Botnet Explained
Botnet Explained
A botnet is a network of infected computers that work together to carry out an attacker’s goals. They are often used to launch automated attacks, including email spam, malware propagation, data theft and distributed denial of service (DDoS) attacks.
Botnets can be created using cheap computing power, such as cloud infrastructure. They can also be created by leveraging vulnerabilities in internet-connected devices, including Internet of Things (IoT) hardware and software.
Recruitment of Botnets
To recruit victims for a botnet, the cybercriminal must first infect them with malware that allows them to communicate with a remote server. This is done through a variety of methods, from simple web downloads and exploit kits to more sophisticated email attachments.
Once a sufficient number of infected machines have been recruited, the attacker then organizes them into a network of “bots” that they can control remotely. The attacker can then use the bots to carry out any desired actions, from launching an attack or sending spam to taking down an entire network of servers or even stealing personal account credentials to sell on the Dark Web.
Command Approach
The most common method for controlling bots is through a command and control (C&C) server. Typically, this is done through Internet Relay Chat (IRC) protocols or by sending commands to the infected devices via a peer-to-peer (P2P) communication network.
Peer-to-Peer Network Approach
Newer botnets operate over a P2P network, which avoids the single point of failure that centralized botnets can experience. These bots discreetly probe random IP addresses until they find a match, then communicate with the other bots to update their list of infected devices and send them commands.