What is a botnet?

                                                           

Botnet is the generic name that names any group of PC infected and controlled by an attacker remotely. Generally, a hacker or a group of them creates a botnet using malware that infects a large number of machines. Computers are part of the botnet, called "bots" or "zombies." There is not a minimum number of computers to create a botnet. Small botnets can include hundreds of infected PCs, while older botnets use millions of computers. Some examples of recent botnets are Conficker, Zeus, Waledac, Mariposa and Kelihos. Often, the botnet is understood as a unique entity, however the creators of this malware sell it to anyone who pays for it. For this reason, there are dozens of separate botnets using the same malware and operating at the same time.

How does it infect the computer?

Hackers use two methods to infect computers and these are part of a botnet: drive-by downloads and email attacks. In the first case, the process requires different steps and the attacker must find a web page with a vulnerability that it can exploit. Then, the hacker loads its malicious code on the page and exploits the vulnerability in a web browser such as Google Chrome or Internet Explorer. The code redirects the user's browser to another site controlled by the offender where the bot code is downloaded and installed on the computer. In the second case, the process is simpler. The attacker sends a large amount of spam, where a Word or PDF file with a malicious code or a link to the page that hosts the code is attached. Once the code is on the computer, the computer becomes part of the botnet. The attacker can remotely manage the commands, upload data to the PC or do what he really wants with the machine.

Uses
DDoS Attacks: The most common use of botnets is DDoS attacks. These attacks use the power of the computer and the bandwidth of hundreds or thousands of computers to send a large amount of traffic to a specific web page and overload the site. There are different types of DDoS attacks, but the objective is always the same: to collapse a web. The attackers used this tactic to tear down the pages of their enemies. However, they started using this method to attack portals such as Yahoo, MSN, online stores, banks or government websites. Groups like Anonymous and LulzSec used DDoS attacks against these types of organizations. Meanwhile, cybercriminals used this type of attack on banking pages to hide other more important attacks on these banking entities.

In addition to performing DDoS attacks, botmasters use botnets for other malicious purposes.

Sending Spam: Most often a botnet is used to send spam to email addresses. Normally the creators of these Botnets sell their services to spammers. In at least one case, an investigation (the Rustock network) managed to find out that a single hacker had gained control of a million computers, using them as a platform for their attacks, with which he was able to send 30 billion spam per day.

Bitcoin Mining: With the appearance of cryptocurrencies, already in 2011 there were reports of a new use for botnets: using computer processing to generate bitcoins. In this way criminals can obtain resources without spending on hardware or in energy consumption.It is expected that this use will continue to increase in the future.An example of these networks is ZeroAccess botnet.

Advertising Fraud
Computer criminals use the combined processing power of botnets to carry out fraudulent actions. For example, botmasters carry out advertising scams by ordering thousands of infected computers to visit fraudulent websites and click on ads placed there. For each click, the hacker receives a commission from the advertiser.

Share on Facebook Share on Twitter