What is a Botnet?
A botnet is a network of hijacked computers and devices infected with malware that is controlled by a hacker. These networks are often used to send spam, launch Distributed Denial of Service (DDoS) attacks, and steal online credentials through form grabbing. They may be rented out to other cybercriminals who use them for various purposes, or even turned into money-making enterprises, such as crypto mining.
The number of potential devices a hacker can co-opt into his or her botnet continues to rise, thanks to the ongoing expansion of the Internet of Things (IoT). In addition to smartphones and computers, IoT devices such as routers, light bulbs, and home security systems can all be infected with malware that allows them to connect to a bot herder over the internet.
There are two different ways that attackers control their army of hijacked zombies, referred to as bots: the traditional client-server model and a peer-to-peer approach. In the client-server model, the hacker sets up a central server that sends automated commands to the infected bots via a communications protocol. The bots then act on the instructions and attack. This model can be easier to identify and shut down. However, many modern hacker groups rely on a peer-to-peer system that uses the responsibility for passing on instructions to be embedded within each bot in the botnet. This makes it harder to locate and stop an attack by targeting just the centralized bot herder server.