What is a Botnet?
A Botnet is a group of infected computers or devices that are controlled by malicious software. A hacker or attacker can use a Botnet to commit different crimes like DDoS attacks, Phishing, etc.
Once the device is infected, a hidden program starts running on the victim’s computer and waits for instructions from the hacker. These instructions are called Command and Control (C&C). A C&C server communicates with the infected computers, also known as zombie devices or bots, to control them remotely. This is done by a communication protocol that is hard to identify and block.
Hackers usually build botnets for financial gain or to demonstrate their hacking skills. They can use them to do DDoS attacks, spam, phishing, form grabbing for stealing online credentials and much more.
Several authors distribute botnet malware to potential attackers, so they don’t have to create their own. The Mirai botnet, for example, is malware that targets low-cost, Linux IoT systems like routers, cameras, and home automation products to flood a target with traffic. This caused major outages at Krebs on Security, OVH and Dyn, among others.
More recently, decentralized botnets that use components of peer-to-peer filesharing have emerged. These networks eliminate the single point-of-failure present in centralized models, making them more resilient to takedown efforts. In addition, they allow the bot herder to hide their identity by spreading instruction responsibilities across the infected computer network. To further obfuscate their presence, these newer networks often use encryption.