The Secret Life of Enterprise Botnets
summary
Researchers track about 500,000+ compromised enterprise devices over a year and find enterprise IoT (DVRs, thermal cameras, CPE, some cloud servers) now generate the majority of DDoS activity, often in 5k–60k‑IP bursts; aggregated attack capacity is roughly 50–100 terabit, enough to threaten global transit if fully mobilized. Key drivers are ubiquitous exposed devices, collapsing booter prices, and carriers rolling out gigabit symmetric upstream that amplifies each bot’s impact; attacks trend shorter and pulsed, evading traditional edge defenses.
AI-written summary · about
chapters (15)
- 0:00Introduction to enterprise botnets
- 1:33DDoS growth and botnet shift
- 4:46Service provider marketing impact
- 7:15Law enforcement and market forces
- 9:26Studying botnets in the wild
- 13:23Botnet scale and capacity
- 15:53Common compromised devices
- 17:40Real-world attack example
- 20:54Exploiting device vulnerabilities
- 23:03Thermal camera botnet activity
- 24:27Changing DDoS security models
- 26:14US as DDoS exporter
- 28:22Systemic threat to internet
- 30:13Call to action for enterprises
- 32:45Q&A session
related talks
23mThe Role of IoT and 5G Devices in DDoS Attacks
37mAnatomy of a DDoS
23mThe Rise of the Eternal Botnet
52mInvestigating DDOS - Architecture Actors and Attribution
40mResearch on New Vectors of UDP-Based DDoS Amplification Attacks of IoT
29mAttack of the Clone Army
03mThe world will see (and just saw) an Internet zombie apocalypse
45mBarbarians at the Gate(way)