LT1

### Overview In this talk, Jerome from Nokia Deepfield shares insights into current and emerging Denial of Service (DoS) security threats. He addresses the shift in Nokia's core focus toward network infrastructure and routers, explaining how his day-to-day research tracks DoS activity using customer telemetry, internet-wide scanning, and active proxy discovery.

### Key Topics - **DoS Threat Landscape**: For roughly the past five years, botnets have driven the majority of DoS attacks, currently generating about 60% of DoS traffic. - **Botnet Composition**: Compromised devices historically include MikroTik routers, DVRs, unexpected connected systems such as parking meters in Korea, and exposed Jupyter notebooks exploited to launch DoS attacks against Minecraft servers. - **Rise of Residential Proxies**: An emerging shift over the prior six months shows significant overlap between volumetric DoS source IP addresses and residential proxy nodes. - **Scale and Detection Challenges**: Residential proxies are harder to discover because they often lack open ports for direct crawling, yet they represent a footprint orders of magnitude larger than traditional botnets.

### Technical Details - **Data Sources and Discovery**: Research relies on customer telemetry (specifically NetFlow data), active IPv4 crawling to map devices and running services, and active residential proxy discovery. - **Traditional Botnet Footprint**: Known DoS botnets account for approximately 1 million nodes, with individual attacks typically drawing from tens of thousands of source IPs. - **Proxy Scale and BudBox**: Residential proxies, such as Badbox pre-installed at the factory on Android TV boxes, reach an estimated 100 million nodes—two orders of magnitude larger than standard botnets. Daily tracking observes approximately 30 million of these nodes, and attack sizes can involve significantly higher volumes of source IPs. - **Discovery Hurdles**: Unlike traditional bots that expose open ports, residential proxy nodes generally do not accept direct inbound crawls, demanding active discovery methods.

### Takeaways Volumetric DoS attacks are rapidly converging with residential proxy infrastructure, drastically increasing potential attack scale and obfuscation. Nokia Deepfield is actively collaborating across the industry to address the monitoring and mitigation challenges posed by these massive proxy networks. Note: The transcript cuts off mid-sentence during the concluding remarks.