What is a botnet?

A botnet is a group of computers controlled from a single source that run related software.

Originally, botnets were created as a tool with valid purposes in Internet relay chat (IRC) channels. Eventually, hackers exploited the vulnerabilities in IRC networks and developed bots to perform malicious activities such as password theft, keystroke logging.

An attacker will often target computers not safeguarded with firewalls and/or anti-virus software. A botnet manipulator may get control of a computer usually by one of two ways: drive-by downloads and email.

Drive-by download infections require the attacker to find a popular website with an exploitable vulnerability. The attacker then loads his own malicious code on the site and rigs it to exploit a vulnerability in a common browser such as Google Chrome or Internet Explorer. This code will then redirect the user’s browser to another site controlled by the attacker where the bot code will be downloaded and installed on the user’s machine.

The email infection vector is easier. The attacker sends out a large batch of spam that includes either a file such as a Word document or PDF with malicious code in it, or a link to a site where the malicious code is hosted. In either case, once the attacker’s code is on the user’s machine, that PC is now part of the botnet. The attacker can issue remote commands to the PC, upload data from the machine, download new components and generally do what he wants with it.

Botnets are significant because they have become tools that both hackers and organized crime use to perform illegal activities online. For example, hackers use botnets to launch coordinated denial-of-service attacks, while organized crime uses botnets as ways to spam, or send a phishing attack that is then used for identify theft.

Users are reminded on the importance of effective anti-virus and firewall software to safeguard their connections.