Botnet Attacks

Description

A botnet is used for DDoS, sending spam, phishing campaigns, password spraying, cryptocurrency mining, malware distribution and other work that needs quantity. The strength of a botnet is not in one device but in the sum of thousands or millions controlled from one place.

A botnet is the consequence of many compromised devices brought together under one attacker. A badly configured router in a house, a forgotten camera in a company and an unpatched server can all end up as infrastructure for an attack on somebody else.

Examples

• A network of compromised cameras and routers generates large DDoS traffic at a public service.
• A botnet sends mass phishing messages from compromised devices, changing sources to make blocking harder.
• Compromised servers are used to attempt logins on a large number of accounts through password spraying.

Notes

• A device that merely sits on the network is not harmless if it has a default password, old firmware and access to the internet.
• With botnets, infrastructure hygiene is a collective matter. Somebody else's neglect becomes everybody's problem.