Botnet. A network of computers created by malware and controlled remotely, without the knowledge of the users of those computers.
Botnet. A botnet is a collection of software agents, or robots, that run autonomously and automatically. The term is most commonly associated with IRC bots and more recently malicious software, but it can also refer to a network of computers using distributed computing software." [WikiBot] During 2009 botnets became wider and spread all over the world, posing the biggest current threat. Botnets are a big money affair; they can be rented to send spam or advertising or to create a distributed Denial of Service (DoS) to paralyse almost every service on the Internet. In turf wars between different botnets Distriuted Denial of Service (DDoS) is used as the method of attack. This results in significant waste of network resources for service provider over the network, due to bandwidth saturation or a frozen CPU in the network-access router, and in a large number of infected or compromised hosts (estimated to be about 30 millions, according to InfoSecurity magazine [InfSecMag]). Because of their large spread and the large amount of money that bot herders can earn, botnets are evolving in different ways: By infecting systems: Being invisible to the system allows botnets to pass antivirus software unnoticed and also to use root- kits installed on unusable sectors of a disk drive that are not accessible to the operating system. Also, a bot-virus often patches the system that it has compromised and exploits a vulnerability that allows it to be the only one to control the host computer. Botnets tend to be as specific as possible to the task they are assigned to do: for example, there are spam-only botnets, like Conficker and DDoS- only botnets like the Mariposa botnet, while multipurpose botnets, like the Zeus botnet, are decreasing. While botnets were previously used for spam, phishing and spyware, they are now also used to fetch any data from computers that can be used to send specific and targeted spam (not only email contacts or credit card numbers but also login credentials for social network platforms). Using the communication protocol: Botnets tend to pass from an architecture with a centralised server (single point of failure) to an architecture without server, using P2P protocol. This technique has the advantage to be almost invisible to the monitoring of network traffic. Botnets also tend to use an encrypted version of the protocol to bypass Intrusion Detection Systems (IDSs) (based on intercepting specific patterns in packets payload). The best way to mitigate botne...
