A botnet to a group of computers that’s been hacked and put under the control of one controller called a bot herder, and all this without the computer owner’s knowledge. They do it by planting a bot into the system and then activating it when it suits their ends.

How they work
Bot herders try to target the machines with broadband internet like those of home users, small universities and enterprises, which are typically with limited resources and knowledge of protecting their systems. These computers often run on Windows without up-to-date patches. The computer are infected by using an e-mail attachment, or more recently, using Internet Relay Chat (IRC). Once infected, the bot logs onto an IRC server to receive commands from the bot herder. Though firewalls, anti-spyware and antivirus programs can stem the flow of attacks, even more programs are being developed to evade detection.

Once a computer is commandeered, the bot herder can use it in a variety of ways. It can be used to download a variety of adware that pays per download, send spam to people listed on the owner’s addressbook, gain confidential information through keylogging, and even cause a directed denial of service attack (DoS) to a selected website by sending huge amounts of traffic and page requests, shutting it down until the attack is over. Because of the flexibility of IRC networks, computers from different countries can be easily connected and controlled through a botnet. Botnets proliferate because the potential of profit is great.

There are signs to tell if a computer has become a zombie in a botnet. Monitor to see if it’s receiving data from a server the user isn’t accessing. Organizations intent on finding and shutting down botnets establish networks specifically made to lure these bot herders out in the open. They allow these to control a computer in their system and tracing the source down. They reverse engineer bots and listen into botnet conversations to find them. If the track a zombie, it will be reported and the data of the infection logged for possible criminal investigations.

[tags]botnet[/tags]