Botnet

Botnets were originally conceived as networks of computers for running and keeping web services active. Criminals have compromised them to carry out fraudulent activities.

Network zombies

We can think of botnets as a network of bots (robots).
In the negative sense they have acquired over time, these bots are also called network zombies.

The zombies of a botnet are not just PCs, tablets and smartphones, but also PLCs, SCADA systems and even the hardware of refrigerators, heating systems or cameras.
The only common factor is that they are able to connect to a network, and therefore to the Internet.

These bots are all connected to a single Command and Control centre (C&C), which receives the data and from which commands are launched.
The Command and Control centre is run by an individual or a group known as the botmaster.

Life and Death

The life of a botnet consists of three (or four) very distinct phases.

1. Infection

A botnet is created through an initial infection phase.
Using all the methods already seen, exploiting system vulnerabilities or spreading via trojans, emails, removable devices and so on, the botmaster spreads the threat, expanding it as far as possible.

At this stage it is not very important “who” gets infected but “how many”.
Every device that comes under the hacker’s control becomes a zombie.
Almost every time, a zombie does not even know it is one.

2. Attack

Botnets have very short lives. The purpose for which they are created is always very specific and has even worldwide relevance, unlike the spread, which aims to reach as many devices as possible.
The very vulnerabilities exploited might be discovered only a few days later. The window of time is very short.

The target itself is almost always external to the infected devices. This is so as not to arouse any suspicion.

When the botmaster considers the network ready, they ask all the devices they control to perform small operations (remember that a bot could be a networked refrigerator with very little processing power).

These “small” operations, distributed on a large scale, have devastating results.
Especially in cases of brute force or DDoS attacks on government networks or industrial plants.

3. Death

As soon as the network of zombies has served its purpose, it is usually “forgotten”.
The speed required in implementation and distribution does not allow for the creation of “sophisticated” software, only the minimum needed for the purpose for which it was created.

As the damage is very destructive – unlike ransom-motivated infections, which usually hit small organisations or private individuals – cyber security companies are very keen to provide solutions to close these gaps as soon as possible.

According to data obtained by Fortinet during the first quarter of 2018, 58% of botnet infections last less than a day, 17.6% up to two consecutive days and only 5% for more than a week. The botnet with the greatest persistence is Mirai, which specifically infects IoT devices, using them for DDoS attacks or to provide proxy services, with an average of 5.5 days.

4. Resurrection

Some anomalous cases can occur, however.
Devices are infected with the aim of regaining control of them later, or the zombies may be made more resistant to removal through future updates.

In these cases the botmaster will use a series of tricks to make the infection “survive”, even a possible change of C&C.

Updating many devices (mainly IoT) is in fact not entirely trivial, and the hacker, having control of them without the user’s knowledge, could even block security updates.

Command and Control Centre

Bot networks are mainly of 3 types, depending on how the C&C is created and managed.
In technical jargon this is called the botnet architecture.

1. Centralised

In this architecture, the bots connect directly to one or more C&C centres (for redundancy), download information there and wait for commands.
The botmaster must connect to one of these centres in order to operate on the network.

Commands can be sent intermittently (web/HTTP or otherwise IP-based services) that publish the commands the bots download (pull method).

Or continuously via IRC (chat) protocols, whereby commands are sent to the bots (push method) in real time.

Centralised botnets are of 3 types:

• Client/Server architecture: the bots connect to a single C&C. This structure is the weakest: once the centre is eliminated, the whole network stops working.

• Multi-Server architecture: the bots connect to several C&Cs. To destroy the network, all the centres must be destroyed.
  The botmaster, moreover, can always create new ones if even just one of them survives.

• Hierarchical architecture: the C&C communicates only with some bots, which in turn connect to others, and so on.
  This architecture is very difficult to destroy because the C&C is well protected by the hierarchy that makes up the network.

2. Decentralised

In this mode there is no real C&C; instead, one or more of the bots themselves are the centre to which the botmaster connects.

These then send commands to the other bots through P2P connections, making this network very difficult to stop.

In this case the network’s resilience to shutdown increases, but at the same time it is much harder to build.

3. Hybrid

The hybrid architecture combines the advantages of both.

One example would be to communicate over a P2P network with a server that is elected as the Command and Control centre, then exploiting HTTP connections to bypass network defences.

Or to make the centre “virtual”, while it is in fact embedded in the bots themselves.

Uses and Purposes

We know well that the aim is always IT-related fraudulent activity.
Let us now look more specifically, however, at the various uses for which a botnet is created.

DDoS attacks

Perhaps this use is not the most common, but it is certainly the most dangerous. Thousands or millions of zombies can attack the same Internet resource simultaneously.

Certainly, as we have seen, each bot may have limited computing resources, but this is where numbers win.

A DDoS attack can put a stop to important services that need to be connected at all times – such as the monitoring of power plants or passenger transport systems.

Email spam

When you have millions of computers under your control, why not use them to bombard the web with malicious emails?

If every bot in the network could send even just one email per second, the total traffic would be staggering.
And that is not all! Almost all spam is generated by botnets.

Trojan horse (for ICS systems)

A bot may have no specific purpose other than spreading itself.

It could, however, be kept “dormant” and later used to inject malicious software through it.

This software could even (see Mirai) attack OT systems, decoupled from the IT infrastructure. It could in fact use the connectivity that the bot provides to the botnet to download something more dangerous.

The sticking point is that it is often very difficult to work out where the malware comes from, precisely because the bot software in itself does nothing harmful.

Information gathering

A network of zombies can also be used in “passive” mode.
The infected devices collect information and spy on the network, sending data to the C&C and to the botmaster.
This purpose makes the network easier to design.

This information can then be used for further attacks or sold for a fee (both to the victims themselves and to more or less legal organisations).

Information dissemination

In the era of web espionage, it may be necessary to share confidential information that might otherwise be censored.

This type of data can concern classified information of governments or military services, but also services such as illegal streaming or the sharing of content that would not otherwise be available in a certain country.

This type of use is usually not malicious – indeed, in many cases it is ethically right, such as spreading information in countries under dictatorial regimes.

We must, however, be aware that our computer has been an “accomplice” to breaches of the security systems and information of governments or industrial systems.

Advertising fraud (adware)

Online advertising services – called adware (advertisement and software) – are mainly based on the number of views or “clicks” on banners.

Many criminals use botnets to mimic the clicks and views of a user, multiplied by millions of them.

It is not easy for an advertising service to tell which are real and which are fake, and the techniques (on both sides) are becoming ever more refined.

Resale

One of the purposes of a botnet could be its very existence!

Many experts in fact create networks of zombies for the sole purpose of reselling them so that they are used for criminal purposes as we have seen above.

One of the problems in this case would be legal in nature: what is the legal liability of the creator of a bot network sold to third parties?

Certainly, infecting PCs is already in itself criminal behaviour!

Underground status

Last and perhaps least important, in many circles frequented by hackers, having a vast network of bots can carry social weight that confers prestige and standing!

Am I infected? How can I find out?

To detect a bot or a botnet, all the usual methods used for generic malware can be applied.

However, there are also specific methods: a botnet, unlike much malicious software, has a peculiar characteristic: it must be connected.

By checking all the connections that our private network makes, we can identify anomalous ones.

A widely used method is to use a decoy, usually a particularly weak PC that is easy to compromise, so that malicious software is “attracted” to it.

At that point everything anomalous that has hit the decoy is blocked, whether it be the IPs from which attacks originate or the signatures of software that should not be present (or that was not present previously).