How to defend against botnets

The importance of the human factor in facing roBOT NETworks: among the main cyber threats of recent years, able to control hundreds of thousands of devices simultaneously.

The word Botnet derives from roBOT NETwork. As the term already suggests, it is a network made up of compromised computing devices (therefore infected by Malware) connected to the Internet and controlled by a single entity, the botmaster. A Botnet can have both benign and malicious purposes: it can act on a large network of computers remotely, automatically analyse the devices and networks connected to them, carry out DoS attacks, run spam attacks and corrupt other devices.

Creating a Botnet. The attacker first needs a compromised machine infected to be used as a zombie. The Bot is programmed to search for other vulnerable devices, infect them in turn and thus create a large network of compromised targets. The attacker creates a C&C (command and control) centre, configuring and forcing the various hosts to connect and wait for instructions. Through that centre it is now possible to command them simultaneously, launch DDoS attacks or infect other devices.

Main types of botnet. Centralised: commanded by a single C&C which issues commands and controls them totally. However, if the botmaster is traced and neutralised, they will no longer perform their function. Decentralised (via p2p): connected to each other like a peer network, each issuing orders to neighbouring nodes. In this way, even if one is stopped, the others continue their work anyway.

The easiest way to control a botnet is to connect each bot to a remote server. A single control source could send commands and updates through synchronous or asynchronous communication methods. Asynchronous: based on HTTP, it connects to a Web server to load/run instructions at predefined intervals. Synchronous: based on IRC (Internet Relay Chat), it establishes a persistent channel between the bots and the IRC server to receive commands in real time. The centrality of these configurations makes them particularly vulnerable: to neutralise the whole botnet you would just need to identify and shut down the C2 server (HTTP/IRC).

The hackers' choices. Hackers face several choices: implementing a distributed peer-to-peer (P2P) communication mode, where a zombie device can act both as a bot and as a C2 server, making it less vulnerable to a possible counterattack; implementing a mixed communication mode, for example creating a P2P botnet communicating with C2 servers via HTTP; implementing a communication mode using the TOR network which, being encrypted and designed to be anonymous, would allow the botnet's actions to be hidden.

Purpose of Botnets. To enable the simultaneous action of hundreds of thousands of devices, usable by botmasters for various purposes: carrying out DDoS attacks on Web servers; spamming; committing web fraud through simulated clicks on advertising links; mining Bitcoin exploiting the computing power of zombie computers; distributing other malware; renting out malicious services for a fee (MaaS).

Countering and international analysis. Botnets are one of the main security risks of recent years, as they provide computing and bandwidth power to people with not entirely legal aims. Detecting them and taking them offline requires considerable time and energy, since finding an infected machine does not necessarily mean being able to trace the botmaster (especially if controlled via TOR).

How to defend against botnets. The defence against this constantly evolving threat consists in protecting the network and potential access points, i.e. the users, who should be adequately educated about the threat and its management. The human factor plays a fundamental role. Some minimum security tips: update your device with the latest operating system and firmware versions; protect your device with up-to-date antivirus and firewall; download trustworthy and verified software; pay attention to attachments and links in e-mails.

Defence for companies. Defence certainly passes through the digital education of users, but companies can also adopt some precautions: use tools to interrupt the flow of unwanted, high-risk e-mails; filter content leaving the corporate network; counter the lateral spread of the infection through restrictions on domain trust relationships and local administrative accounts; intensify the detection of unusual activity through network monitoring; offer frequent training and updates to employees on security rules and phishing scams.