Botnet: The Biggest Threat To Internet
Botnet: The Biggest Threat To Internet
By:
Gurneet Singh
RA1803 B43
10803506
Example of PHISHING
Example of PHISHING
AND NOW COMES THE
BOTNET !!!
BOTNET ςς??
• Collection of compromised computers—bots, also
known as zombies.
• Under the control of a single entity, ie. control server (a
botnet controller).
• Uses the mechanism of a single command.
• Network of computers using distributed
computing software.
• Any computer connected to the Internet—preferably
with a broadband connection—is a desirable base of
computing power to be used as a bot.
What is a BOT ?
• Software applications that run automated tasks
over the Internet.
• Perform tasks that are both simple and
structurally repetitive, at a much higher rate than
would be possible for a human alone.
• The term originates from the earlier classification
of intelligent agents as "knowledge robots".
• In short, "bot" is just another term for intelligent
agent.
Intelligent Agent
• Piece of software that can autonomously
accomplish a task for a person or other entity.
• The software has some sort of "trigger" built
into it and, once executed, the agent can carry
out its function without further intervention.
• The key ingredient is that the software
program accomplishes some task
autonomously once triggered.
Purpose of Intelligent Systems
1. Search for information automatically.
2. Answer specific questions.
3. Inform you when an event has occurred.
4. Provide custom news to you on a just-in-time
format.
5. Provide intelligent tutoring.
6. Find you the best prices on nearly any item.
7. Provide automatic services, such as checking web
pages for changes or broken links.
Malicious Activities
Distributed Denial-of-Service (DDoS) attacks.
Spamming
Sniffing
Keylogging
Spreading new malware
Mass identity theft (Phishing)
ACTUAL WORKING
Worm/Trojan
program that's
usually transmitted
through a spam.
BOTS created.
Communicates with
attacker.
Attacker send
commands through
IRC.
An ATTACK !!!
• Attacker spreads a Trojan horse to infect various
hosts
– hosts become zombies and connect to IRC server on a
specific channel as regular user users
• channel may be encrypted or open
• IRC Server can be on a public network or installed on
one of the compromised hosts
• Bots listen to the channel for instructions from the
operator
• operator instructs the net to do “it's stuff”.
INTERNET RELAY CHAT :IRC
Zombie establish
connection with bot
controller.
All bots are
connected to IRC
servers.
Bot controller send
commands to bots
through IRC
Threats !!!
Description
DDOS Attack by CHINA on US
TRACKING & STOPPING BOTS
Tracking IRC Servers
Honeynets
PREVENTION
Using anti-virus and anti-spyware software and keeping it up to
date.
Setting your operating system software to download and install
security patches automatically.
Being cautious about opening any attachments or downloading
files from emails you receive.
Using a firewall to protect your computer from hacking attacks
while it is connected to the Internet.
Disconnecting from the Internet when you're away from your
computer.
Downloading free software only from sites you know and trust.
Taking action immediately if your computer is infected.
CONCLUSION