Botnets

One of the popular ways the online criminals  make money is through the use of botnets. Once a botnet is set up they can use it in many different ways , such as for sending spam mails or distributing malware , virus, etc.
Botnets are a group of compromised systems  which are controlled by hackers, attackers or individual for propagating virus, malware, spam to other computers on the Internet.  If your PC is unsecured, then there is a chance your PC could become  a bot. Botnets usually work in client- server model where the attacker owns a Command and Control server ( CnC server). A computer part of the Botnet will receive instructions from the CnC Server. Once your PC is part of  botnet, hackers can extract confidential information from your PC through Internet.

CnC based Botnets:
Command and control server acts as a leader to the bots. These Bots (Computers infected with malware)  contact CnC server for receiving commands.

P2P based Botnets:
These do not rely on Command and control servers for receving commands, instead uses peer to peer communication protocol for receiving commands. P2P communication is used as a backup when CnC servers are not reachable. In this network each node acts as slave and as master giving orders to other PC.

Lets examine some Botnets in recent years,
Grum botnet is one of the largest botnets established over the Internet , it has two different types of CnC servers, they are Master CnC servers and Secondary CnC servers.  Dutch authorities recently take down the  two secondary CnC servers located in Netherlands. The Master CnC servers  located in Russia and panama are still alive.


DreamDroid and TigerBot malware  compromises Google Android devices. TigerBot is an Android malware controlled via SMS , it is capable of recording phone calls,  upload device GPS location. TigerBot differs from traditional malware in that it is controlled via SMS rather than from a Command and control server on internet.


How to detect botnet:

  • If machine is working slowly then it may be an indication of botnet,  as botnet uses victims machine resources.
  • Use Network intrusion detection system.

Preventive measures:

  • Use updated  Anti-virus.
  • Regularly update your Operating System and if possible enable automatic software updates.
  • Uninstall software that you don’t use.
  • Avoid clicking links on spam emails.
  • Use strong passwords to protect your account
  • Don’t use the same password for all sites.
  • Don’t put unknown pendrives into your computer.
  • Turn on your firewall.  

Tools to Remove malware from your PC


Microsoft Security Essentials: It is used to guard against virus, spyware and other evil software. It is free of cost and easy to use software for windows Operating systems.

You can download Microsoft security Essentials at following link.
http://windows.microsoft.com/en-US/windows/products/security-essentials/download

You can also use  Antivirus programs to remove malware , the following are the links to Free Antivirus programs.
Avira - http://www.avira.com/en/downloads
Avast - http://www.avast.com/free-antivirus-download
AVG - http://www.avg.com/in-en/special-download-antivirus-for-windows-7-mssc

Source:
 http://thehackernews.com/2012/08/botnet-hacker-news-magazine-august-2012.html
 http://www.microsoft.com/security/pc-security/protect-pc.aspx

Address

Centre for Development of Advanced Computing, (C-DAC)
Plot No. 6 & 7, Hardware Park, Sy No. 1/1, Srisailam Highway, Pahadi Shareef Via Keshavagiri (Post) Hyderabad - 500005

Phone

Phone: 040-23737124/25
Mobile: 040-23737124/25

TollFree

1800 425 6235

Email Address

isea[at]cdac[dot]in