Technical Consultant

Botnet is a collection of software agents, or robots, that run autonomously and automatically. The term is most commonly associated with malicious software, but it can also refer to the network of computers using distributed computing software. While botnets are often named after their malicious software name, there are typically multiple botnets in operation using the same malicious software families, but operated by different criminal entities.

A botnet (also known as a zombie army) is a number of Internet computers that, although their owners are unaware of it, have been set up to forward transmissions (including spam or viruses) to other computers on the Internet. Any such computer is referred to as a zombie – in effect, a computer “robot” or “bot” that serves the wishes of some master spam or virus originator. Most computers compromised in this way are home-based. According to a report from Russian-based Kaspersky Labs, botnets — not spam, viruses, or worms — currently pose the biggest threat to the Internet. A report from Symantec came to a similar conclusion.

Computers that are coopted to serve in a zombie army are often those whose owners fail to provide effective firewalls and other safeguards. An increasing number of home users have high speed connections for computers that may be inadequately protected. A zombie or bot is often created through an Internet port that has been left open and through which a small Trojan horse program can be left for future activation. At a certain time, the zombie army “controller” can unleash the effects of the army by sending a single command, possibly from an Internet Relay Channel (IRC) site.

The typical lifecycle of spam that originates from a botnet:
1. Spammer’s web site
2. Spammer
3. Spamware
4. Infected computers
5. Virus or trojan
6. Mail servers
7. Users
8. Web traffic

Botnet typically perform the following

1. Backdoor/downloader
2. SMTP relay
3. E-mail address stealer
4. E-mail virus spreader
5. Distributed denial of service (DDos) attack tool
6. Updated copy of Storm Worm dropper

Defending Against Botnets

1. Firewalls – “Full” security includes anti-virus, anti-spam, anti-adware systems with constant and timely updates as well as firewalls, intrusion detection software and e-mail gateways
2. Establishing a workable patch management system which ensures that security patches are updated frequently and as soon as they are made available;
3. Educating users to be wary of attachments or weblinks in their email. Most malicious code (in the form of Trojans, worms and the like) are embedded in innocuous email attachments or weblinks that allow the code to sneak in;
4. Shutting down external access, especially through the ‘ports’ (pathways in and out of the system that are used to move programs and files) which are not used for particular applications. Among the ports which should be considered for full or partial closure are those used for Internet Relay Chats (IRCs) and File Transfer Protocols (FTP) applications which are favored means for bots to communicate with their ‘controllers’;
5. For operators and webmasters, a key learning lies in monitoring the traffic ‘flux’ of the network, which would lead to the operators and webmasters being able to detect or suspect if a botnet attack is underway; and
6. Developing a systematic plan to disrupt a botnet attack, including knowing how to isolate a ‘polluted’ machine from the network as soon as an attack is detected. The machine can then be studied at leisure, pinpointing the vulnerabilities which allowed the bots in and developing patches or approaches to deal with the problem.