Posted by: Ken Harthun
Botnet, Security, sophos
I have recently had issues with trying to explain botnets to a client. I was met with blank stares.
Thanks to Sophos for this definition:
A botnet is a collection of infected computers that are remotely controlled by a hacker.
Once a computer is infected with a bot, the hacker can control the computer remotely via the internet. From then on, the computer is a “zombie,” doing the bidding of the hacker, although the user is completely unaware. Collectively, such computers are called a botnet.
The hacker can share or sell access to control the botnet, allowing others to use it for malicious purposes.
For example, a spammer can use a botnet to send out spam email. Up to 99% of all spam is now distributed in this way. This enables the spammers to avoid detection and to get around any blacklisting applied to their own servers. It can also reduce their costsbecause the computer’s owner is paying for the internet access.
Hackers can also use zombies to launch a distributed denial-of-service attack, also known as a DDoS. They arrange for thousands of computers to attempt to access the same website simultaneously, so that the web server is unable to handle all the requests reaching it. The website thus becomes inaccessible.