While I was reverse engineering ZeroAccess in order to write a monitoring system, I had an idea which would allow me to use ZeroAccess C&C infrastructure to reflect and amplify a UDP based DDoS attack, which I'd found to be beautifully ironic. After further analysis, I discovered it may even be possible to use non worker bots (which connect from behind NAT) to participate in the attack.
Zero Amplification
ZeroAccess is a peer-to-peer botnet (bots which can accept incoming connections act as servers and those that cannot act as workers). The p2p protocol is built on top of UDP and has a fairly significant size difference between the main request and response size, which is ideal for both reflection and amplification. Each bot send a 16-byte peer request via UDP to every supernode in its active list with the purpose of learning about new peers and files, if the supernode is online it responds with a UDP packet containing a 16-byte header, 16 peers and a list of available files. Each peer entry is 8 bytes and a file entry is 140 bytes (currently there are 2 files, so that brings the response to a total size of 424 bytes (almost 27 times larger than the request).
Using a server which allows source address spoofing, we can send a peer request packet to each supernode with the source IP spoofed to the IP of the system we wish to attack, resulting in each supernode "replying" with a 424 byte packet to the victim's IP address. Assuming we have a sever that can output at 1gb/s, the target will receive up to 26.5 gb/s worth of packets from various supernodes (though it will vary depending on how busy the supernodes are and their throughput).
Unfortunately, there's nowhere near as many supernodes as there are bots, due to something called NAT (Network Address Translation).
NAT
The idea behind NAT is to allow multiple computer to share the same public IP address (I'll give a brief and oversimplified explanation of how this works).
SOCIAL SHARE CARD GENERATOR