Questions tagged [botnet]
A botnet is a collection of computers that are under the control of a person or group, usually facilitated by malware. These computers are often used to take part in DDoS attacks and spamming.
162
questions
1
vote
1
answer
104
views
Preventing Signup API abuse from botnet
I am working on an e-commerce website, wherein make use of mobile OTP authentication for new signups. We have a fair bit of protection against bots and malicious actors by using aggressive rate ...
- 159
0
votes
2
answers
152
views
How are IoT botnets even a thing when the only write-able folder is /var or /tmp and both gets reset every restart?
This "No Persistence" and having to re-infect again after every reboot seems so inefficient for IoT to be such pursued targets.
Also, most of the persistence methods I have seen tend to be ...
- 15
0
votes
0
answers
55
views
Malware sinkhole evasion techniques
I have read into malware sink holing, as a way to disrupt botnets.
There are also approaches to make this more difficult, for example using a Domain Name Generator algorithm which is what the ...
- 181
0
votes
0
answers
52
views
Increment hearbeat request metasploit
I'm using metasploit to a university project and I have to try to make a botnet attack unnoticed. If the blue team detects it, I have to try to make as imposible as I can to attribute the attack.
I'm ...
- 13
5
votes
0
answers
232
views
Why am seeing all these Chinese proxy domains? [closed]
Through a casual Google search I came to this Stack Overflow result. I clicked it absent-mindedly, could not connect through the server and saw that he domain was some Chinese government proxy server. ...
- 151
0
votes
1
answer
131
views
Why do DDoS attacks spoof DNS source IPs?
Recently, a lot of my friends have been talking about botnets. They said they've created their own. Obviously, I know this is all illegal so I try not to take part in any of it.
But I've been ...
27
votes
2
answers
9k
views
How is Google abused for DDoS attacks?
While analysing a DDoS attack on my site using CloudFlare console, I've noticed that many attack requests come from AS139190 GOOGLE-AS-AP Google Asia Pacific Pte. Ltd. with Empty user agent.
I'm ...
- 383
0
votes
1
answer
134
views
Can Mirai scan reach devices behind routers?
I recently saw this article of a version of Mirai being spread to Android based devices via ADB enabled. My question relates to how Mirai does scanning.
Lets assume I have a Android based device (like ...
- 1,095
0
votes
1
answer
522
views
Can't free proxies be used to create a botnet?
I recently learned that there are plenty of services on the internet that offer/list free public proxies (freeproxylists.net, hidemyass.com, proxyscrape.com to name a few). Is this safe? Can't an ...
- 47
-1
votes
1
answer
173
views
How was the router compromised? [closed]
ISP sent a message telling that they've detected some bot network characteristic traffic from a router's IP address. Recommended countermeasures have already been taken, i. e. connected laptop's ...
- 103
2
votes
1
answer
267
views
Why do infected hosts scan port 80?
I have my serve set up with AbuseIPDB so I can keep a log of all suspicious request and hacking attempts for my honeypot machine. I noticed an IP that sent a GET request to port 80.
177.154.28.130 - - ...
- 103
1
vote
2
answers
205
views
Do some IoT devices connect to your wifi without you knowing it?
I keep hearing about refrigerators and automated vacuum cleaners being targeted, but do the owners manually configure these devices to connect to their wifi network or do the devices have a work ...
- 11
1
vote
1
answer
161
views
Why do bots visit my website even though it hasn't been shared with anyone yet?
Is this usual? These bots hit my website every 15 minutes and they're the only visitors I get since I haven't shared the website with anyone yet... How do they even know about my website?
What is the ...
- 11
0
votes
0
answers
103
views
DDoS in form of bad bots?
Recently, one of my servers came under attack by DDoSing it. After inspection of access logs, I can only find one common denominator: Referrer.
All of request come with (I assume) fake referrer:
...
- 123
1
vote
0
answers
119
views
How are accountgenerators with captchas still possible?
I was asking myself, how there are still account generators (e.g. for Steam) wide available for everyone.
With account generators I mean programs, that are automatically creating a huge amount of ...
0
votes
1
answer
125
views
Using opensource C2 dangers
I've been playing around with some of the C2's available at GitHub that I've found at https://www.thec2matrix.com/matrix
It's cool to play around with tons of Linux machines I own and send them ...
- 155
1
vote
1
answer
147
views
Why attacker do not care about masking the IP of the infected device of botnet?
I get a sentence:
If an attack is created using a botnet the likelihood of tracking the attack back to its source is low. For an added level of obfuscation, an attacker may have each distributed ...
- 935
1
vote
1
answer
120
views
What does "hijack" mean in networking security?
How should I understand the word "hijack" in network security?
In Cloudflare's page about the Mirai botnet, there is a sentence:
The Mirai botnet employed a hundred thousand hijacked IoT devices ...
- 935
1
vote
1
answer
199
views
How do botnets self-propogate exactly?
I am learning about malware and botnets and came across that botnets can "self-propogate" and I am confused as to how they can do this. I know that a botnet can be created through multiple people ...
- 113
1
vote
1
answer
171
views
Why fingerprint a browser if a fingerprint can be replayed?
I'm facing an issue with rampant scraping and abuse on a website that costs me a good chunk of money to maintain. So, I have been looking to implement a few solutions, and apparently these solutions ...
user22260
85
votes
10
answers
17k
views
How and why is my site being abused?
I own a popular website that allows people to enter a phone number and get information back about that phone number, such as the name of the phone carrier. It's a free service, but it costs us money ...
- 699
30
votes
10
answers
9k
views
Received email from ISP saying one of my devices has malware
My dad received a suspicious email from our ISP (mtnl.net.in).
The email was from noreply@mtnl.net.in and it had our user ID (I masked it as xxxxxxxx@a) in the email so it must have come from the ISP ...
- 453
0
votes
1
answer
425
views
Malicious IP addresses [closed]
I am looking for updated lists of IP addresses that belong to malware's C&C, botnets, malicious scanners, or other sort of malicious activities.
Is there any public database of malicious IP ...
- 31
-3
votes
2
answers
164
views
What's the main constituent part of botnet?
Is the botnet controlled broiler of servers or personal PCs?
We know the botnet can be controlled to DDoS attack, but what's the main constituent part of botnet?
I know the botnet's element maybe PC,...
- 935
82
votes
5
answers
14k
views
Email Account under attack (really) - anything I can do?
Over the last week, there is a constant barrage of authentication failures to my email account from a variety of ip addresses - usually in blocks of exactly 575 attempts.
My password is as strong as ...
- 831
2
votes
2
answers
666
views
Zeus v3 - can I detect its existence "manually"?
A firewall in my company was triggered by a DNS query from one of our laptops. Specifically, the exact reason was MALWARE-CNC Win.Trojan.Zeus v3 DGA DNS query detected.
Now, I could just follow this ...
- 380
1
vote
0
answers
101
views
Question on a decentralized botnet, is this technically how communications would flow? (Flowchart)
I am trying to get into and researching botnets, to help myself learn and others prevent attacks. First thing is understanding how decentralized botnet's work.
I asked a question yesterday explaining ...
- 115
0
votes
1
answer
223
views
How does the server-client scheme work in a botnet?
I am having trouble wrapping my head around the idea on how a server-client botnet structure actually works.
Let's say that the server is A, and the client is B.
We know A is listening always on ...
- 115
2
votes
2
answers
1k
views
Server getting probed: why can I see successful GET requests to other sites?
I put up my site yesterday and this morning I saw a lot of requests in the logs. I have seen this before, and immediately could tell it was someone/something probing the server. Most of the requests ...
- 785
1
vote
2
answers
207
views
Are botnet nodes made to stop working during office hours?
Some network guys at my work seem to think that a client that we monitor may be part of a botnet, but the spike in traffic that we see at night always stops at the latest around 8am in time for office ...
- 13
2
votes
1
answer
244
views
Honeypot SSH connection attempts with no interaction
I am seeing a lot (>50% of total events) of connection events on a honeypot I have set up but there is no further interaction, no brute force, just a connect then disconnect.
I'm thinking this is ...
- 21
-1
votes
2
answers
436
views
Which are the most dangerous and popular botnets that came from IoT devices?
The ease of taking control of a cheap IoT device makes them the perfect target to craft a botnet to perform DDoS attacks.
I heard about botnets created from a lot of hacked IoT devices used to ...
- 21
1
vote
0
answers
107
views
How to (easily?) protect a mobile authentication endpoint?
I'm creating an app that runs both on the web and on mobile (loads offline files through cordova inside a webview)
For my user's login forms in the web vesion, I use google captcha to protect ...
- 633
5
votes
1
answer
824
views
Unusual GET Request
I am getting unusual get requests to my server: /op69okl?name=http://www.ntdtv.com/ or /op69okl?name=http://www.epochtimes.com/ or something similar with other sites in the param. Doing some searching ...
- 85
3
votes
0
answers
256
views
Security Risks specific to IPv6-only hosts
Because I can get full IPv6 support now from my home office (Comcast did this right) I have started to bring up cloud servers with no IPv4 addresses -- only IPv6. I use a static address and create a ...
- 525
1
vote
3
answers
605
views
Risks of deploying MIRAI on my local network for testing?
Once again for research purposes I would like to "release" the MIRAI botnet on an IoT subnetwork in my home. However I am unsure of the consequences that this may have (e.g. damage my devices). What ...
- 649
2
votes
0
answers
97
views
How does Mirai (or any IoT malware) perform the initial infection? [duplicate]
From what I understand, Mirai and other related IoT malware use already infected bots to perform the scanning of various IPs for open ports to find potential new victims. How is the first bot infected ...
- 71
2
votes
2
answers
1k
views
Is it still possible to run an online dictionary attack from a single machine, without anonymisation?
This question concerns dictionary attacks conducted:
Over the Internet, using programs like THC Hydra
Via protocols such as HTTP, FTP and SMTP
I believe I'm right in thinking that: a) due to the ...
- 979
0
votes
1
answer
74
views
Are emails from the Necurs bot net DKIM and/or SPF signed?
As the questions title already asks: Are emails sent by Necurs DKIM and/or SPF signed?
Or are they unsigned and simply spoofed?
-1
votes
1
answer
189
views
Can I identify which botnet is attacking my service?
My service is seeing a fairly sophisticated attack that is distributed across multiple IP addresses. I have a list of 'rogue' IP addresses. They are distributed all around the world. Is there some way ...
- 199
0
votes
1
answer
121
views
Finding/Predicting BotNet Generated Domains Without DGA Knowledge
I will pose an academic perspective in my question, but I welcome any and every observation. So a botnet would generate 1000s of domain/day and an actual attacker will register a few, which will be ...
- 193
-1
votes
2
answers
213
views
Botnet callbacks to coin mining sites - how to act? [closed]
I found that one user is making connections to coin mining related domains. Is there any way to stop this activity, with respect to that user?
- 7
2
votes
2
answers
218
views
Is there a way to prevent comments from being abused for command and control?
Botnets typically are coordinated over protocols like HTTP or IRC. However, to make such command and control traffic harder to spot, attackers have occasionally turned to other channels, including ...
- 1,148
3
votes
1
answer
471
views
How does a botnet update?
So recently I started to study how botnets work. But recently I stumbled onto a problem. I even tried brain storming how it would do it, but I couldn't think how a bot would update its code. I also ...
- 163
2
votes
1
answer
521
views
What to do when my router is infected with a malware (becoming a part of a botnet)?
Backstory
Few years ago I bought an Aztech DSL5005 ADSL router, it was the only router available which I could verify I can telnet to and get a proper Linux environment (I wanted an OpenWRT enabled ...
- 121
4
votes
3
answers
4k
views
How does Malware use Unregistered Domains
I just finished reading that the WannaDecryptor malware was querying an unregistered domain. I thought it was connecting to its command and control server. Is this correct?
It is my understanding ...
- 143
0
votes
2
answers
1k
views
How Mirai scans or find targets [duplicate]
I read some articles about the Mirai botnet.
I can't understand how Mirai scans/finds IoT devices.
Does Mirai scan the entire public IP range with an open telnet port and try to log in?
- 11
3
votes
1
answer
142
views
Dangers of Botnet Scanning Traffic?
Are there any dangers to seeing small amounts of botnet/malware associated traffic crawling your public facing infrastructure? For instance seeing the same malware associated IP making different ...
- 31
4
votes
1
answer
165
views
One computer on our network was hacked and stole hundreds of accounts on different websites - what are correct steps to take?
Someone in our company long time ago downloaded infected Windows Server copy from torrent site and kept it as test server in our network till now. Recently, our administrator noticed huge outgoing ...
- 41
0
votes
2
answers
209
views
Where to find current, live botnet executable clients
I've been able to find readily available botnet source code online however I'm currently working on my university research project and require access to an actual botnet client which encompases DGA's (...
