What’s a “botnet”?

botnet (bot·net) noun A collection of software robots that’s normally associated with malicious software. Botnets are notorious for being platforms for spam distribution.

The term botnet can refer to any group of software “robots” and normally consists of a collection of compromised (“zombie”) computers running the botnet software. In most cases the PCs running the botnet software are turned into zombie computers unknowingly, usually through drive-by downloads (software that is downloaded and automatically installed through exploited browser vulnerabilities, or by software worms, Trojan horses, or other malware). Botnets are usually controlled remotely by a botmaster using a central command-and-control interface on his or her computer.

A really good botnet can be installed on a user’s machine and never arouse any suspicion to the user through normal means of detection such as computer performance slowdowns, increased bandwidth usage, pop-ups, etc. It’s possible that a PC can be the unknowing accomplice to a number of blackhat operations, including:

• Spam:

  By utilizing it’s network of zombie computers, a botnet can be a powerful spam distribution platform. Millions of spam emails are sent out by botnets every day.

• DDoS:

  With enough infected computers, issuing a Distributed Denial of Service Attack (flooding a website with enough bogus traffic to bring it down) can easily be done with a botnet.

• Spreading malware:

  A zombie PC in a botnet can also be set up to not only self-propagate onto other unsuspecting computers, but it can also be a delivery system for other forms of malware, too. (viruses, spyware, Trojans, etc.)

• Information collection:

  Sometimes the only job of the zombies in a botnet is to collect information about the human host: what they click on, who they email, their passwords, etc.