This procedure can take some time, but the concept is really easy. They also do this from compromised and specially modified machines to be sure that their origin cannot be traced back. The amount they need depends. It isn't only the number, it is the bandwidth of each of these. From what I've heard from security mailing lists, attackers have already compromised Internet2 and other high-speed machines.
Remote detection is practically impossible unless the attack goes on for a timed amount of days.
That was a point I wanted to prove. Since the other existing DDoS tools weren't totally anonymous and untraceable, I saw the possibility that security people would waste their time trying to find ways to track the attacker, while the DDoS tools would sooner or later become sophisticated enough to make this impossible. There is still the chance of finding attackers if they aren't extremely careful and leave traces on the compromised hosts or manipulate and damage things on the compromised hosts enough so that the administrator detects them locally. Trinoo was used. Currently, many people seem to be modifying those tools, or developing new, similar ones, and keeping them private.