Botnets have become one of the biggest threats to security systems today. Their growing popularity among cybercriminals comes from their ability to infiltrate almost any internet-connected device, from DVR players to corporate mainframes.
Botnets are also becoming a larger part of cultural discussions around cyber security. Facebook’s fake ad controversy and the Twitter bot fiasco during the 2016 presidential election worry many politicians and citizens about the disruptive potential of botnets. Recently published studies from MIT have concluded that social media bots and automated accounts play a major role in spreading fake news.
The use of botnets to mine cryptocurrencies like Bitcoin is a growing business for cyber criminals. It’s predicted the trend will continue, resulting in more computers infected with mining software and more digital wallets stolen.
Aside from being tools for influencing elections and mining cryptocurrencies, botnets are also dangerous to corporations and consumers because they’re used to deploy malware, initiate attacks on websites, steal personal information, and defraud advertisers.
It’s clear botnets are bad, but what are they exactly? And how can you protect your personal information and devices? Step one is understanding how bots work. Step two is taking preventative actions.
How Do Botnets Work?
To better understand how botnets function, consider that the name itself is a blending of the words “robot” and “network”. In a broad sense, that’s exactly what botnets are: a network of robots used to commit cyber crime. The cyber criminals controlling them are called botmasters or bot herders.
Size Matters
To build a botnet, botmasters need as many infected online devices or “bots” under their command as possible. The more bots connected, the bigger the botnet. The bigger the botnet, the bigger the impact. So size matters. The criminal’s ultimate goal is often financial gain, malware propagation, or just general disruption of the internet.
Imagine the following: You’ve enlisted ten of your friends to call the Department of Motor Vehicles at the same time on the same day. Aside from the deafening sounds of ringing phones and the scurrying of State employees, not much else would happen. Now, imagine you wrangled 100 of your friends, to do the same thing. The simultaneous influx of such a large number of signals, pings, and requests would overload the DMV’s phone system, likely shutting it down completely.
Cybercriminals use botnets to create a similar disruption on the internet. They command their infected bot army to overload a website to the point that it stops functioning and/or access is denied. Such an attack is called a denial of service or DDoS.
Botnet Infections
Botnets aren’t typically created to compromise just one individual computer; they’re designed to infect millions of devices. Bot herders often deploy botnets onto computers through a trojan horse virus. The strategy typically requires users to infect their own systems by opening email attachments, clicking on malicious pop up ads, or downloading dangerous software from a website. After infecting devices, botnets are then free to access and modify personal information, attack other computers, and commit other crimes.
More complex botnets can even self-propagate, finding and infecting devices automatically. Such autonomous bots carry out seek-and-infect missions, constantly searching the web for vulnerable internet-connected devices lacking operating system updates or antivirus software.
Botnets are difficult to detect. They use only small amounts of computing power to avoid disrupting normal device functions and alerting the user. More advanced botnets are even designed to update their behavior so as to thwart detection by cybersecurity software. Users are unaware they’re connected device is being controlled by cyber criminals. What’s worse, botnet design continues to evolve, making newer versions harder to find.
Botnets take time to grow. Many will lay dormant within devices waiting for the botmaster to call them to action for a DDoS attack or for spam dissemination.
Vulnerable Devices
Botnets can infect almost any device connected directly or wirelessly to the internet. PCs, laptops, mobile devices, DVR’s, smartwatches, security cameras, and smart kitchen appliances can all fall within the web of a botnet.
Although it seems absurd to think of a refrigerator or coffee maker becoming the unwitting participant in a cyber crime, it happens more often than most people realize. Often appliance manufacturers use unsecure passwords to guard entry into their devices, making them easy for autonomous bots scouring the internet to find and exploit.
As the never-ending growth of the Internet of Things brings more devices online, cyber criminals have greater opportunities to grow their botnets, and with it, the level of impact.
In 2016, a large DDoS attack hit the internet infrastructure company Dyn. The attack used a botnet comprised of security cameras and DVRs. The DDoS disrupted internet service for large sections of the country, creating problems for many popular websites like Twitter and Amazon.
Botnet Attacks
Aside from DDoS attacks, botmasters also employ botnets for other malicious purposes.
Ad Fraud
Cybercriminals can use the combined processing power of botnets to run fraudulent schemes. For example, botmasters build ad fraud schemes by commanding thousands of infected devices to visit fraudulent websites and “click” on ads placed there. For every click, the hacker then gets a percentage of the advertising fees.
Selling and Renting Botnets
Botnets can even be sold or rented on the internet. After infecting and wrangling thousands of devices, botmasters look for other cybercriminals interested in using them to propagate malware. Botnet buyers then carry out cyber attacks, spread ransomware, or steal personal information.
Laws surrounding botnets and cybercrime continue to evolve. As botnets become bigger threats to internet infrastructure, communications systems, and electrical grids, users will be required to ensure their devices are adequately protected from infection. It’s likely cyber laws will begin to hold users more responsible for crimes committed by their own devices.
Botnet Structures
Botnet structures usually take one of two forms, and each structure is designed to give the botmaster as much control as possible.
Client-server model
The client-server botnet structure is set up like a basic network with one main server controlling the transmission of information from each client. The botmaster uses special software to establish command and control (C&C) servers to relay instructions to each client device.
While the client-server model works well for taking and maintaining control over the botnet, it has several downsides: it’s relatively easy for law enforcement official to location of the C&C server, and it has only one control point. Destroy the server, and the botnet is dead.
Peer-to-peer
Rather than relying on one centralized C&C server, newer botnets have evolved to use the more interconnected peer-to-peer (P2P) structure. In a P2P botnet, each infected device functions as a client and a server. Individual bots have a list of other infected devices and will seek them out to update and to transmit information between them.
P2P botnet structures make it harder for law enforcement to locate any centralized source. The lack of a single C&C server also makes P2P botnets harder to disrupt. Like the mythological Hydra, cutting off the head won’t kill the beast. It has many others to keep it alive.
Botnet Prevention
It should be clear by now that preventing botnet infection requires a comprehensive strategy; one that includes good surfing habits and antivirus protection. Now that you’ve armed yourself with the knowledge of how botnets work, here are some ways to keep botnets at bay.
Update your operating system
One of the tips always topping the list of malware preventative measures is keeping your OS updated. Software developers actively combat malware; they know early on when threats arise. Set your OS to update automatically and make sure you’re running the latest version.
Avoid email attachments from suspicious or unknown sources
Email attachments are a favorite source of infection for many types of viruses. Don’t open an attachment from an unknown source. Even scrutinize emails sent from friends and family. Bots regularly use contact lists to compose and send spam and infected emails. That email from your mother may actually be a botnet in disguise.
Avoid downloads from P2P and file sharing networks
Botnets use P2P networks and file sharing services to infect computers. Scan any downloads before executing the files or find safer alternatives for transferring files.
Don’t click on suspicious links
Links to malicious websites are common infection points, so avoid clicking them without a thorough examination. Hover your cursor over the hypertext and check to see where the URL actually goes. Malicious links like to live in message boards, YouTube comments, pop up ads, and the like.
Get Antivirus Software
Getting antivirus software is the best way to avoid and eliminate botnets. Look for antivirus protection that’s designed to cover all of your devices, not just your computer. Remember, botnets sneak into all types of devices, so look software that’s comprehensive in scope.
With the Internet of Things increasing, so too does the potential for botnet size and power. Laws will eventually change to hold users more responsible for the actions of their devices. Taking preventative action now will protect your identity, data, and devices.
FAQs
What is botnet and how does it work? ›
A botnet (short for “robot network”) is a network of computers infected by malware that are under the control of a single attacking party, known as the “bot-herder.” Each individual machine under the control of the bot-herder is known as a bot.
What is a botnet quizlet? ›botnet. A network of computer that have been infected by viruses or worms. the computer on a botnet can be used to spam other computers, or their processing power can be harnessed by the hacker and used for illicit purposes.
What is botnet in security? ›Botnet refers to a network of hijacked internet-connected devices that are installed with malicious codes known as malware. Each of these infected devices is known as Bots, and a hacker/cybercriminal known as the "Bot herder" remotely controls them.
What is botnet and how do you prevent it? ›Botnets are designed to exploit vulnerabilities in your network, which includes unpatched security risks in connected devices. Keep those devices more secure by installing antivirus and other software updates and patches as soon as they become available.
What is an example of botnet in cyber security? ›For example, an ad fraud botnet infects a user's PC with malicious software that uses the system's web browsers to divert fraudulent traffic to certain online advertisements. However, to stay concealed, the botnet won't take complete control of the operating system (OS) or the web browser, which would alert the user.
What is an example of a botnet? ›A typical example of botnet-based spam attacks is fraudulent online reviews, where a fraudster takes over user devices, and posts spam online reviews in bulk without actually using the service or product.
Is botnet a security threat? ›A botnet attack is any attack leveraging a botnet—a group of bots and devices linked together to perform the same task—for distribution and scaling. Botnet attacks are used by cybercriminals to carry out intense scraping, DDoS, and other large-scale cybercrime.
Why is botnet a threat? ›Targeted intrusions are typically executed by smaller botnets designed for compromising organizations' specific, high-value systems or networks. Once inside, attackers can penetrate and intrude even further into an enterprise's systems and gain access to their most valuable assets.
What is another term for botnet? ›(roBOT NETwork) Also called a "zombie army," a botnet is a large number of compromised computers that are used to generate spam, relay viruses or flood a network or Web server with excessive requests to cause it to fail (see denial-of-service attack).
Why do hackers use botnets? ›Hackers use botnets for several scams, including flooding other servers with traffic to shut down targeted websites. They might also use infected computers to mine cryptocurrency or send phishing emails in an attempt to trick victims into giving up their personal and financial information.
How many botnets are there? ›
Although botnets have been around since the 1990s, they've grown staggeringly fast, especially over the past year. As the report notes, in the first half of 2022 alone, there were more than 67 million connections from more than 600,000 unique IP addresses across 30,000 organizations and 168 countries.
What is botnet command? ›A botnet is a group of malware-infected and internet-connected bots that are controlled by a threat actor. Most botnets have a centralized command-and-control architecture, although peer-to-peer (P2P) botnets are on the rise due to their decentralized nature, which offers more control to the threat actors.
What controls a botnet? ›A botnet's originator (known as a "bot herder" or "bot master") controls the botnet remotely. This is known as the command-and-control (C&C). The program for the operation must communicate via a covert channel to the client on the victim's machine (zombie computer).
How are botnets removed? ›Use antivirus software: A trustworthy antivirus tool will give you free botnet scanning and removal while protecting you against other types of malware as well.
How can botnets affect your computer? ›The most direct impact is that an infected machine is no longer under the legitimate user's control. Most people today store highly sensitive content (such as financial or legal details) on their personal devices; such information becomes vulnerable once the device is infected.
What is the difference between botnet and malware? ›Malware is generally defined as software built for the purpose of disrupting or damaging a computer system and has existed almost as long as the internet has. A botnet is a collection of computers that have been infected with similar malware.
Do hackers use botnets? ›Botnets are behind most large-scale cyber attacks launched on the internet. Using a highly distributed network of bots, hackers perform a wide range of fraudulent activities, from denial of service attacks to data theft.
Is My computer A botnet? ›If your computer shuts down or reboots unexpectedly, it could be part of a botnet. Unexpected shutdowns are particularly common with botnet computers. Assuming there are no hardware problems with your computer, it shouldn't shut down unexpectedly. This is just one more sign that your computer is part of a botnet.
Is botnet good or bad? ›Botnets are a double sided-sword. When used wisely, they can benefit your business in a number of ways. One such example is Googlebot, which is used to crawl the web and enhance search results. But, when used with malicious intent, bots can wreak havoc, hurting your business.
Which two attacks typically use a botnet? ›- Phishing attacks. ...
- Distributed Denial-of-Service (DDoS) attacks. ...
- Brute force attacks. ...
- Ensure all systems are updated. ...
- Maintain good cybersecurity hygiene. ...
- Establish control access to machines and systems. ...
- Continuously monitor network traffic. ...
- Require cybersecurity training for employees.
How do hackers create a botnet? ›
Hackers create botnets by installing malware on a targeted computer or device. The malware then links the infected device to the botnet's command and control center, which the hacker uses to tell the computers in the botnet what to do.
Can botnet steal data? ›A bot coordinator is an individual or group who is responsible for controlling a botnet, a network of computers infected with malicious software and controlled as a group without the owners' knowledge or permission. The botnet coordinator can use the botnet to launch DDoS attacks, steal data, and spread malware.
What type of malware is a botnet? ›Botnets are networks of computers infected by malware (such as computer viruses, key loggers and other malicious software) and controlled remotely by criminals, usually for financial gain or to launch attacks on websites or networks.
How do hackers get botnets? ›Botnets are created by infecting computer systems with malicious software, which in most cases comes in the form of a trojan horse virus that a user can inadvertently download or the malicious payload hackers install on an already compromised server or website.
Are botnets illegal? ›Unless you have permission from everyone whose computer you use, creating a botnet is illegal. The tasks that most hackers use botnets for—like DDoS attacks—are also illegal on their own.
What can a botnet do to your device? ›A botnet is a group of Internet-connected devices, each of which runs one or more bots. Botnets can be used to perform Distributed Denial-of-Service (DDoS) attacks, steal data, send spam, and allow the attacker to access the device and its connection.
What would hackers use a botnet to perform? ›Hackers use botnets for several scams, including flooding other servers with traffic to shut down targeted websites. They might also use infected computers to mine cryptocurrency or send phishing emails in an attempt to trick victims into giving up their personal and financial information.
How do botnets start? ›Bot-herders can create botnets by sending malware to unknowing recipients via file sharing, email, social media application protocols, or by using other bots as intermediaries. Once opened, malicious files infect devices with malicious code that instructs the computer to report back to the bot-herder.
How is botnet installed? ›Bot herders often deploy botnets onto computers through a trojan horse virus. The strategy typically requires users to infect their own systems by opening email attachments, clicking on malicious pop up ads, or downloading dangerous software from a website.
Can you trace a botnet? ›Many botnet operators use IP addresses sourced from the darknet (i.e the unused IP addresses space held by ISPs) to make DDoS attacks more untraceable. So when you try to trace the attack back, you'll only find the hijacked addresses and not the attacker behind them.
Does botnet need internet? ›
Candidates for botnet recruitment can be any device that can access an internet connection. Many devices we use today have some form of computer within them — even ones you might not consider. Nearly any computer-based internet device is vulnerable to a botnet meaning the threat is growing constantly.
What are the dangers of botnets? ›Botnets can range in size from only a few hundreds to millions of infected devices. Attackers typically use the collective resources of the botnet to perform various disruptive or criminal activities, such as sending vast amounts of spam emails, distributing malware and launching Denial-of-Service attacks.
Why do criminals use botnets? ›The idea behind using botnets for DDoS attacks is to overwhelm a target server with a massive number of requests (from the zombie devices) to crash, or at least slow down, the server significantly. DDoS is one of the most common ways botnets are utilized in criminal attacks, and often the most dangerous.
What language are botnets coded in? ›Java. This language is widely used in systems programming and mobile app development, so it's popular with hackers who want to access operating systems or exploit mobile vulnerabilities. Java is often used to create botnets and perform identity theft.
What are the signs that your computer is infected with a bot? ›- Frequent computer crashes without an identifiable reason.
- Slow internet access.
- Problems with computer shut down (it takes its time to shut down or doesn't shut down completely/correctly)
Your antivirus tool detects botnet malware: Many of the best free antivirus tools are excellent botnet scanners. They'll scan for botnets and other threats, then remove the malware if any are found.