Question

You are required to research Botnets and provide a one page summary of the following:
1. What are Botnets?
2. What are some of the functions that Botnets can perform?
3. Statistics indicating the effects of major Botnet attacks in the past decade?
4. What are some of the different types of Botnets?
5. What are some of the ways to protect against Botnets?
Please list all references used.

Answer 1

1. What are Botnets?

The word 'botnet' is derived from two words robot and network. It is a network of computers that are on-purpose infected with malware by cyber-criminals, hackers,etc. to perform tasks unethically on a victims device. It uses "standards-based network protocols" to communicate between the attacking and attacked devices. These internet-connected devices which make up botnet may include PC, servers, mobile and IOT devices which are infected and controlled by a common type of malware.

2. What are some of the functions that Botnets can perform?

Botnets are used to perform DDoS attacks, stealing of data, spams and allow the attacker to access devices and its connection total control. The main motive for using botnet is to infect as many connected devices as possible and use computing power and resources of these devices for automated tasks that remain hidden to the users of the devices. Using these acquired computational power botnets are used to mine many crypto-currencies (eg. Bitcoin, ethereum, Litcoin, EOS, etc.). They can also steal your digital wallets, generate fake Internet traffic on websites for financial gain, replacing banners and adds to target the specific consumer, pop-ups, etc. As they can control pop-ups and add banners they are also used to influence elections and other political campaigns.

3. Statistics indicating the effects of major Botnet attacks in the past decade?

Botnets have had some major attacks in the past. "Zeus". Malware of information security. It used Trojan Horse. It was used steal banking credentials and financial information from users of infected devices. In 2010, it was estimated that over 3.6 million devices were infected with this botnet. Similarly, "Kelihos" affected more than 300000 users. "Srizbi" in 2007 was estimated to be around affecting 450000 users. "Methbot" was estimated to be earning 3$-5$ million per day from fake adds revenue affecting around 1200 datacenters in US which affected more than 850000 IP addresses. Ramnit in 2011 afftected over 3 million users. A recent one, "Mirai", in 2016 was observed to be affecting 380000 devices doing DDoS attacks.

4. What are some of the different types of Botnets?

Botnets are mainly classified in four different types. They include IRC-->Internet Relay Chat botnet, P2P-->Peer-to-Peer botnet, HTTP botnet and hybrid botnet which is the combination of all these types of Botnet Structures. Nowdays, even mobile botnets are being created. Cloud Botnets are also implemented by cyber-criminals, they are known as cloud based botnet and bot cloud.

IRC bots can be used to monitor and prevent malicious interventions and perform some automated tasks. It was one of the first kind of bot developed for a beneficial purpose. Later, it can be used for demolition activities. P-2-P Botnet can be formed by using the P-2-P protocols and decentralized network of nodes. It is very difficult to shut down the P-2-P botnet due to its decentralized structure. Every P-2-P bot can be used as client and server. HTTP Botnet is centralized botnet, using HTTP protocol. Used to hide activities in normal web-traffic and escape from current detection methods like firewalls. Hybrid botnet is the combination of two or more botnet models such as IRC, P-2-P and HTTP botnets. It can be both centralized or decentralized structures. Mobile botnet can be formed by exploiting the SMS and Bluetooth features of the mobile phones.

5. What are some of the ways to protect against Botnets?

This has been established that Botnets are very dangerous. They can cause massive losses and failures. Preventing against them is very important. Although these Botnets are very sophisticated and hard to detect certain measures must be always followed. Always surf on good and trusted websites. Ensure that while entering sensitive information the website has https protocol. Have a good and trusted antivirus software which is updated. Ensure to install latest updates and security patches of the operating system you are using. Avoid spam emails and suspicious emails and sms as they tend to have virus, malware and botnets in their attachments. Never click on suspicious links and adds like winning lottery, free money, etc. They are most probably malicious. Avoid P-2-P file sharing as botnets can easily spread.

Please rate a THUMBS UP if you find it useful and Best of Luck :-)