Archive notice: This article was originally published on May 29, 2008. Links and embedded videos are preserved as part of the historical record.
They have now developed into the most significant threat and one of the most important sources of income for criminals on the internet. A paper by Kaspersky Lab virus analyst Vitaly Kamluk entitled “Botnets—Doing Business with Zombies” explains the botnet phenomenon. The article examines the structure and use of these zombie networks and opens a series of articles on botnets.
A botnet is a collection of computers infected with malware that allows cybercriminals to control the compromised machines remotely. Malware developed specifically to build botnets is known as bots.
Botnets have enormous computing resources. They are a threatening weapon in cyberspace and an effective means of making money illegally. Computers belonging to a botnet can be controlled by cybercriminals from any location, while the structure of the internet provides botnet operators with anonymity. Users of compromised computers generally have no idea that criminals are using their machines. Most zombies are home users’ PCs.
Botnets can be used for a wide range of criminal activities—from sending spam to extortion, phishing, data theft, and attacks on government networks. Cybercriminals wishing to use botnets for their purposes no longer need special knowledge or significant start-up capital. The illegal botnet industry offers complete packages at moderate prices to anyone interested, including software, ready-made networks, and anonymous hosting services.
At present, botnets are among the most important illegal sources of revenue on the internet and are a dangerous weapon in the hands of criminals. It can hardly be assumed that cybercriminals will voluntarily give up such an effective tool, and IT-security experts are concerned that botnet technology will continue to develop.
Not only cybercriminals may be interested in building international botnets, but also states prepared to use zombie networks as a means of political pressure and as weapons in cyberwars against other countries.
Networks combining the resources of dozens, hundreds of thousands, and in some cases millions of infected computers possess extremely dangerous potential, Kamluk concludes. This concentrated cyber power is based on infected home users’ computers, which make up the overwhelming majority of zombie machines and are exploited by criminals for their own purposes.
Further links:
- The complete paper
