Marcial Quinones-Cardona Botnets Individual Project By Marcial Quinones-Cardona Mercy College Dr. John Yoon

What is a Botnet? A collection of hacked computers whose purpose is to perform criminal attacks. A hacker will send a virus to a user hoping that they will download the program. Upon opening the file, the virus will then install itself and the user will join the botnet. A botnet owner can perform acts such as stealing data from one’s computer, DDoS (Distributed Denial of Service) attacks, and keylogging, and email spam.

How Botnets are Spread: More in Depth Look Botnets can be spread throughout any type of media or messaging service. Emails are a very common place that a virus can be sent. Users can spoof their address which means they can send you an email from a service they aren’t really using. Ex: You can spoof an address to say support@apple.com and have your Apple account stolen through phishing. The same method for phishing can be used for virus spreading.

How Easy it is to Obtain a Botnet? Gaining a botnet is fairly easy. Services such as, “Botnet-as-a-Service” or BaaS have been created so that you can easily buy someone’s botnet. What this means is that you can pay as little as $5 to a hacker and they will allow you to use their botnet service. This botnet service can allow you to send multiple viruses to infected victims, DDoS websites, and the other malicious things mentioned in the previous slide. Additionally, one can even go through the effort of hacking a fridge or security camera to use in a botnet.

Why It’s Important to Stop Botnets Botnets are one of the most malicious viruses one can have on their computer. They are easily undetectable, especially when the victim is unaware that their computer might be compromised. Companies can lose out on millions of dollars every second their website services are down! These botnets can be used to attack government websites or hack government property.

Problems With Malware Detection No set method on detecting them. Antivirus and firewalls are helpful, but for only so long; What is meant by that is technology is advancing which means that malware is too. Your simple firewall and antivirus can only detect so much. Internet of Things (IoT) devices are common in most households. These can cause an issue by being hacked and used in botnet software as well. There is essentially no AV (anti virus) for these devices, essentially making malware detection a problem. No organization has been created specifically to stop cyber crimes.

How We Can Potentially Fix the Problem Honeypots: A honeypot is essentially a trap that is used to either allow an attack to go through on a false server/system or to prevent it from happening in general. Preventing the attack from even happening can be a huge life saver. Help emulate the attack so we can understand how it happened and prevent it in the future.

How We Can Potentially Fix the Problem Contd. [1] Filter Module: Set up a filter that whitelists and blacklists incoming connections. Get a general idea of who is a real person accessing a website or a bot. Monitor their activity and see what they are browsing and doing on said website.

How We Can Potentially Fix the Problem Contd. [2] Track the Source: By looking through the source code or potentially learning more about where it originated, we can track down who may have started the botnet. Developers have been caught before selling their products to the wrong people. (Law Enforcement) There is no specific team for cyber crime, but the FBI and other branches of the law work effortlessly to find these criminals. Locking them away can help prevent them from creating these sources.

Conclusion Stopping botnets is going to be a very hard thing. Research is going to be needed to understand the mindset of those who are creating these tools and then potentially allowing us to come up with ways to stop them from spreading. Tools should be created to detect any suspicious software that was installed on the computer. Additionally, applications can be made to not only monitor programs that have been installed the past few days, but also see what they are doing in the background.