I am currently reading literature that states that Bogons are commonly used by attackers when conducting DDos attacks. I did some searching for an explanation and all I could find was that "Bogons make it difficult to trace back to the attackers IP"
My question is, if an attacker is free to choose an IP to spoof, why not use a random non-Bogon not owned by the attacker? What is the advantage of the Bogon over a non-Bogon?
The conclusion that attackers prefer bogons as spoofed source IP addresses is a product of selection bias and mistaking correlation for causation.
Which of these is higher?
The answer, of course, is the latter. Invalid IP addresses are inherently not the source of much (if any) legitimate traffic. However, the reason for this isn't that attackers prefer bogon addresses for spoofing, it's that almost no legitimate traffic comes from bogon addresses.
When attackers send DDoS traffic, they often generate the spoofed source IP at random. They do not include logic that excludes bogon ranges or RFC1918 addresses. As such, a reasonable portion of the outgoing packets' source addresses will be bogons.
Now put yourself in the shoes of a sysadmin looking at their traffic logs. Approximately 15% of addresses in the space 0.0.0.0 to 255.255.255.255 are bogons. Let's assume that an attacker has sent one million malicious packets to your network. That means that 850k of those packets came from non-bogon IPs, and 150k came from bogon IPs. However, at the same time as the attack was happening, normal traffic from every day operations was still flowing through the network, so those 850k packets might make up 50% of your network load. As such, if you look at the percentages, 50% of non-bogon traffic was malicious, but nearly 100% of bogon traffic was malicious! That must mean that attackers prefer bogon addresses!
But, if you consider the ratio of non-bogon source addresses to bogon source addresses in the malicious traffic alone, only 15% of the malicious packets actually came from bogon addresses, which leads to the exact opposite conclusion.
This reasoning problem is amplified by the fact that it's far more difficult to tell if a given packet is malicious if it has a legitimate-looking source address. This means that the number of malicious packets with non-bogon addresses that we can easily identify as malicious is lower than the actual number of malicious packets with non-bogon addresses. This further skews analysis.
Logically, it also makes no sense for an attacker to prefer bogon IP addresses over non-bogon IPs. At best it does nothing, because the router isn't looking at the source IP address. At worst, it makes the packets more likely to get dropped by a router instead of reaching the target.
