Are there any known botnets that specifically target smartphones? What is their topology and how are they controlled?
What are they used for?
Generally speaking, we haven't seen large, long-lived botnets formed by compromising smartphones, in the same way as we've seen for desktops. (There are small-scale exceptions, but this is is a good first approximation.) There certainly has been no shortage of malware targeting smartphones, but what it does once it compromises your machine looks a bit different from what tends to happen on desktops.
It's instructive to look at why. Why do bad guys want to compromise your desktop or your smartphone? Because they want to make money. Therefore, they are going to be driven and motivated by what they can do with your compromised machine -- in particular, how they can make money from it.
Right now, the main ways of making money off a compromised desktop are things like sending spam, hosting bad web sites (phishing sites, pharmaceutical storefronts, etc.), launching DDoS attacks, stealing users' credentials, and so on.
Most of those attacks are not possible or less attractive on smartphones. Smartphones tend to have lower network bandwidth than desktops, so they're not as useful for sending spam, hosting bad sites, or launching DDoS attacks. Also, due to sandboxing and other security protections, it is not as easy to steal users' credentials (it is possible, but not as trivial).
For these reasons, we shouldn't expect to see bad guys leverage compromised smartphones in the same way that they leverage compromised desktop machines.
For more detail, see the following research paper, which surveys smartphone malware seen in the wild (up to 2011) and speculates on incentives that might drive malicious behavior in the future:
For more research, see the following:
There is at least one botnet I know of, it was malware cloaked as a regular app. While the app was running it logged into Yahoo email addresses and started sending spam. This particular botnet was discovered by Terry Zink, a security researcher at Microsoft.
The malware was spread by using independent application stores. Almost all of the phones resided in Argentina, Ukraine, Pakistan, Jordan and Ryssua, where independent appstores are popular but often contain more malware.
SMS controlled botnet
Georgia Weidman, a famous security researcher currently focusing on Android, made a proof of concept for a botnet to be used on smartphones. It used SMS to communicate to the different bots by using an encrypted payload that only the bot application would be able to decrypt and recognize.
The bot would position itself between the modem and the userspace. If the bot receives a messages destined for him he will keep it (signature), otherwise it will be sent to userspace.
The topology is 1 master -> multiple sentinels (long infected bots) -> other bots
Her example included a PoC for Android (Root exploit) and for iPhone (Jailbroken and iKbee worm for non-rooted phones).
Complete presentation here.
If you wonder why sms, it's because it uses less batteries than a constant probe using the internet connection.
The Ikee.b worm resulted from Ashley Towns Ikee.a worm. Where Ikee.a was relatively benign (Rick Rolling users). However Ikee.b was used to extort users. It also listened to a C&C server in Lithuania. Periodically all bots would probe the server to check if there were any instructions.
More info on this worm can be found here.
Spam Soldier (see here, here, and here) targets android devices with text messages that lead you to download malware. The malware is then used to make your device part of a spamming botnet. This is a 'in the wild' attack, not just a theoretical exercise. The 'business model' behind the attack is the standard standard spam business model.