Info about botnet, summary, history, technology and future

1. WHAT IS BOTNET?
Milan Petrásek
21/5/2014

3. Content
• Introduction
• Star and multiserver topology botnets
• Hierarchical topology botnets
• Random topology botnets
• Types of attacks
• Famous botnets through history
• Summary

4. Intro - terms
BOT or „zombie“. Short for roBOT.
NET short for interNET
Botnet a lot of infected computers
Bot Herder or „bot master“ can control
the botnet remotely
C&C Server command-and-control centre
for botnet managing

5. Star and multiserver
topology

6. Hierarchical topology

7. Random topology

8. Types of attacks
• Distributed denial-of-service (DDoS)
• Adware advertises
• Spyware
• E-mail
• Click fraud
• Fast flux
• Brute-forcing remote machines services
• Worms
• Scareware
• Exploiting systems

9. Famous botnets through history
• 2001 – First Botnet
(http://www.bizjournals.com/atlanta/stories/2002/07/22/story4.html?p
age=all)
• 2005 Torpig
• 2006 Virut
• 2007 Zeus – one of the biggest (compromised U.S. computers: 3.6
million)
• 2007 Storm
• 2008 Conficker
• 2008 Grum
• 2008 Lethic
• 2008 Mariposa
• 2009 SpyEye
• 2010 Waledac
• 2011 ZeroAccess
• 2012 FlashFake (Mac OS X)
• 2012 Jeef
• 2012 Smoke

10. Summary
• Botnets are serious problem today
– Malware as a Service
• Bleak future awaiting us
– Mobile botnets on the rise
– Internet of Things botnets

11. IoT BotnetInternet of Things botnets
In December 2013 a researcher at Proofpoint noticed that hundreds of thousands of malicious
emails logged through a security gateway had originated from botnet that included not only
computers, but also other devices – including SmartTV, a refrigerator and other household
appliances.
IoT worm used to mine cryptocurrency – worm Linux.Darlloz
http://www.symantec.com/connect/blogs/iot-worm-used-mine-
cryptocurrency
Infecting DVRs with Bitcoin-mining malware even easier than you
suspected
http://arstechnica.com/security/2014/05/infecting-dvrs-with-
bitcoin-mining-malware-even-easier-you-suspected/

12. QUESTIONS?

13. Resources
• http://en.wikipedia.org/wiki/Botnet
• http://www.welivesecurity.com/2011/06/27/tdl-tracking-peer-pressure/
• http://www.abuse.ch/?p=3499
• http://www.securelist.com/en/analysis/204792227/The_anatomy_of_Fl
ashfake_Part_1
• http://www.networkworld.com/news/2009/072209-botnets.html
• Fortinet – White Paper: „Anatomy of a Botnet“
• Fortinet – 2013 Cybercrime Report
• Gunter Ollmann, VP of Research, Damballa Inc. – Botnet Communication
Topologies