By using multiple zombies, the attacker can
- Generate huge traffic
One Denial of Service attack from a blazing fast 1 Gigabit connection is 10 times less harmful than a Distributed Denial of Service constant 1 Megabit attack from 10,000 zombies. (Assuming that all of the bandwidth from one line can be used for attack which is highly unlikely.)
- Make it hard to protect
1 IP causing Denial of Service? Modern firewalls can easily block it. 10, 100 IPs? No problem.
How about a 620 Gbps attack from fifty million IPs? You can't block each and every one of the IPs. And before you know it, the core infrastructure of you and your service provider's network(routers, backbones, etc) starts to die. You can't do anything but pray for the attack to stop.
By using botnet computers, the attacker can mitigate the risk of being exposed.
- Firewall mitigation
Easy and powerful attacks such as UDP flooding can be mitigated by a firewall because the attack is well known and firewalls are programmed to protect them. But what about a legitimate request, say, a simple http page load?
If the scale of the botnet gets huge, even a simple page loading can cause deadly results. Imagine 145k botnets loading 1MB page every second. It can generate an approx. 1Tbps load on the victim, which will be ranked the second greatest DDoS attack on history.