Botnet: infection, remote control, and a DDoS example

0 / 4

Botnet

A bot is a device infected with malware that follows an attacker's commands. Not only PCs but also routers and cameras can become bots. A network of many such bots, controlled together by an attacker from afar, is a botnet.

Example: a centrally controlled botnet attacks one web server.

1 / 4

Infection: a device becomes a bot

A device gets infected when it runs a malicious file or when attackers exploit a security vulnerability. Once the malware runs, the attacker can send commands to the device remotely. The owner of an infected device may be a victim too, since the device is used without their knowledge.

2 / 4

C2 link: waiting for commands from the control server

In this example, the infected devices connect to a central control server. C2 stands for Command and Control. Some botnets have no central server; their bots pass commands to one another peer to peer (P2P).

3 / 4

Attacker: sends the attack command to many bots

The attacker sends an attack command to the control server. The control server passes the command to the connected bots. In this example, the command tells every bot to send requests to the same web server.

4 / 4

Bots: concentrating requests to disrupt the service

Many bots send a huge number of requests to the target web server at the same time. When the server or network is overloaded, access for normal users can slow down or fail. This kind of attack is a Distributed Denial of Service (DDoS) attack. Botnets are also used to send spam and steal information.

A figure that follows a PC, a router, and a camera from malware infection to becoming bots, linking to a control server, and flooding one web server on the attacker's command

A figure that follows a PC, a router, and a camera from malware infection to becoming bots, linking to a control server, and flooding one web server on the attacker's command