You don't even need that, you just need faster upstream than they have downstream and you can 'DDoS'.

One comprimised server with 100mbps is usually sufficient. Or perhaps someone actually owns a connection they use to DDoS with.