos'ing me since my internet only goes down on special occasions such as maintenance or stuff related. My friend warned me that it was only possible to find the attacker if he was launching the attack directly from him, and that it is impossible to track an attacker who is using a paid website service.
Is it true? Any tips about it?
This is more of a networking question. If the attacker launches the attack from his home without any protections, then the IP will point to his home. If he pays a service to do it, or uses a cloud server, then the IP will point to the service and not his home.
But the service will have records of who paid them, so it is possible for investigators to trace the attack that way.
Even if the ddos attacker was launching the attack themselves, attribution is still very difficult. You may be able to track what type of botnet the attack is coming from, but it is probably best to contact your ISP if you truly believe you are under attack.
It will be difficult for sure, but lets say if the attacker is using a "booter" service, you will need to track and hack the booter service or coerce them into giving the IP address of the person who ordered the attack by ironically ddossing the booter service. For hacking, DNS spoofing + phishing with proxy to real site is probably your best bet.
A lot of booters use UDP amplification instead of botnets, and many use the server itself to attack as well. Many will also ping the target to determine whether it is down. You can use that to track the attacker's server, and if you're lucky, it'll be the same as the one hosting the booter webpage.
Honestly, there is no need to use a booter service for home connections. It's very easy to completely disable a home internet connection with just one server because the upload of the server is much greater than most ISP download speeds. They can also use IP spoofing to hide their IP address, but again, many will ping the IP to verify that it's down, which can reveal the server's IP.
If they're using some DDoS service, the attack will look something like this:
[Attacker] ---- DDoS command ----> [Server] ----- Traffic -----> [You]
So if you were to look at the source address of the traffic, it would come to the IP address of some server owned or controlled by the DDoS service, not the attacker.
The IP address of the attacker could still be obtained since there will be records on the DDoS service's servers of each attack and where they originate from.
If the attack is launched directly from the attacker, it looks like this:
[Attacker] ----- Traffic -----> [You]
In this case, the source of traffic would be that of the attacker.
