BOTNETS Presented By : Ramesh kumar Ramesh kumar 08EBKIT049 08EBKIT049 A BIGGEST THREAT TO INERNET

A Quick Glance  Introduction  History  How do they work ?  Protocols  What are they used for ?  Types of BOTS  Prevention  Conclusion

INTRODUCTION  Botnets are networks of computers taken hostage by malware that controls them and makes them to act in other nefarious ways.  A "botnet" is a collection of computers that have been infected with remote-control software.  Runs autonomously and automatically.  User unaware

History  Originally used in IRC as a way to allow automated tasks to be done Protect a channel, kick a user out of a channel etc.Protect a channel, kick a user out of a channel etc.  Eventually evolved into a way to automate malicious tasks  Started with DoS/DDoS against servers TFN, stacheldraht, trinoo (1999)TFN, stacheldraht, trinoo (1999)

How do they work? Worm/Trojan program that's usually transmitted through a spam. 2. Bot connects to IRC C&C channel 4. Repeat. Soon the botmaster has an army of bots to control from a single point 3. Botmaster sends commands through IRC C&C channel to bots Botmaster Victim IRC Server

PROTOCOLS  IRC  HTTP  P2P

Some Important points  Size of Botnets: 50,000 or more BOTS in a single botnet new bots each day.  IRC hides IP’S.  Different botnets can be connected through IRC  Botnets can be rented  Botnet controller is always unidentified.

Malicious activities  Distributed Denial-of-Service (DDoS) attacks. DDoS  Spamming  Sniffing  Keylogging  Spreading new malware  Mass identity theft (Phishing)

GOOD APPLICATIONS  Online games/Polling  Instant Messenger  Search Engines

EXAMPLE  DDoS attack on an Asian e- commerce company in Nov  According to security company Prolexic it was the largest DDoS attacks in 2011  Prolexic refused to tell name of cpmpany because of a trust agreement with the company.  The 15,000 requests per second were performed by a botnet of 250,000 PCs in total, which together peaked at 45Gbps DDoS traffic.

TYPES OF BOTS  Agobot: Most sophisticated. Most sophisticated. 20,000 lines c/c++ code 20,000 lines c/c++ code IRC based command/control. IRC based command/control. Capable of many DoS attack types. Capable of many DoS attack types. Traffic sniffers/key logging. Traffic sniffers/key logging.  SDBot: Simpler than Agobot, 2,000 lines C code. Simpler than Agobot, 2,000 lines C code. Non-malicious at base. Non-malicious at base. Easily extended for malicious purposes. Easily extended for malicious purposes. ScanningScanning DoS AttacksDoS Attacks SniffersSniffers

 SpyBot: <3,000 lines C code. <3,000 lines C code. Possibly evolved from SDBot. Possibly evolved from SDBot. Similar command/control engine. Similar command/control engine. No attempts to hide malicious purposes. No attempts to hide malicious purposes.  GT Bot: Functions based on mIRC scripting capabilities. HideWindow program hides bot on local system. HideWindow program hides bot on local system. Port scanning, DoS attacks, exploits for RPC. Port scanning, DoS attacks, exploits for RPC. TYPES OF BOTS

PREVENTION  Using anti-virus and anti-spyware software and keeping it up to date.  Setting your operating system software to download and install security patches automatically.  Being cautious about opening any attachments or downloading files from s you receive.  Using a firewall to protect your computer from hacking attacks while it is connected to the Internet. Cont…

 Disconnecting from the Internet when you're away from your computer.  Downloading free software only from sites you know and trust.  Taking action immediately if your computer is infected. PREVENTION

CONCLUSION  Botnet a large army of networked computers.  Used in many malicious activities.  Works automatically and autonomously.  Hence biggest threat to INTERNET

THANK YOU