Botnet

A botnet, from "robot network", is a set of compromised machines — called bots, droids, or usually zombies — which can collectively perform tasks for the bot herder.

The main applications of botnets are to perpetrate various sorts of net.evil, such as conducting distributed denial of service attacks and sending spam. With a large number of infected computers — the Storm botnet had millions — a botnet can be an extremely powerful computing system with enormous communication bandwidth. Interesting analogies have been drawn between "white hat" cloud computing services and "black hat" botnets, both of which are means of dynamically combining resources.

Recruiting the victim machines

Machines may be taken over in a variety of ways. Trojan horse programs — most often in games or pornography — are used. Phishing has been used as an attack vector to recruit new zombies. . Some viruses make the victim computer part of a botnet. A famous example was the Storm botnet , spread mainly by email messages. These methods can be combined; downloaded malware might scan the victim's address book and try to spread further via email or instant messaging.

Another method is to concentrate on attacking web servers, especially those for busy sites. If the attacker can subvert a web server, then he can plant malicious code there; that code will then automatically attempt to subvert every machine that visits the site. This is extremely good for the attacker; by breaking security on a single server he can subvert large numbers of machines.

Botnets can also be built by actively scanning for insecure machines. Any computer can be attacked in this way, but one target is common enough and often insecure enough to be the favorite. The attacker looks up the IP address ranges used for ADSL or other broadband Internet service; any machine he can compromise there will have a good enough net connection to be quite useful to him. Most are home machines, often not set up for secure operation and not protected by firewalls. He then scans those IP addresses looking for Windows machines that have not installed Microsoft's security updates and are therefore vulnerable to known attacks.

Defenses

Several simple defenses can greatly reduce the risk of a home machine becoming part of a botnet. Simply doing Windows updates prevents many of the attacks used. A cheap off-the-shelf router provides some firewall protection between your machine and the net, and has other benefits such as allowing multiple machines to share a connection. Checking your Windows network settings to ensure that you are not allowing shares to arbitrary people can block some attacks.

The International Telecommunication Union have a Botnet Mitigation Toolkit,