Botnet Attacks: Difference between revisions
1st DNS Seal addition. |
No edit summary |
||
| Line 5: | Line 5: | ||
}} | }} | ||
'''Botnet Attacks''' involve networks of infected computers controlled by a hacker or "botherder"<ref name="norton">[http://us.norton.com/botnet/ Bots and Botnets—A Growing Threat], Symantec Corporation</ref> | '''Botnet Attacks''' involve networks of infected computers controlled by a hacker or "botherder"<ref name="norton">[http://us.norton.com/botnet/ Bots and Botnets—A Growing Threat], Symantec Corporation</ref> without the consent of the computers' owners.<ref name="kasper">[http://usa.kaspersky.com/internet-security-center/threats/botnet-attacks#.Ut269fbTmfQ Botnet Attack Information], Kaspersky Lab</ref><ref name="shadow">[http://www.shadowserver.org/wiki/pmwiki.php/Information/Botnets Botnets], Shadowserver.org</ref> These infected computers can be used in complex cyberattacks, including but not limited to [[Fast Flux]] attacks where the controller uses the botnet to hide his or her location, [[Spam]] attacks, DDOS attacks, and [[Phishing]] attacks, all without the knowledge of the computer's owner.<ref name="norton"/><ref name="shadow"/> | ||
The term botnet comes from the combination of robot and network.<ref name="kasper"/> Sometimes botnets are referred to as zombie computers or zombie networks because they infect other computers.<ref name="norton"/><ref name="fbi">[http://www.fbi.gov/news/news_blog/botnets-101 Botnets 101: What They Are and How to Avoid Them] (June 5, 2013), Federal Bureau of Investigation</ref> They can also be hard to detect and shut down once they are established, especially when the average user may not realize they are part of one.<ref name="bbc">[http://www.bbc.co.uk/news/technology-25185232 Zombie botnets: Why some crime networks refuse to die] by Mark Ward (January 20, 2014), BBC</ref> For example, when part of the Kelihos botnet was taken down, it reappeared within 4 months.<ref name="sym"/> | |||
==Public Perception== | ==Public Perception== | ||
| Line 14: | Line 16: | ||
==Historical Use== | ==Historical Use== | ||
*Botherders or controllers frequently target PCs without adequate security protection such as personal | *Botherders or controllers frequently target PCs without adequate security protection such as personal computers with Internet access.<ref name="ss">[http://searchsecurity.techtarget.com/definition/botnet botnet (zombie army)] by Margaret Rouse (February 2012), SearchSecurity.com</ref> Botherders can also create botnets by getting an Internet user to unintentionally download malware.<ref name="fbi"/> According to the [[GNSO]]'s Registration Abuse Polices Working Group (RAPWG) report, botnet controllers can use registered or unregistered domains to give infected computers instructions or updates.<ref name="rapwg">[http://gnso.icann.org/en/group-activities/inactive/2011/rap Working Group Final Report; Submitted on May 29, 2010] (PDF), Internet Corporation for Assigned Names and Numbers (ICANN)</ref> If the botnet had been communicating via a certain domain name and the name expires, the botnet may disappear temporarily but become active again when the domain is re-registered.<ref name="bbc"/> | ||
*According to a BBC news report, 5-10% of all computers are infected and act as part of a botnet.<ref name="bbc"/> Estimates about the relative sizes of botnets vary, starting with botnets as small as a few hundred computers leading up to botnets that exceed 50,000 compromised computers.<ref>[http://www.honeynet.org/node/62 Lessons Learned] (August 10, 2008), The Honeynet Project</ref> Some extensive botnets may have more than half a million infected computers.<ref name="sophos"/> | *According to a BBC news report, 5-10% of all computers are infected and act as part of a botnet.<ref name="bbc"/> Estimates about the relative sizes of botnets vary, starting with botnets as small as a few hundred computers leading up to botnets that exceed 50,000 compromised computers.<ref>[http://www.honeynet.org/node/62 Lessons Learned] (August 10, 2008), The Honeynet Project</ref> Some extensive botnets may have more than half a million infected computers.<ref name="sophos"/> | ||
*As stated in previous sections, botnets can be used in multiple ways that threaten Internet users. For example, botnets can relay information from individual computers back to the botherder by using keylogging software. This information, including passwords | *As stated in previous sections, botnets can be used in multiple ways that threaten Internet users. For example, botnets can relay information from individual computers back to the botherder by using keylogging software. This information, including passwords, credit cards, or bank account numbers, can then be used by the network controller.<ref name="ss"/> Botnets can also be used in Distributed Denial of Service (DDoS) attacks, <ref name="ss"/> fast flux attacks, phishing attacks, spam campaigns,<ref name="kasper"/> identity theft, clickfraud, and distributing malware.<ref name="norton"/><ref>[http://www.honeynet.org/node/52 Uses of botnets] (August 10, 2008), The Honeynet Project</ref> Botnets can also affect mobile devices and phones, and a Symantec report stated that a botnet infected mobile app has generated anywhere from $1,600 to $9,000 per day.<ref name="sym">[http://www.symantec.com/security_response/publications/threatreport.jsp 2013 Internet Security Report, Vol. 18] (PDF), Symantec Corporation</ref> | ||
*In 2014, the FBI in collaboration with law enforcement officials from multiple countries "disrupted" the Gameover Zeus botnet, which has allegedly been responsible for $100 million in losses.<ref name="gameover">http://www.pcworld.com/article/2357820/law-enforcement-agencies-disrupt-gamover-zeus-botnet.html by Grant Gross (June 2, 2014) PCWorld</ref> This botnet is believed to comprise anywhere from 500,000 to 1 million computers.<ref name="gameover"/> The operator of this botnet could face bank fraud, [[Wire Fraud Statute| wire fraud]], conspiracy, and [[Computer Fraud and Abuse Act| computer hacking]] charges.<ref name="gameover"/> | *In 2014, the FBI in collaboration with law enforcement officials from multiple countries "disrupted" the Gameover Zeus botnet, which has allegedly been responsible for $100 million in losses.<ref name="gameover">http://www.pcworld.com/article/2357820/law-enforcement-agencies-disrupt-gamover-zeus-botnet.html by Grant Gross (June 2, 2014) PCWorld</ref> This botnet is believed to comprise anywhere from 500,000 to 1 million computers.<ref name="gameover"/> The operator of this botnet could face bank fraud, [[Wire Fraud Statute| wire fraud]], conspiracy, and [[Computer Fraud and Abuse Act| computer hacking]] charges.<ref name="gameover"/> | ||