Botnets -- they're dangerous, deceptive, and very difficult to detect and deal with. What's more, according to recent surveys,
the botnet threat is growing...rapidly.
Experts say it's imperative that enterprises become aware of the acute and growing dangers posed by botnets, and take decisive
and effective steps to counter them before it's too late.
New! Watch this Network World Webcast - Practical Email Governance Now. Meeting the Minimum Threshold to Regain Control Over Email.
But that's easier said than done as botnets are insidious, and use stealth as a key weapon.
Short for robot, a bot is a captured and compromised computer; and of course botnets are networks of such computers. After
being commandeered, these machines may be used for a range of nefarious purposes, including scanning networks for other vulnerable
systems, launching denial of service (DoS) attacks against a specified target, sending spam e-mails, and keystroke logging
as a prelude to ID or password theft.
Botnets are generally created through spam e-mails or adware that leaves behind a software agent, also sometimes called a
'bot'. Captured, or "botted," machines can be controlled remotely by the malware creator, referred to as the bot master or
bot herder.
If additional software has to be downloaded to complete the capture process, the bot would first do that. "It may use any
mechanism -- FTP, PFTP, HTTP -- to install the software," explains Jim Lippard, director of information security operations
at network services provider Global Crossing, whose customers include more than 35% of the Fortune 500, as well as 700 carriers,
mobile operators and ISPs.
The next thing the bot does is call home. It would "usually do a DNS lookup on a particular name used by the miscreant for
that botnet. Then it will find the host for that name, and connect to it using standard Internet Relay Chat (IRC) protocol,"
Lippard says.
The larger a botnet, the more formidable the attack it can launch. For instance, when a botnet containing tens of thousands
of captured machines is used to launch a denial of service attack, the consequences can be serious and irreparable.
