Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
The results are in! See what nearly 90,000 developers picked as their most loved, dreaded, and desired coding languages and more in the 2019 Developer Survey.

Questions tagged [botnet]

A botnet is a collection of computers that are under the control of a person or group, usually facilitated by malware. These computers are often used to take part in DDoS attacks and spamming.

79
votes
5answers
13k views

Email Account under attack (really) - anything I can do?

Over the last week, there is a constant barrage of authentication failures to my email account from a variety of ip addresses - usually in blocks of exactly 575 attempts. My password is as strong as ...
1
vote
2answers
80 views

Zeus v3 - can I detect its existence “manually”?

A firewall in my company was triggered by a DNS query from one of our laptops. Specifically, the exact reason was MALWARE-CNC Win.Trojan.Zeus v3 DGA DNS query detected. Now, I could just follow this ...
1
vote
0answers
27 views

Question on a decentralized botnet, is this technically how communications would flow? (Flowchart)

I am trying to get into and researching botnets, to help myself learn and others prevent attacks. First thing is understanding how decentralized botnet's work. I asked a question yesterday explaining ...
0
votes
1answer
80 views

How does the server-client scheme work in a botnet?

I am having trouble wrapping my head around the idea on how a server-client botnet structure actually works. Let's say that the server is A, and the client is B. We know A is listening always on ...
0
votes
1answer
111 views

Server getting probed: why can I see successful GET requests to other sites?

I put up my site yesterday and this morning I saw a lot of requests in the logs. I have seen this before, and immediately could tell it was someone/something probing the server. Most of the requests ...
1
vote
2answers
157 views

Are botnet nodes made to stop working during office hours?

Some network guys at my work seem to think that a client that we monitor may be part of a botnet, but the spike in traffic that we see at night always stops at the latest around 8am in time for office ...
0
votes
0answers
68 views

What can attackers do to increase the rate of attempts in a brute-force attack as the number of attempts increases?

I am aware of this post (about Moore's Law and brute-force attack). Suppose is the number of brute-force attempts, we have . What I want to ask is the following: suppose an attacker started a brute-...
2
votes
1answer
110 views

Honeypot SSH connection attempts with no interaction

I am seeing a lot (>50% of total events) of connection events on a honeypot I have set up but there is no further interaction, no brute force, just a connect then disconnect. I'm thinking this is ...
-1
votes
2answers
328 views

Which are the most dangerous and popular botnets that came from IoT devices?

The ease of taking control of a cheap IoT device makes them the perfect target to craft a botnet to perform DDoS attacks. I heard about botnets created from a lot of hacked IoT devices used to ...
1
vote
0answers
28 views

How to (easily?) protect a mobile authentication endpoint?

I'm creating an app that runs both on the web and on mobile (loads offline files through cordova inside a webview) For my user's login forms in the web vesion, I use google captcha to protect ...
5
votes
1answer
633 views

Unusual GET Request

I am getting unusual get requests to my server: /op69okl?name=http://www.ntdtv.com/ or /op69okl?name=http://www.epochtimes.com/ or something similar with other sites in the param. Doing some searching ...
3
votes
0answers
155 views

Security Risks specific to IPv6-only hosts

Because I can get full IPv6 support now from my home office (Comcast did this right) I have started to bring up cloud servers with no IPv4 addresses -- only IPv6. I use a static address and create a ...
1
vote
3answers
388 views

Risks of deploying MIRAI on my local network for testing?

Once again for research purposes I would like to "release" the MIRAI botnet on an IoT subnetwork in my home. However I am unsure of the consequences that this may have (e.g. damage my devices). What ...
2
votes
0answers
89 views

How does Mirai (or any IoT malware) perform the initial infection? [duplicate]

From what I understand, Mirai and other related IoT malware use already infected bots to perform the scanning of various IPs for open ports to find potential new victims. How is the first bot infected ...
2
votes
2answers
719 views

Is it still possible to run an online dictionary attack from a single machine, without anonymisation?

This question concerns dictionary attacks conducted: Over the Internet, using programs like THC Hydra Via protocols such as HTTP, FTP and SMTP I believe I'm right in thinking that: a) due to the ...
0
votes
1answer
31 views

Are emails from the Necurs bot net DKIM and/or SPF signed?

As the questions title already asks: Are emails sent by Necurs DKIM and/or SPF signed? Or are they unsigned and simply spoofed?
-1
votes
1answer
89 views

Can I identify which botnet is attacking my service?

My service is seeing a fairly sophisticated attack that is distributed across multiple IP addresses. I have a list of 'rogue' IP addresses. They are distributed all around the world. Is there some way ...
0
votes
1answer
63 views

Finding/Predicting BotNet Generated Domains Without DGA Knowledge

I will pose an academic perspective in my question, but I welcome any and every observation. So a botnet would generate 1000s of domain/day and an actual attacker will register a few, which will be ...
-1
votes
2answers
157 views

Botnet callbacks to coin mining sites - how to act? [closed]

I found that one user is making connections to coin mining related domains. Is there any way to stop this activity, with respect to that user?
2
votes
2answers
139 views

Is there a way to prevent comments from being abused for command and control?

Botnets typically are coordinated over protocols like HTTP or IRC. However, to make such command and control traffic harder to spot, attackers have occasionally turned to other channels, including ...
4
votes
1answer
284 views

How does a botnet update?

So recently I started to study how botnets work. But recently I stumbled onto a problem. I even tried brain storming how it would do it, but I couldn't think how a bot would update its code. I also ...
2
votes
1answer
383 views

What to do when my router is infected with a malware (becoming a part of a botnet)?

Backstory Few years ago I bought an Aztech DSL5005 ADSL router, it was the only router available which I could verify I can telnet to and get a proper Linux environment (I wanted an OpenWRT enabled ...
4
votes
3answers
2k views

How does Malware use Unregistered Domains

I just finished reading that the WannaDecryptor malware was querying an unregistered domain. I thought it was connecting to its command and control server. Is this correct? It is my understanding ...
0
votes
2answers
846 views

How Mirai scans or find targets [duplicate]

I read some articles about the Mirai botnet. I can't understand how Mirai scans/finds IoT devices. Does Mirai scan the entire public IP range with an open telnet port and try to log in?
3
votes
1answer
97 views

Dangers of Botnet Scanning Traffic?

Are there any dangers to seeing small amounts of botnet/malware associated traffic crawling your public facing infrastructure? For instance seeing the same malware associated IP making different ...
3
votes
1answer
103 views

One computer on our network was hacked and stole hundreds of accounts on different websites - what are correct steps to take?

Someone in our company long time ago downloaded infected Windows Server copy from torrent site and kept it as test server in our network till now. Recently, our administrator noticed huge outgoing ...
0
votes
2answers
143 views

Where to find current, live botnet executable clients

I've been able to find readily available botnet source code online however I'm currently working on my university research project and require access to an actual botnet client which encompases DGA's (...
5
votes
2answers
2k views

How does Mirai's C&C communicate with its bots?

I'm wondering how Mirai based botnets work. Specifically, I want to understand the communication mechanisms between the C&C servers and its bots. After reading this question I've understood that a ...
-5
votes
2answers
1k views

remove mirai virus on router

I need some help with removing the mirai worm on my rounter. Few days ago my ISP was on cyberattacks which it have affected over 100,000 customers who couldn't be able to get access to the internet ...
8
votes
1answer
223 views

How could ISPs “clean up their act” to protect against Mirai?

In the forum post in which Mirai source code was released, the author wrote With Mirai, I usually pull max 380k bots from telnet alone. However, after the Kreb DDoS, ISPs been slowly shutting ...
11
votes
4answers
7k views

Can I protect my router from a Mirai Worm and how do I know if I'm vulnerable?

Today this article was published by the BBC: Talk Talk and Post Office routers hit by cyber-attack. It states: It involves the use of a modified form of the Mirai worm - a type of malware that is ...
1
vote
1answer
118 views

Is a router a better device for a IoT botnet than something in the router's network?

As some of you maybe noticed, there was a attack this weekand against routers of the german provider Telekom an their routers "W723 Typ B" and "W921". According to the news here in Germany, they ...
2
votes
1answer
415 views

Have botnets been used as a TOR-like network?

I may be a bit naive on the subject, so bear with me. I know that hackers can use a botnet as a proxy to hide their IP, but there are ways to discover their IP when the traffic is intercepted. I also ...
5
votes
2answers
429 views

How is the Mirai botnet directed?

One of the recent malware making the rounds is the Mirai botnet, which seems to be focused in Linux-based Internet-of-Things devices. It has been used for DDos atacks on many major websites, including ...
4
votes
3answers
653 views

What happens to zombie machines after DDoS attacks?

Do the zombie machines that takes part in a DDoS attack belong to ordinary people just like you and me? Can we be the part of a DDoS attack even without realizing it? What happens to these slave ...
5
votes
1answer
861 views

I ran netstat and one thing that came up was MSN bingbot, does that mean my computer is being used as part of a Microsoft botnet?

I ran netstat on my computer, and one thing that came up was msnbot-65-52-108-216. I did some research and what came up was that it's from an IP originating in Redmond, Washington and that it's likely ...
15
votes
3answers
3k views

Are HTTP brute-force password-guessing attacks common nowadays?

Are brute-force attacks against online accounts (gmail, facebook, instagram) something that really happens? I don't mean something like cracking password hashes or DDoS, but real brute-force attacks (...
3
votes
1answer
119 views

Popular website contains ad that triggers remote scan from botnet: what should I do?

One of my country's main TV channel has a website from which one can watch it live - in streaming. Obviously, it serves ads in the meanwhile, mainly from google partners. One night I had the website ...
2
votes
2answers
479 views

Chrome OS Security

I am new to how botnets work and I was wondering if Chrome OS could be infected to become part of a botnet? I own a chromebook and would love to know if this is possible for testing purposes. Is the ...
0
votes
2answers
287 views

Command and Control Infrastructure

This is an academic question, I googled a lot but couldn't find suitable answers for this question: What are the different Command & Control infrastructures (Botnets) & what are the ...
8
votes
3answers
670 views

How To Stop A Mobile Verification Attack

I am thinking of using mobile phone number verification for the sign up step in my web application but how do I prevent a hacker or a malicious user from sending mobile verification requests to an ...
0
votes
1answer
54 views

Which is better: detecting spam at receiver or source?

Background I researched a detection of spam sent out using bots. After studying different techniques used by bots to deliver spam, I have no generalised solution to detect spamming at the source ...
0
votes
2answers
404 views

Spam mails originating from botnet

Background I am working on spam detection at the receiver side,i.e where all mails are delivered,i.e at the mailserver side. Spammers are capable of sending spam mails through Bots,Open relays and ...
1
vote
1answer
249 views

Hops encountered More for spam Mails than Legitimate Mails

Background I am working with email headers for spam detection. Each E-Mail header contains many "Received:" headers fields. Each "Received:" header is added by an intermediate Smtp/Mail server in the ...
3
votes
2answers
680 views

DGA (Domain Generation Algorithm) - malwares

Some malwares use DGA (Domain Generation Algorithm) to randomly generate domains in order for the zombies to be able to communicate in a resilient manner with the C&C. As far as I know, there is ...
2
votes
0answers
1k views

How to reduce Adwords click fraud (botnet clicking ads)? [closed]

I hope this is the right place to ask (here is a similar question but the answers aren't specific for AdWords). My Google AdWords campaign has been under attack for the past 3 days. Bots from ...
1
vote
1answer
1k views

Nginx: How to block IP by hostname regex

I'm running a small wordpress site with nginx + php5-fpm. I have noticed that I get a lot of botnet attacks from IPs with hostnames like: 52-182.static.spheral.ru 208-135.static.spheral.ru 118-239....
0
votes
3answers
606 views

How do botnets not get caught when using Gmail accounts for spamming? [closed]

Botnets are Spamming through web-mail services like gmail.com,hotmail.com,etc. by compromising email-accounts I read a post from this forum about how online accounts are compromised. Following are ...
1
vote
0answers
442 views

Detecting Bots Who are sending Spam Mails via Webmail

I am working on spam Detection done by botnets. Some Information Recently,I came through a techique to detect the spammer in my network which is based on the anamolous amount of MX queries,outbound ...
-1
votes
1answer
603 views

How do Bots Spam Where Outgoing SMTP is blocked

I have read,that bots in an internal network talk directly to External Mail servers instead of going through the Internal Mailserver to deliver spam. Query If it's true, than how do Bots spam do so ...