What Is A Botnet?

Date First Published: 22nd May 2023

Topic: Cybersecurity

Subtopic: Threats To Systems, Data & Information

Article Type: Computer Terms & Definitions

Difficulty Level: 7/10

Learn more about what a botnet is in this article.

A botnet is a network of hijacked computers infected with malware that are controlled by a single attacking party to carry out cyberattacks and other malicious activities, like bringing servers down by DDoS attacks, spreading malware, stealing sensitive information, engaging in brute-force attacks, engaging in click fraud campaigns, engaging in Bitcoin mining, and sending spam emails. Any device with internet capabilities can be part of a botnet as long as it can be infected with malware. This includes desktop computers, laptops, smartphones, tablets, game consoles, and even smart devices.

The goal of a botnet is to infect as many computers as possible with malware and send commands to all the computers and use the computing power and functionality of those computers for automated tasks to do harm to other networks and computers, whilst remaining hidden from the user. However, not all botnets are designed to attack other computers and networks. Some attackers leave their botnets inactive and use them to spy on victims and install malware, including ransomware and Trojan horses.

Note:

The word 'botnet' is a combination of the words 'robot' and 'network'.

How Do Botnets Spread?

Attackers often use malware and distribute it over a network or through email attachments. When a user opens the email attachment or the malicious program, they will be infected without them knowing that it has been installed on their computer. This causes their computer to be infected with an army of other infected computers to perform malicious attacks and be part of the botnet. Once the botnet has reached a sufficient size, the attacker can use the combined power of all the computers (bots) to perform the automated tasks.

Some botnet malware may automatically spread itself as part of a worm by automatically scanning vulnerable network devices and infecting them once discovered. This method of getting computers infected is more powerful when the attacker takes advantage of a zero-day vulnerability that hasn't been discovered or patched yet.

Size Of Botnets

Botnets are not limited to just a few computers. Botnets could be hundreds or even thousands of computers located all around the world. Botnets range from just a few computers to several thousand computers. Even though larger botnets cause the most harm, the larger the botnet, the easier it is to locate and break apart. This is because the unusually high amount of bandwidth used by these botnets may alert ISPs, which could possibly lead to the botnet being discovered and dismantled.

How To Tell If A Computer Is Part Of A Botnet?

There is no single way to tell whether a computer is part of a botnet. However, there are some signs that indicate that a computer is part of a botnet. Below are five signs that a computer is part of a botnet.

• Slow internet connection or sudden bandwidth spikes. Botnets slow down your internet connection because the attacker uses your computer to spam networks with malicious traffic. If your internet connection is suddenly slow for no apparent reason, this can indicate that a botnet is working in the background and congesting your internet connection, which will cause websites to load slowly. Also, a sudden increase in bandwidth usage can indicate botnet malware.
• Inability to update your operating system. Botnet malware can make it harder for you to update your operating system so that it can stay on your system. If you cannot seem to update your operating system or the options have disappeared, this is another sign of botnet malware.
• Unexpected shutdowns or reboots. Unexpected shutdowns or reboots are common with computers infected with botnet malware. As long as there are no hardware problems on your computer, it should not abruptly shut down without notice.
• Unexpected changes to your system. A botnet can alter your system files, change your browser settings or desktop background without your permission, or change your computer settings. If you have noticed unexpected changes to your system that you never remember changing yourself, this is another sign of botnet malware.
• Malware detected by your antivirus. Strong antivirus software is good at detecting botnet malware. If you think that your computer is infected with a botnet, have run an antivirus scan and it has found malware, you should investigate in more detail whether your computer may be part of a botnet. Obviously, not all malware is used for botnets, but if you have removed the detected malware and you are no longer experiencing any of the signs above, then your computer was likely hijacked for a botnet.

How To Protect Against Botnets?

Below are five tips to protect a computer against botnets.

• Don't open unexpected email attachments. Unexpected email attachments can contain botnet malware and are a common way of getting a virus or malware infection. If you receive an unexpected attachment from someone that you don't know, do not open it. Even if it is someone from you know, if the attachment looks off or suspicious, it is best not to open it and confirm with the recipient that it is the file they intended to send.
• Always keep your operating system and software up to date. Attackers exploit vulnerabilities in operating systems, and applications to infect devices with botnet malware. Updates can fix bugs and vulnerabilities discovered by other users.
• Use strong antivirus software and keep it up to date. Strong antivirus software is useful for detecting and removing botnet malware from computers. Also, it is important to keep it up to date so that it can detect the latest threats.
• Use a firewall. Whilst a firewall doesn't guarantee that your computer will be immune to botnets, a trusted firewall will alert you to suspicious web traffic and help you block unwanted botnet traffic.
• Don't download things from websites you don't know. This is the most common way that computers catch viruses and malware, including botnet malware. If you download something from a website that you don't know, it might contain botnet malware. It is not uncommon for them to come up in search engines when looking for downloads for software programs or applications. You should only download things, especially software, from reputable websites that you trust.

Examples Of Botnets

In 2007, the Zeus malware was first detected. It is one of the most well-known and widely used malware types in the history of information security. It uses a Trojan horse program to infect vulnerable devices. Variants of this malware have been used for multiple purposes over the years, including spreading CryptoLocker ransomware.

Originally, Zeus, or Zbot, was used to steal banking credentials and financial information from users of infected devices. Attackers used the bots to send out spam and phishing emails that spread the Zeus Trojan to more users once this data was collected.

An example of a click fraud botnet was Methbot. It was revealed in 2016 by White Ops, a cybersecurity services company. According to security researchers, Methbot was generating between $3 million and $5 million in fraudulent ad revenue daily by generating fraudulent clicks for online ads and automated views of video ads.

Instead of infecting random devices, the Methbot campaign was run on around 800 to 1200 dedicated servers in data centres located in the United States and the Netherlands. The click fraud campaign included 6000 spoofed domain names and over 850,000 IP addresses, most of which were falsely registered as belonging to legitimate ISPs.

The infected servers generated fake clicks and mouse movements and faked Facebook and LinkedIn social media accounts to appear as legitimate users to trick traditional click fraud detection mechanisms.

In order to stop the click fraud campaign, White Ops published a list of the spoofed domains and fraudulent IP addresses to notify advertisers and allow them to block the addresses.

Comments