How Do Botnets Work?
An attacker builds a botnet by taking control of a large number of network-connected machines. While it is possible to build a botnet using cheap computing power, such as cloud infrastructure, botnets are usually created by infecting computers with malware. Often, botnets will target devices with notoriously poor security, such as Internet of Things (IoT) systems.
This malware installed on the machine will monitor for instructions distributed by the botnet’s command and control (C2) architecture. Botnets can use a variety of different forms of C2, including data posted on websites, social media channels, responses to DNS queries, and more. After receiving instructions from a C2 server, botnet will carry out those commands. Botnets can be used in various attacks that may or may not require additional communication with the C2 server. However, in some cases, the botnet may deliver information back to the C2 server as well.
What Are Botnets Used For?
Botnets are designed to automate various types of attacks, making them easier, cheaper, and more scalable for cybercriminals to perform. Often, botnets are involved in multiple stages of the cyberattack lifecycle, including the following:
- Vulnerability Scanning: Malware and other cyberattacks commonly begin by exploiting a vulnerability in the target system. Botnets can be used to search for vulnerable systems that can be exploited and used in follow-on attacks.
- Malware Delivery: Often, botnets are designed to be self-spreading, increasing the power and scope of the malicious network. After identifying a vulnerability in a targeted system, a bot may exploit it and use it to infect the target system with the botnet.
- Multi-Stage Attacks: In addition to delivering their own malware, botnets are sometimes used to distribute other types of malware. For example, the botnet may download and install a banking trojan or ransomware on the infected computer.
- Automated Attacks: Once installed on a computer, botnet can be used for a variety of automated attacks. In general, these are untargeted attacks designed to take advantage of the scale of the botnet.
Types of Botnet Attacks
Botents are designed to perform attacks that are easy to automate and carry out at scale. Some examples of common types of attacks that botnets might be used to perform include the following:
- Distributed Denial of Service (DDoS): DDoS attacks are designed to overwhelm a target with traffic from multiple sources, rendering it unable to handle legitimate requests. DDoS attacks are some of the most common uses of botnets.
- Password Attacks: Credential stuffing and other automated password guessing attacks use breached credentials, dictionaries, or a brute force search to identify the passwords of online accounts. If valid credentials are discovered, the attacker can use them in a variety of different attacks.
- Phishing: Botnets can be used to support phishing attacks. For example, botnet may use infected machines to send out phishing and spam emails, increasing the scale of the malicious email campaign.
- Cryptojacking: Cryptojacking uses the computational power of infected machines to mine cryptocurrency. The rewards of this mining activity go to the attacker, enabling them to make money at the victim’s expense.
- Financial Fraud: Credit card data is commonly for sale on the dark web or stolen through data breaches. Bots can be used to test if the data is valid or use compromised accounts to perform financial fraud.
- Ad Fraud: Websites earn revenue based on the number of times an ad has been viewed or clicked. Botnets can perform click fraud by pretending to be legitimate users and clicking on ads to increase revenue for malicious sites.
- Scalping: Some major events sell tickets online and have a limited number available. Bots can purchase tickets more quickly than human users, enabling their operators to sell those tickets at a markup on the secondary market.
Prevent Botnet Attacks with Check Point
Botnets pose multiple threats to an organization and its cybersecurity. If an organization’s systems are infected by malware, they may be conscripted into a botnet and used to perform automated attacks against other systems. Conversely, an organization may also be the target of these automated attacks, which can be used to achieve various purposes.
Protecting against the botnet threat requires implementing a comprehensive security program that protects both endpoints against infection and other corporate systems against attack. Check Point Harmony provides unified security that secures both an organization’s endpoints and its applications against attack. For more information about how Harmony Endpoint can protect your organization against botnets and other cyber threats, reach out for a free demo today.
Feedback