A botnet (short for “robot network”) is a network of computers infected by malware that is under the control of a single attacking party, known as the “bot herder.” Each machine controlled by the bot herder or botmaster is known as a bot.
From one central point, the attacking party can command every computer on its botnet to simultaneously carry out a coordinated criminal action. The scale of a botnet (many comprised of millions of bots) enables the attacker to perform large-scale actions previously impossible with malware.
Common uses of botnets include:
The rise of botnets and modern malware is reshaping the threat landscape and forcing enterprises to reassess how they protect themselves. These modern threats have outpaced traditional anti-malware strategies and, in the process, have established a foothold within the enterprise that criminals and nation-states can use to steal information and attack sensitive assets.
The evolution of malware includes types that mutate or can be updated to avoid detection by traditional malware signatures. Bots (individual infected machines) and botnets (the broader network of bots working together) are significant in developing polymorphic malware. They are notoriously difficult for traditional antivirus/anti-malware solutions to detect.
It is essential to understand what sets botnets apart from previous generations of malware and how they affect our efforts to control them.
Most botnets are set up in three stages. First, the malicious actor identifies a website, system, or application vulnerability. Then, the target is infected with malicious software that will allow the cybercriminal to control it. The botnet malware is often delivered to individual devices using phishing emails, ad fraud (i.e., malicious ads), and drive-by downloads.
Unlike earlier types of malware, which were more or less a swarm of independent agents, bots are centrally coordinated and retain a communication channel to the outside world. Botnets are changing what is possible in the world of malware. Now, all malware of the same type can work together toward a common goal, with each infected machine growing the power and value of the overall botnet. The botnet can evolve to pursue new goals or adapt to changes in security measures.
Some of the most important and unique functional traits of botnets are:
Botnets are malware that takes full advantage of the resiliency built into the Internet itself. A botnet can distribute multiple control servers worldwide, with numerous fallback options. Bots can also leverage other infected bots as communication channels, providing a near-infinite number of communication paths to adapt to changing access options.
Updates from the command and control servers can also completely change the bot's functionality. This enables a new economic approach for a botnet owner, who can now use portions of the botnet for a particular task, such as collecting credit card numbers, while other segments of the botnet could be sending spam. The critical point is that the infection is the most crucial step because the functionality can always be changed later.
Since bots are hard to detect and can easily change function, they are particularly well-suited for targeted and long-term intrusions into a network. Since bots are controlled by remote human intelligence, a botnet is more like having a malicious hacker inside your network than a malicious executable. For instance, a bot can learn more about the network's organization, find targets to exploit, and install additional backdoors if the bot is ever discovered.
The motivations for creating botnets parallel most other malicious cyber menaces. Threat actors create botnets primarily for profit, but some use them for activism and to enable state-sponsored disruptions.
Several of the most common uses of botnets are cryptocurrency mining, financial and sensitive information theft, sabotage (e.g., taking services or sites offline), cyberattacks (e.g., phishing, ransomware, and distributed denial-of-service attacks), and selling access to other cybercriminals (i.e., bontet-as-a-service).
Botnets are created when the bot herder sends the bot from his command and control servers to an unknowing recipient using file sharing, email, social media application protocols, or other bots as an intermediary. Once the recipient opens the malicious file on his computer, the bot reports to command and control, where the bot herder can dictate commands to infected computers and launch botnet attacks. Below is a diagram illustrating these relationships.
Botnet designs vary, but how they are controlled falls into two categories—client/server and peer-to-peer. Most botnets combine these models.
Botnets based on a client-server model are centralized and controlled by a single command-and-control server. Once a system has been infected, the malware contacts the command-and-control server to receive instructions (e.g., to launch attacks or infect other connected devices). From this centralized server, the cybercriminal can control all the botnet devices.
Client-server botnets have been found to use different topologies. Several common network topologies botnets use include star, multi-server, and hierarchical.
Star network topologies employ a hub-and-spoke structure, with each host connected to a hub at the center of the network. In this model, the hub provides a channel to share messages with the devices in the botnet, and all data runs through the hub for distribution.
The structure of a multi-server network topology also follows a hub-and-spoke model. However, with a multi-server network topology, one server handles communication and data transmissions between the bots.
In a hierarchical network topology model, a centralized server communicates and transmits data, and bots handle communication with bots lower in the hierarchy. In this model, the server is separated from most bots.
P2P botnets are decentralized and do not use command-and-control servers. In this model, the malware is replicated on all systems in the botnet, and each system acts as both the client and server.
A bot herder can send commands to one bot in the network and share them with adjacent nodes. In a P2P botnet, the bots maintain a list of which systems are in the network and can be trusted to share data and communications, including malware updates and commands.
An advantage of the P2P botnet model is that bots are only connected with limited machines, making it difficult to identify all botnet systems. However, this decentralization makes the botnets more susceptible to hijacking. To mitigate this risk, cybercriminals often use encryption to restrict access.
The P2P botnet model also provides a distinct advantage over the client-server model because there is not a single point of failure. With a client-server botnet, if the centralized server is taken down, the entire botnet goes with it.
A number of unique functional traits of bots and botnets make them well-suited for long-term intrusions. The bot herder can update bots to change their entire functionality based on what he/she would like them to do and to adapt to changes and countermeasures by the target system.
Bots can also utilize other infected computers on the botnet as communication channels, providing the bot herder with a near-infinite number of communication paths to adapt to changing options and deliver updates. This highlights that infection is the most important step because functionality and communication methods can always be changed later on as needed.
Since the remote bot herder controls infected computers, a botnet is like having a malicious hacker inside your network instead of just a malicious executable program.
Once a botnet is discovered, the two widely used approaches for disabling it are to take down the control centers and remove the botnet malware. The best approach will depend on the botnet architecture, its scale, and the resources available to an organization.
If the botnet employs a client-server architecture, it can be disabled by shutting down the main server or servers that control it. Taking down a botnet control center usually requires the support of law enforcement.
Several approaches can be used to remove botnet malware from individual systems. The easiest is to use anti-virus tools. In cases where this does not work, systems need to be wiped and reimaged. The malware can be removed for IoT devices by doing a factory reset, reformatting the device, or flashing the firmware.
One of the most important steps an enterprise can take to control modern malware is to reduce the infection vectors and eliminate the ability for the bots to hide. Today, most of the infection vectors used by botnets are virtually unchecked, and botnet traffic is typically small enough to easily blend into the background of “normal” network traffic.
By regaining complete visibility and control of strictly what traffic is allowed into the network and why, security teams can greatly satisfy both goals.
Establish policies of approved applications and uses based on company needs and culture:
Palo Alto Networks provides the tools and techniques to control and secure the use of these malware-enabling applications. This ability to securely enable any application is a critical requirement for enterprises where simply blocking all access to blogs, webmail, IM and social networking apps would be both impractical and unduly constrain the enterprise’s ability to communicate and stay connected with the outside world.
Several tools and techniques are available to defend against botnet threats. Some are specific to botnets, and others are part of an organization’s overall security program. The following are several tools and techniques that can be employed.
The simple answer as to what botnets can do is anything. Botnets are used to automate and scale many malicious cyber activities. The following examples demonstrate the variety of actions that botnets can be directed to execute on behalf of cybercriminals.
These functions are made possible because once botnet malware is installed, it enables the botmaster to send commands such as:
Though email is today seen as an older vector for attack, some of the largest botnets are used to send spam. Known as spambots, these bots send spam, spread phishing messages, and add more systems to the botnet.
Botnets are widely used for DDoS attacks. Due to their massive scale, botnets are highly effective at overloading a target network or server with requests, rendering it inaccessible to its intended users.
A twist on the spamming botnet model involves using bots for DDoS attacks, overwhelming a target system with traffic from numerous endpoints. The enterprise with the infected client is often not the target, but the compromised host is used to flood a remote target with traffic.
DDoS attacks may target specific companies for personal/political reasons or to extort payment. These attacks pose a dual risk for the enterprise, potentially causing downtime and lost productivity if targeted, or consuming valuable network resources if end-users participate in the attack.
In addition to launching attacks, botnets scan networks for exploiting vulnerable systems. In some cases, these are broad scans of the Internet. Botnets seek out particular types of devices or organizations to scan to support targeted attacks.
The scale of botnets makes them very effective for running programs designed to breach web accounts by force. This includes dictionary attacks and credential stuffing that exploit weak user passwords to gain unauthorized system access.
Systems infected with botnet malware collect sensitive information from devices. Tools employed by botnets to steal information include keyloggers and screenshot grabbers. The collected data is then sent back to an attacker’s remote server.
Targeted intrusions leverage smaller botnets designed to compromise specific high-value systems of organizations from which attackers can penetrate and intrude further into the network. These intrusions are extremely dangerous to organizations as attackers specifically target their most valuable assets, including financial data, research and development, intellectual property, and customer information.
Many botnet attacks are zero-day varieties. The following is a review of several real-world botnet attacks. While most of these have been disabled, a few are still active.
One of the first botnets that gained public attention was the EarthLink botnet, also called the EarthLink Spammer. Launched in 2000, the botnet was used by its creator and other cyber criminals to send more than 1.25 million phishing emails over the EarthLink network.
This botnet software used Trojan horse malware to infect systems and access users' information remotely. Over a year, the EarthLink botnet affected about 12% of EarthLink's email traffic and cost the organization an estimated $4.1 million in lost profits.
Discovered in 2007, the Curtwail botnet was sending more than 51 million emails every minute by 2009, accounting for more than 45% of the world's spam. It is estimated that, at its peak, the Curwail botnet comprised 1.5 to 2 million infected computer systems sending 74 billion spam emails a day.
This botnet targeted Windows systems with Trojan horse malware that used infected computers as spambots. Cutwail was also used to spread well-known malware families and was used as a DDoS botnet for SSL attacks.
In its heyday, the ZeuS botnet, also called Zbot, was thought to be the most widely used malware, infecting more than 13 million computers across 196 countries. ZeuS used Trojan horse malware for several nefarious undertakings, including spreading CryptoLocker ransomware and stealing credentials to users' accounts, including their social media, banking, FTP, and email accounts. Over 90% of all online bank fraud incidents were attributed to the ZeuS botnet.
Storm, also called the Storm worm botnet, Dorf botnet, and Ecard malware, was one of the first peer-to-peer botnets. This Trojan horse malware was available through a rental model on the dark web. Believed to have infected up to 2 million computers, Storm was used for a number of criminal activities, including identity theft, bank fraud, and DDoS attacks. This was one of the most virulent botnets to data as it had defensive capabilities that thwarted attempts to track and deactivate it.
The Kraken botnet was a massive spyware botnet. It was estimated to have infected 10% of all Fortune 500 companies, but each of the almost 500,000 bots in the network could send about 600,000 emails a day. In addition to its size, the Kraken botnet is thought to have been one of the first to use evasion techniques to avoid detection by anti-malware tools.
Specializing in spam targeting the pharmaceutical industry, the Grum botnet could send almost 40 billion emails daily, accounting for nearly 20% of the world's spam. At its peak, the Grum botnet included more than 100,000 computers.
A notable feature of the Grum botnet was that it used two types of control servers, one for infecting systems and one for sending commands. Additionally, the control servers were located in Panama, Russia, and Ukraine, which gave it resiliency and allowed it to stay operational when one control server was disabled.
The Mariposa botnet, comprised of more than 12 million computers, used worm malware that propagated itself through malicious digital ads (i.e., malvertising). This botnet was used to steal sensitive data from over 800,000 users, including credentials for financial services sites and credit card numbers. It was also used to launch online scams and DDoS attacks.
After the client-server ZeuS botnet was disabled, GameOver Zeus (GOZ) emerged with a peer-to-peer architecture that made it harder to disrupt. Before it was disrupted, GameOver Zeus had infected over 250,000 computers and an estimated $100 million in monetary losses.
Dridex, also known as Bugat and Cridex, is Trojan horse malware that mostly spreads through phishing campaigns. It is delivered as a Word or Excel document attachment with a malicious macro that downloads and executes malware. Distributed through a malware-as-a-service model, this infostealer botnet is used to perform a number of malicious actions to steal users' information, including capturing screenshots, keylogging, and launching ransomware attacks.
Built to target Microsoft Windows operating systems, ZeroAccess is a peer-to-peer botnet that uses Trojan horse malware. The ZeroAccess botnet was particularly difficult to disable because it evaded detection by using a trick to turn off anti-virus software running on the infected systems. Growing to more than 9 million computers, the ZeroAccess botnet was used for cryptocurrency mining and spamming malware.
3ve was the head of three interconnected sub-botnets used for ad fraud. The botnet was used to create more than 5,000 fake websites, spoofing the domains of high-ranking and prestigious publishers and selling their "premium" traffic to advertisers. 3ve was believed to have generated 3-12 billion ad bid requests daily using the more than 1.7 million computers under its control. By using an anti-forensics evasion tactic, 3ve collected an estimated $30 million before it was disabled.
Emotet, also known as Heodo and Geodo, is considered one of the most dangerous botnets because it is polymorphic, changing its code each time it is called up. It uses Trojan horse malware to spread and distribute other malware and ransomware. Threat actors use Emotet to commit financial fraud, espionage, and political sabotage with malicious spam.
The Mirai botnet is known for targeting and weaponizing IoT devices. It is believed to have infected over 600,000 devices, which it uses to launch DDoS attacks. In 2016, it ran a 1TB/second DDoS. The Mirai source code is publicly available and has been used to create hundreds more botnets. Mirai is considered to be the largest IoT botnet.
