Botnet Attacks

A botnet is a linked network of malware-infected computers that hackers run. Simply put, a botnet is a network of compromised computers that cybercriminals commonly use for various cybercrime activities. A botnet assault is a cyber attack that employs the use of a botnet as part of its strategy.

The Botnet’s Four Essential Components (and the Roles They Play in Botnet Attacks)

A botnet is made up of four main components:

• The hacker who organises botnet attacks is known as a botmaster or bot herder (botnet herder).
• The central computer used by cybercriminals to communicate with all other infected computers is known as a command and control (C&C) server. Please keep in mind that not all botnets use command and control (C&C) servers (for example, random topology botnets). Instead, they create peer-to-peer botnet networks to send the data. (We’ll get into more depth on that point later in this article.)
• The bot code is a trojan horse that is specifically designed to target botnets. Botnet malware is another name for them.
• The botnet malware-infected computers are known as botnet hosts, bots, or zombie devices. Botmasters use internet-connected devices as botnet hosts (e.g., mobile phones, laptops, cable boxes, IP/CCTV cameras, Wi-Fi routers, and other IoT devices).

How Botnet Works? There are three key phases to consider

Phase 1: Recruiting New Hosts to Join Botnet Army

A botnet attack requires that you have a sufficient number of infected hosts connected to the same C&C server. A botmaster infects new computers by using the following malware injection techniques:

• Phishing emails: The intruder sends phishing emails to their targets while impersonating legitimate businesses, recruiters, tech support staff, employers, and colleagues. These emails can include malicious attachments, macros, or links that lead recipients to a spammy website. The botnet malware can auto-install on users’ computers when they download infected attachments or click on malicious links in emails.
• Malicious websites: Malware can be hidden in photos, videos, songs, slideshows, files, apps, and advertisements on certain websites. Malware can also be found in links and buttons. The botnet trojan infects users’ computers or smartphones as they visit these pages and either download infected media files or click on corrupt links.
• Vulnerability exploits: The botmaster searches the internet for connected devices with known vulnerabilities like CVE-2019-3396 and CVE-2020-5902. They take advantage of these flaws to infect computers with malware. When a botnet trojan infects a computer, it looks for other vulnerable devices to infect and force them to enter the botnet network.

Phase 2: Establishing Communication Between the Host Device & Bot Herder

The botmaster creates one of these two paths to develop internal communication in a botnet.

Client-Server Network:

All infected hosts (clients) receive commands from a single central server and report back to it. In certain instances, the intruder can communicate through the Internet Relay Chat (IRC) network. To communicate with the master server, all of the compromised clients must know the correct IRC server, port, and channel to link to.

A website (domain name or IP address) is often used by the bot herder as a central point of communication. When the infected bots visit the website, they are given a list of commands to carry out. The website is a lot easier to run than the IRC network, particularly when there are a lot of client bots. Additionally, the botnet as a whole will use an encrypted HTTPS channel to mask their contact.

The disadvantage of this approach for cybercriminals is that if the hosting site detects suspicious behaviour, the website can be taken down immediately. The hacker must then establish a centralised point of contact for their botnet on the internet.

Peer-to-Peer Botnet Network

This is a higher-level channel. The bots in this scenario don’t receive commands from a centralised C&C server; instead, they pass commands directly to other bots. Since P2P networks are frequently decentralised, the government and cybersecurity researchers face numerous challenges in detecting them. It’s difficult because bots don’t communicate with a centralised C&C server, so they can’t target, control, or take down any specific server.

P2P networks are not all created equal, and their topologies vary based on their architectures. A P2P network with computers behind firewalls or just proxy server access will have a different structure.

Bots may also make use of public key infrastructure. The digital signature aspect makes it difficult for security researchers to detect and intercept peer-to-peer networks. Asymmetric encryption with two keys — one public and one private — is used for digital signing.

Asymmetric keys: In this case, the attacker embeds a public key in the malware that infects zombie computers. To prevent the botnet from being hijacked, the attacker signs all commands with the corresponding private keys before sending them to the botnet. To ensure that the commands are coming from the botmaster alone, the bots use the public key to authenticate them.

Symmetric keys: In some P2P botnets, each bot produces its own symmetric key, which can be used by other bots to exchange data. As a result, both the botmaster and other bots use the symmetric key to transfer information to other bots. Without a corresponding private key, no other clients can join the peer-to-peer network in this scenario.

Phase 3: Using Botnet Malware for Cyber Attacks

When a large number of infected devices are gathered under a botnet umbrella, the attackers may use them to carry out a variety of botnet attacks.

What sort of illegal activities do these device-controlling networks participate in, though? According to Joseph Demarest’s Senate testimony, who served as Chief Operating Officer of the FBI’s Criminal, Cyber, Response, and Surveillance Branch:

“Once the botnet is in place, it can be used in distributed denial of service (DDoS) attacks, proxy and spam services, malware distribution, and other organized criminal activity. Botnets can also be used for covert intelligence collection, and terrorists or state-sponsored actors could use a botnet to attack Internet-connected critical infrastructure. And they can be used as weapons in ideology campaigns against their target to instigate fear, intimidation, or public embarrassment.”

These are some of the most common botnet attacks carried out by these networks:

Distributed Denial of Service (DDoS) Attacks

One of the top 7 information security risks we’ve previously discussed is being compromised in a DDoS attack with the use of a botnet.

During a DDoS attack, all of the bots visit a specific website and flood it with multiple requests at the same time. The website’s bandwidth becomes drained as a result of unexpectedly high traffic or packet forwarding flux, and the website becomes sluggish or ceases responding at all.

DDoS attacks that are effective disrupt services and make websites inaccessible to legitimate users. Nitol, AgoBot, Cyclone, SDBot, Cutwail, and PhatBot are some of the most common botnets for DDoS attacks.

Brute Force Attacks

Even if the webmaster has allowed the restricted login attempts feature, a botnet will successfully conduct a brute force attack on the website. In a typical brute force attack, an attacker attempts to guess login credentials using a pre-configured list of values (user IDs and passwords). They’ll use this method to try out various variations on login pages one by one before they gain access to the device.

Scripts are commonly used by attackers to automate this operation. However, by restricting the number of login attempts per IP address, websites can easily avoid brute force attacks. After a certain number of failed login attempts, the login pages for every particular IP address freeze.

The bots receive a list of websites (or IP addresses) from botmaster, along with a few pairs of usernames and passwords (generally less than three) for each IP address, in botnet brute force attacks. On the specified IP, the bots attempt to authenticate the given set of credentials. It sends a report to the C&C server if it is successful. If this is not the case, it will carry on to other IP addresses.

The target websites are unable to detect the brute force attacks carried out by botnets since the hosts use different IP addresses and try fewer combinations than the website’s failed login attempts limits.

Theft of Data

Another advantage of using a botnet is that it helps cybercriminals to steal confidential data from their victims’ computers. For botnet attacks, trojans mounted on host devices can do any or all of the following and send the information back to the botmaster:

• Keep track of all of the users’ behaviour.
• Keeps track of the data on the host machines.
• It keeps track of the users’ online transactions.
• Keystroke logging is used to record users’ keystrokes, and form grabbing (also known as formjacking) is used to snatch login credentials from online forms.

To commit financial or identity fraud, a botmaster can steal and misuse a variety of information from users, including:

• First and last names
• Credit or debit card numbers
• User IDs and passwords
• Email addresses
• Physical addresses

Botnet attacks have also been used to steal sensitive government, political, and military information.

Spreading Malware

If a computer is compromised, the self-propagating malware spreads to other computers, allowing the network to hire bots. One example is when the infected computer, without the user’s knowledge, sends malware-laden links, attachments, and phishing emails to the host’s social media/phonebook contacts and email contact lists. They even wreak havoc on all other gadgets that are attached to them.

For example, if a laptop becomes infected with a botnet trojan, the malicious code is spread to any other IoT device you connect to it, including a printer, Wi-Fi router, USB drive, and even a cell phone and CCTV camera connected via Bluetooth or USB cable to the infected laptop.

Crypto Mining

Botnets are designed to mine for the cryptocurrency of choice. The botmaster uses the combined computing power of thousands of machines at the same time. As a result, the botmaster will be able to steal more cryptocurrencies faster. Smominru, Adylkuzz, Bondnet, and PyCryptoMiner are some of the most common botnets for crypto mining.

Fake Traffic

Infected bots are told to visit a website in order to increase traffic and click on ads in order to increase revenue from the revenue-per-click (RPC) advertising model. It’s known as click-frauds.

5 Real World Botnets Examples

Botnets come in a variety of shapes and sizes. These are some of the most common botnets that are commonly used by criminals.

Bashlite

Bashlite was found for the first time in 2014. It has been continuously targeting IoT devices, especially DVRs, cameras, and home routers, for the past six years. Qbot, Hoaxcalls, Lizkebab, Torlus, and Gafgyt are some of the variants. Hoaxcalls used Symantec’s Safe Web Gateway 5.0.2.8 in April 2020. In 2016, Bashlite corrupted over one million IoT computers in order to carry out DDoS attacks.

Mirai

Mirai is a botnet that uses Mirai malware to attack Linux-based servers and Internet of Things (IoT) devices like routers, DVRs, and IP cameras. Mirai communicates with hosts over an encrypted channel and then deletes itself until the malware has finished running. As a result, it’s difficult for businesses to spot.

The Mirai botnet is primarily used for DDoS attacks and cryptocurrency mining by its operators (cryptomining). Some well-known companies have been attacked, including GitHub, Twitter, Reddit, Netflix, Airbnb, Krebs on Security, and Rutgers University.

GoldBrute

Around 1.5 million remote desktop protocol (RDP) servers were brute-forced by the GoldBrute botnet in 2019. This Botnet used AES-encrypted WebSocket connections to communicate with its C&C.

Smominru

Smominru is a crypto mining botnet that targets Windows systems from the past. It’s been blamed for infecting over 526,000 Windows hosts and generating millions of dollars in cryptocurrency for its operators. Botnet operators will use Taylor Swift’s picture to mask malware payloads as one of their attack methods.

Dark Nexus

Bitdefender uncovered Dark Nexus (also written Dark nexus) as the most recent botnet in December 2019. It was developed with malicious code similar to that used in the Mirai and Qbot botnets. It changes itself regularly, making it difficult to predict its behaviour.

Bitdefender’s core components modified 30 times in three months, according to the study! It infects IoT devices and performs brute force attacks using credential stuffing. The Dark Nexus botnet is being rented out to other cybercriminals for as little as $20 a month by its creators!

How to Detect a Botnet

You must first be able to detect botnets in order to protect your company (more precisely, your servers and other devices) from botnet attacks. A botnet can be detected using one of three methods:

Signature-Based Detection

Deep packet inspection (DPI) is used to track network traffic in this process. It examines inbound packet flows for signs of malicious malware by looking for known trends (i.e., signatures). By monitoring the level of traffic and packet flux, it can detect the first incoming intrusion attempts.

The signature-based approach, on the other hand, can only detect malware patterns stored in the botnet database. As a result, it is unable to detect botnets that are entirely new or unknown. If members of the same botnet family use different behaviour patterns, it won’t be able to detect the entire botnet. It also fails to detect malware that is encrypted or compressed.

Flow-Based Detection

This approach analyses packets of the same source and destination to track network traffic flow. It doesn’t inspect each packet; instead, it uses data extracted from the packet header to keep track of the flow size, length, and average packet size. It can also detect bots that are encrypted or compressed.

Another benefit of this method is that it is not reliant on malware trends. Even if the bots use different signatures, it can detect entire botnet families.

Detection via Honeypots

Honeypots are deliberately insecure networks that businesses set up to attract and distract attackers away from their real servers. Honeypots are intended to have poor security structures and to hold no sensitive information. The aim is to divert hackers’ attention and resources away from real servers and into these fake ones.

When honeypots encounter irregular traffic or packet forwarding flux, the webmaster may get an early indication of a botnet attack. Before the attackers target the main servers, the organization’s security team has time to research the attacker’s methods and payload form.

False Positives Detection Results

Detecting a botnet attack is difficult because detection tools must distinguish botnet traffic from that of legitimate web users and vulnerability scanner requests. When scanning servers for vulnerabilities, some vulnerability scanners behave similarly to botnets. They scan the resources so quickly that some botnet detection software can mistake their behaviour for a botnet attack.

White hat hackers, on the other hand, search servers and websites for compromised databases and security flaws. Some businesses also employ white hat hackers to look for flaws on their servers before the hackers do. Security researchers’ or white-hat hackers’ hacking methods produce the same payload patterns as a botnet. As a result, the security software could produce false positives.

How to Prevent Botnet Attacks

When it comes to avoiding botnet attacks, there are two factors to consider.

1) You prevent botnet trojans from infecting your devices (so they can’t be used in botnet attacks against others):

• Update all applications to the most recent version on a regular basis.
• Email phishing: Phishing emails should be avoided at all costs. Verify that the sender’s email address belongs to the organisation it claims to represent. If you receive an email pretending to be from Wells Fargo, for example, the sender’s email address must include “@wellsfargo.com.” This article will teach you all about phishing emails: Email phishing scams
• Downloads from the internet: If the email is from an unknown source, do not open any attachments or click on any links in the email. When uploading apps, photographs, videos, or songs from unknown sources, be cautious. Before you download something, make sure you scan it with a reputable anti-virus programme.
• Code for security: Install anti-malware, anti-spyware, and firewall software on your computers and mobile devices.
• Checking directories by hand: On a regular basis Examine the C:/Program Files (x86) and C:/Program Files directories. If you see an unfamiliar application, look it up on the internet. Remove it from its original position as well as the recycling bin if it’s not from a reputable publisher.

2) If you own a website, you must safeguard it against botnet attacks of different kinds. Here are a few examples of how you can do so:

• Limit access and login attempts: Allowing limited login attempts can not be enough to prevent brute force attacks. Establish a two-factor or multi-factor authentication system in which users receive a secret code or one-time password (OTP) via SMS or automated voice calls on their mobile phones.
• Firewalls should be used: On your browser, instal a Web Application Firewall (WAF).
• Secure your network from DDoS attacks by implementing the following measures: Use software to track and manage the traffic accessing your website or application to mitigate the impact of DDoS attacks. Here are some examples of effective security tools:
• Content delivery networks (CDNs), Network intrusion detection systems (NIDS), and Access control lists are all examples of load balancers that support SSL bridging and SSL inspection (ACLs)
• Use tools that can detect botnet attacks and avoid them. These types of software can track, detect botnet attacks, and stop bots from communicating with the C&C server.

Wrapping Up the Topic of “What Is a Botnet and How Does It Work?”

If your computer is used in a botnet attack, you can face legal action if the government or security companies investigate the source of the attack. Of course, you have the opportunity to demonstrate that you were unaware of the malware insertion, but the court proceedings can be lengthy and frustrating. As a result, it’s best to avoid botnet attacks from the start by preventing them from infecting your computers.

The following are our key company takeaways:

• Teach your staff to be cautious when using the internet and email.
• Update and patch your applications, hardware, and firmware on all of your computers and devices on a regular basis.
• Use anti-malware software that is up to date.
• Using the tools and techniques described above, you can improve the security of your server.