How do botnets self-propogate exactly?

Question

I am learning about malware and botnets and came across that botnets can "self-propogate" and I am confused as to how they can do this. I know that a botnet can be created through multiple people downloading a malicious software or clicking on a malicious link/email attachment but how can an infected computer infect another computer without something like sharing the file unsuspectingly?

Can it only be through something like an e-mail server or can a bot with a malware payload just try to force connections through open ports to other computers it is connected by through the internet as initiated by the bot master? Can the bot master force a file through for example if the infected computer is connected to a p2p network?

How would it compare with infecting other devices on your home network vs devices across the internet?

Answer 1

Who is the target for bot nets?

A lot of botnets use consumer devices that are insecure by default, or are shipped with vulnerable software.

Imagine you buy the ACME HomeLink™ wireless router, which comes with a neat administrative console for customer comfort. If you have a problem, all that customer service has to do is connect to your router on port 32123 and use the password shibb0l33t and they will be able to fix your problem remotely.

Of course, this is highly insecure, so a botnet could just scan certain parts of the web for an open port 32123 and attempt to log in with the publicly known password. They can then remotely flash your router with a custom firmware, which makes it also part of the botnet.

I'm using a router here as an example, because it's a delicious target for bot nets. They are by nature externally accessible and always online. This makes them very lucrative. Of course, other devices can become part of bot nets, such as IoT devices, unpatched servers, etc.

Doesn't this all require user interaction?

The way you framed your question seems to suggest that networking primarily serves the purpose of user interaction. This is false. In fact, the overwhelming majority of network traffic is automated and happens without any user interaction at all. An example of this are software updates, which happen completely without the user's interaction at all.

Furthermore, you suggest that botnets are primarily created by using malicious downloads or links. This is not the case, as personal computers aren't really that good as a "bot". As I mentioned before, the ideal bot is easily accessible and always online. A personal computer is usually not online all the time. Most people use their computer only for a few hours per day, and then turn it off when they do something else or go to sleep.

Personal computers, of course, can be abused otherwise by malicious actors. Other categories of malware are more prominent on our personal computers than on routers for the following reasons:

• Computers usually have more personal and thus valuable data on them, whereas routers rarely have any personal data at all. As such, Ransomware targets this by encrypting such valuable files and exploiting our desire to keep them. If a router stops working, I could just buy a new one.
• Computers are usually much more powerful than routers, and as such makes crypto miners more efficient on a PC than on a router. Even though the uptime is limited, the extreme difference in computational power of a laptop compared to a home router makes the computer more desirable of a target.
• Computers are used to connect to valuable services such as online banking, PayPal, etc. This allows malware to get access to passwords used with these services, or to interact with them directly (e.g. send money from PayPal to an account used by the attacker).

What can a bot do once it gains control?

That heavily depends on the software. Some botnets communicate via P2P systems, meaning that any bot could forward an instruction to any other bot. That means an infected bot does not necessarily need to directly link to the "master" server. It's enough if the master tells one bot what to do, and this bot then propagates the information.

Other bot nets are designed to communicate to a "Command and Control" server, which simply tells the bots what to do.

The actions of the bots vary from botnet to botnet. Some are used to send spam emails, others are used to DDoS a web server, others are used to mine Bitcoin. Basically, if you asked yourself what you'd do if you had control over 100000 machines anonymously, I'm sure you could think of some more examples.

What about home devices?

Botnets are usually rather limited in the kind of devices they can infect. In fact, the operator of a bot net does not care in the slightest about attacking you or every device you own. If they can get enough bots by just exploiting the insecure configuration of the ACME HomeLink™ routers, then that's all they will do. Sure, the bot may attempt to connect to port 32123 on all your devices, but since they don't offer the same functionality, it won't work. Even if your home devices were vulnerable in some way, the botnet would not infect them if they were not previously designed to do so.