What Is a Botnet?
A botnet is a network of bot?compromised machines that can be controlled and used to launch massive attacks by a bot?herder. Formed from the words robot and network, a botnet can be used for mass actions like distributed denial of service (DDoS) attacks, cryptomining, malware infections, or to crash a network.
Key Takeaways
- Any internet-connected device can become a bot, including computers, mobile devices, and IoT devices like smartwatches, thermostats, and televisions.
- Advanced persistent bots evade detection by cycling through IP addresses, switching identities, and mimicking human behavior to blend in with legitimate traffic.
- Bot-herders build botnets by exploiting software vulnerabilities, infecting devices with malware to create “zombie computers,” then linking thousands of compromised machines together.
- Bot traffic now comprises 51% of all web traffic, and because bots constantly evolve, defending against them requires continuous monitoring, endpoint security, user training, and regular patching.
What Is a Bot?
A bot is a software program that performs an automated task. These tasks are usually repetitive and run without interaction.
Many bots are useful, like search engine bots that crawl websites to index content. However, in the hands of cybercriminals, bots can be a powerful tool to break into accounts, scrape private information, spread disinformation, infect networks with malware, or carry out attacks. And, when linked together into a botnet, they can carry out massive attacks that deal major damage.
What Is a Bot Herder?
A bot herder is a cybercriminal who infects devices with bots, links the infected devices together into a botnet, and manages the network of infected bots to launch attacks.
What Are the Types of Botnets?
Bot herders rely on one of two main forms of architecture to manage their botnets. The form they select will depend on whether they¡¯re looking for simplicity or security.
Centralized Botnet
This is the most common type of botnet, and it falls back on the old idiom of the shortest distance between two points being a straight line.
In a centralized architecture, the bot herder has direct lines of communication with each bot. This is essentially a client-server model, using a command and control (C&C) server to send commands to each infected device. Some bot herders take things a step further by infecting a server as well, linking each bot to the infected server before relaying all communication back to the bot herder.
The centralized model is the simplest way to control a botnet, which also makes it the least secure. Because all communication is funneled through a central server, if that server fails the bot herder loses control of all their bots.
Decentralized Botnet
This more recent form of architecture uses the peer?to?peer (P2P) model, which turns each bot into both a client and a server, meaning each infected device can not only receive commands but also issue them. This architecture is more complicated to create but far more resilient, as a single point of failure does little to damage the overall botnet.
How Is a Botnet Created?
Building a botnet involves three key steps. However, the work required for these steps is significant and time?consuming.
1. Exploit:
The first item on a bot herder¡¯s to?do list is finding a weakness to exploit. That could be a weakness on a website, unguarded access to an application, or misconfigured software. The bot herder then uses this to their advantage, using it as a way to deliver their malware to devices.
2. Build a Bot:
Once the malware has been delivered and the device has been infected, the bot herder gets to work turning the device into a zombie computer, ready to mindlessly follow the bot herder¡¯s orders. The bot herder repeats this process over and over until they have enough devices under their control to begin step three.
3. Attack:
Once they¡¯ve infected hundreds, thousands, or even tens of thousands of devices, they link them all together using their chosen architecture and launch their attacks.
What Devices Are at Risk of Becoming Bots?
The short answer is anything that can connect to the internet. This means common targets like desktops and laptops, but also mobile devices, tablets, and even IOT devices like smartwatches, televisions, and thermostats. As our homes, cars, and offices become ever more internet-connected and interconnected, the options for bot herders swell¡ªespecially as many IoT devices don’t prioritize security, focusing instead on accessibility and lower costs.
Why Are Botnets so Dangerous?
Unlike many types of cyberthreats, bots can be difficult to defend against. Because there are both good bots and bad bots, it can be hard for cybersecurity defenses to differentiate between them.
In addition, bots have become more sophisticated in their behavior. For example, advanced persistent bots (APBs) can cycle through random IP addresses, switch identities, and mimic human behavior by simulating mouse events to appear as legitimate users. Because bots are such a fundamental tool in hacker toolboxes, they constantly evolve to overcome new cybersecurity defenses and tactics.
As a result, IT teams are often far behind bot herders in terms of security sophistication.
How to Protect Your Devices from Becoming Bots
There are steps you can take to keep malicious bots out of your network and prevent your devices and bandwidth from being used in a criminal botnet attack.
1. Enact strong endpoint security practices and keep your software and hardware up to date with all the latest patches.
2. Proactively prevent some bot traffic by blocking known bot hosting providers and proxy services. Keep in mind that bots can attack any endpoint, not just computers, so you want to make sure you also protect access points to things like IoT sensors, mobile apps, and APIs.
3. Train users to help them learn how to avoid bot infections through standard security practices, and strongly advise them not to click on or open suspicious emails, attachments, or links.
4. Should bots make it through your defenses, they can usually be discovered if you monitor your traffic sources for unusual activity, traffic spikes, junk conversions, or anomalous failed login attempts. Remember, however, bots are an ever-evolving threat ¡ª so what worked today might not be enough tomorrow.
