Product Code Database
A botnet is a group of Internet-connected devices, each of which runs one or more Internet bot. Botnets can be used to perform distributed denial-of-service (DDoS) attacks, steal data, send Spamming, and allow the attacker to access the device and its connection. The owner can control the botnet using command and control (C&C) software. The word "botnet" is a portmanteau of the words "robot" and "Computer network". The term is usually used with a negative or malicious connotation.
Operating, building, or using a botnet to access or control devices without their owners’ authorization is illegal in most jurisdictions and is regularly prosecuted as hacking, fraud, or related Cybercrime. Law enforcement and private parties also use legal tools to disrupt botnets, but those takedowns raise separate legal and constitutional issues.
Botnets are increasingly rented out by Cybercrime as commodities for a variety of purposes, including as booter/stresser services.
In the case of IRC bot, infected clients connect to an infected IRC server and join a channel pre-designated for C&C by the bot herder. The bot herder sends commands to the channel via the IRC server. Each client retrieves the commands and executes them. Clients send messages back to the IRC channel with the results of their actions. (2007). 9781597491358, Syngress. ISBN 9781597491358
Newer botnets fully operate over P2P networks. Rather than communicate with a centralized server, P2P bots perform as both a command distribution server and a client which receives commands. This avoids having any single point of failure, which is an issue for centralized botnets.
In order to find other infected machines, P2P bots discreetly probe random until they identify another infected machine. The contacted bot replies with information such as its software version and list of known bots. If one of the bots' version is lower than the other, they will initiate a file transfer to update. This way, each bot grows its list of infected machines and updates itself by periodically communicating to all known bots.
Some botnets implement custom versions of well-known protocols. The implementation differences can be used for detection of botnets. For example, Mega-D features a slightly modified Simple Mail Transfer Protocol (SMTP) implementation for testing spam capability. Bringing down the Mega-D's SMTP server disables the entire pool of bots that rely upon the same SMTP server.C.Y. Cho, D. Babic, R. Shin, and D. Song. , 2010 ACM Conference on Computer and Communications Security.
The process of stealing computing resources as a result of a system being joined to a "botnet" is sometimes referred to as "scrumping".
One problem with using IRC is that each bot client must know the IRC server, port, and channel to be of any use to the botnet. Anti-malware organizations can detect and shut down these servers and channels, effectively halting the botnet attack. If this happens, clients are still infected, but they typically lie dormant since they have no way of receiving instructions. To mitigate this problem, a botnet can consist of several servers or channels. If one of the servers or channels becomes disabled, the botnet simply switches to another. It is still possible to detect and disrupt additional botnet servers or channels by sniffing IRC traffic. A botnet adversary can even potentially gain knowledge of the control scheme and imitate the bot herder by issuing commands correctly. (2007). 9781597491358, Syngress. ISBN 9781597491358
Some have also used encryption as a way to secure or lock down the botnet from others, most of the time when they use encryption it is public-key cryptography and has presented challenges in both implementing it and breaking it.
Disadvantages of using this method are that it uses a considerable amount of bandwidth at large scale, and domains can be quickly seized by government agencies with little effort. If the domains controlling the botnets are not seized, they are also easy targets to compromise with denial-of-service attacks.
Fast flux can be used to make it difficult to track down the control servers, which may change from day to day. Control servers may also hop from DNS domain to DNS domain, with domain generation algorithms being used to create new DNS names for controller servers.
Some botnets use free DNS hosting services such as DynDNS, No-IP, and Afraid.org to point a subdomain towards an IRC server that harbors the bots. While these free DNS services do not themselves host attacks, they provide reference points (often hard-coded into the botnet executable). Removing such services can cripple an entire botnet.
Newer bots can automatically scan their environment and propagate themselves using vulnerabilities and weak passwords. Generally, the more vulnerabilities a bot can scan and propagate through, the more valuable it becomes to a botnet controller community.
Computers can be co-opted into a botnet when they execute malicious software. This can be accomplished by luring users into making a drive-by download, exploiting browser exploit, or by tricking the user into running a Trojan horse program, which may come from an email attachment. This malware will typically install modules that allow the computer to be commanded and controlled by the botnet's operator. After the software is downloaded, it will call home (send a reconnection Network packet) to the host computer. When the re-connection is made, depending on how it is written, a Trojan may then delete itself or may remain present to update and maintain the modules.
China's Great Cannon allows the modification of legitimate web browsing traffic at internet backbones into China to create a large ephemeral botnet to attack large targets such as GitHub in 2015.
While botnets are often named after the malware that created them, multiple botnets typically use the same malware but are operated by different entities. Many-to-Many Botnet Relationships , Damballa, 8 June 2009.
Computer security experts have succeeded in destroying or subverting malware command and control networks, by, among other means, seizing servers or getting them cut off from the Internet, denying access to domains that were due to be used by malware to contact its C&C infrastructure, and, in some cases, breaking into the C&C network itself. In response to this, C&C operators have resorted to using techniques such as overlaying their C&C networks on other existing benign infrastructure such as IRC or Tor, using peer-to-peer networking systems that are not dependent on any fixed servers, and using public key encryption to defeat attempts to break into or spoof the network.
Norton AntiBot was aimed at consumers, but most target enterprises and/or ISPs. Host-based techniques use heuristics to identify bot behavior that has bypassed conventional anti-virus software. Network-based approaches tend to use the techniques described above; shutting down C&C servers, null-routing DNS entries, or completely shutting down IRC servers. BotHunter is software, developed with support from the U.S. Army Research Office, that detects botnet activity within a network by analyzing network traffic and comparing it to patterns characteristic of malicious processes.
Researchers at Sandia National Laboratories are analyzing botnets' behavior by simultaneously running one million Linux kernels—a similar scale to a botnet—as virtual machines on a 4,480-node high-performance computer cluster to emulate a very large network, allowing them to watch how botnets work and experiment with ways to stop them.
Detecting automated bot becomes more difficult as newer and more sophisticated generations of bots get launched by attackers. For example, an automated attack can deploy a large bot army and apply brute-force methods with highly accurate username and password lists to hack into accounts. The idea is to overwhelm sites with tens of thousands of requests from different IPs all over the world, but with each bot only submitting a single request every 10 minutes or so, which can result in more than 5 million attempts per day. In these cases, many tools try to leverage volumetric detection, but automated bot attacks now have ways of circumventing triggers of volumetric detection.
One of the techniques for detecting these bot attacks is what's known as "signature-based systems" in which the software will attempt to detect patterns in the request packet. However, attacks are constantly evolving, so this may not be a viable option when patterns cannot be discerned from thousands of requests. There is also the behavioral approach to thwarting bots, which ultimately tries to distinguish bots from humans. By identifying non-human behavior and recognizing known bot behavior, this process can be applied at the user, browser, and network levels.
The most capable method of using software to combat against a virus has been to utilize honeypot software in order to convince the malware that a system is vulnerable. The malicious files are then analyzed using forensic software.
On 15 July 2014, the Subcommittee on Crime and Terrorism of the Committee on the Judiciary, United States Senate, held a hearing on the threats posed by botnets and the public and private efforts to disrupt and dismantle them.
The rise in vulnerable IoT devices has led to an increase in IoT-based botnet attacks. To address this, a novel network-based anomaly detection method for IoT called N-BaIoT was introduced. It captures network behavior snapshots and employs deep autoencoders to identify abnormal traffic from compromised IoT devices. The method was tested by infecting nine IoT devices with Mirai and BASHLITE botnets, showing its ability to accurately and promptly detect attacks originating from compromised IoT devices within a botnet.
Additionally, comparing different ways of detecting botnets is really useful for researchers. It helps them see how well each method works compared to others. This kind of comparison is good because it lets researchers evaluate the methods fairly and find ways to make them better.
Around 2006, to thwart detection, some botnets were scaling back in size.
The following is a non-exhaustive list of some historical botnets.
| 2002 | MaXiTE | 500-1000 servers | 0 | MaXiTE XDCC Bot, MaXiTE IRC TCL Script, MaxServ | |
| Unknown (no later than 2004) | Marina Botnet | 6,215,000 | 92 | ||
| Torpig | 180,000 | Sinowal, Anserin | |||
| Storm botnet | 160,000 | 3 | Nuwar, Peacomm, Zhelatin | ||
| 2006 (around) | 2011 (March) | Rustock botnet | 150,000 | 30 | RKRustok, Costrat |
| Donbot botnet | 125,000 | 0.8 | Buzus, Bachsoy | ||
| 2007 (around) | Cutwail botnet | 1,500,000 | 74 | Pandex, Mutant (related to: Wigon, Pushdo) | |
| 2007 | Akbot | 1,300,000 | |||
| 2007 (March) | 2008 (November) | Srizbi botnet | 450,000 | 60 | Cbeplay, Exchanger |
| 2008 (around) | Sality | 1,000,000 | Sector, Kuku | ||
| 2008 (around) | 2009-Dec | Mariposa botnet | 12,000,000 | ||
| 2008 (around) | Kraken botnet | 495,000 | 9 | Kracken | |
| 2008 (November) | Conficker | 10,500,000+ | 10 | DownUp, DownAndUp, DownAdUp, Kido | |
| 2008 (November) | 2010 (March) | Waledac botnet | 80,000 | 1.5 | Waled, Waledpak |
| Onewordsub | 40,000 | 1.8 | |||
| Nucrypt | 20,000 | 5 | Loosky, Locksky | ||
| Wopla | 20,000 | 0.6 | Pokier, Slogger, Cryptic | ||
| 2008 (around) | Asprox botnet | 15,000 | Danmec, Hydraflux | ||
| Spamthru | 12,000 | 0.35 | Spam-DComServ, Covesmer, Xmiler | ||
| 2008 (around) | Gumblar | ||||
| 2009 (May) | November 2010 (not complete) | BredoLab botnet | 30,000,000 | 3.6 | Oficla |
| 2009 (Around) | 2012-07-19 | Grum botnet | 560,000 | 39.9 | Tedroo |
| Mega-D botnet | 509,000 | 10 | Ozdok | ||
| 2009 (August) | Festi botnet | 250,000 | 2.25 | Spamnost | |
| 2010 (March) | Vulcanbot | ||||
| 2010 (around) | TDL4 | 4,500,000 | TDSS, Alureon | ||
| Zeus | 3,600,000 (US only) | Zbot, PRG, Wsnpoem, Gorhax, Kneber | |||
| 2010 | (Several: 2011, 2012) | Kelihos botnet | 300,000+ | 4 | Hlux |
| 2011 or earlier | 2015-02 | Ramnit | 3,000,000 | ||
| 2012 (Around) | Chameleon botnet | 120,000 | None | ||
| 2014 | Necurs botnet | 6,000,000 | |||
| 2016 (August) | Mirai | 380,000 | None | ||
| 2022 | Mantis | 5000 | |||
| August 2025 | Rapper Bot | 20,000+ |
|
|
