Questions tagged [botnet]

A botnet is a collection of computers that are under the control of a person or group, usually facilitated by malware. These computers are often used to take part in DDoS attacks and spamming.

Filter by
Sorted by
Tagged with
2
votes
3answers
622 views

Chrome OS Security

I am new to how botnets work and I was wondering if Chrome OS could be infected to become part of a botnet? I own a chromebook and would love to know if this is possible for testing purposes. Is the ...
2
votes
2answers
693 views

Server getting probed: why can I see successful GET requests to other sites?

I put up my site yesterday and this morning I saw a lot of requests in the logs. I have seen this before, and immediately could tell it was someone/something probing the server. Most of the requests ...
0
votes
1answer
54 views

Can't free proxies be used to create a botnet?

I recently learned that there are plenty of services on the internet that offer/list free public proxies (freeproxylists.net, hidemyass.com, proxyscrape.com to name a few). Is this safe? Can't an ...
15
votes
6answers
15k views

Why do botnets use IRC but not a web service for communication?

IRC seems still the most prominent way for communication within botnets. Why do attackers choose IRC? In my (very naive) opinion, to set up a web service is far more easier.
0
votes
3answers
1k views

What are other channels Botnets can use for command and control except IRC

What command and control channels might a botnet use? Which would be most effective? I found good info on IRC, what are other possibilities? (Exam preparation - no harm intended :-) )
4
votes
2answers
762 views

DGA (Domain Generation Algorithm) - malwares

Some malwares use DGA (Domain Generation Algorithm) to randomly generate domains in order for the zombies to be able to communicate in a resilient manner with the C&C. As far as I know, there is ...
-1
votes
1answer
69 views

How was the router compromised? [closed]

ISP sent a message telling that they've detected some bot network characteristic traffic from a router's IP address. Recommended countermeasures have already been taken, i. e. connected laptop's ...
2
votes
1answer
178 views

Why do infected hosts scan port 80?

I have my serve set up with AbuseIPDB so I can keep a log of all suspicious request and hacking attempts for my honeypot machine. I noticed an IP that sent a GET request to port 80. 177.154.28.130 - - ...
1
vote
2answers
125 views

Do some IoT devices connect to your wifi without you knowing it?

I keep hearing about refrigerators and automated vacuum cleaners being targeted, but do the owners manually configure these devices to connect to their wifi network or do the devices have a work ...
1
vote
1answer
107 views

Why do bots visit my website even though it hasn't been shared with anyone yet?

Is this usual? These bots hit my website every 15 minutes and they're the only visitors I get since I haven't shared the website with anyone yet... How do they even know about my website? What is the ...
0
votes
0answers
47 views

DDoS in form of bad bots?

Recently, one of my servers came under attack by DDoSing it. After inspection of access logs, I can only find one common denominator: Referrer. All of request come with (I assume) fake referrer: ...
9
votes
4answers
9k views

Block all BotNets and TOR addresses from accessing our site

I've heard that many DOS attacks and general "black hat hacking" attempts occur over the TOR network. Is it possible for me to dynamically block source IP's by their presence in a BotNet or similar ...
1
vote
0answers
72 views

How are accountgenerators with captchas still possible?

I was asking myself, how there are still account generators (e.g. for Steam) wide available for everyone. With account generators I mean programs, that are automatically creating a huge amount of ...
4
votes
1answer
120 views

One computer on our network was hacked and stole hundreds of accounts on different websites - what are correct steps to take?

Someone in our company long time ago downloaded infected Windows Server copy from torrent site and kept it as test server in our network till now. Recently, our administrator noticed huge outgoing ...
0
votes
1answer
68 views

Using opensource C2 dangers

I've been playing around with some of the C2's available at GitHub that I've found at https://www.thec2matrix.com/matrix It's cool to play around with tons of Linux machines I own and send them ...
23
votes
5answers
38k views

How is IRC so secure/untraceable that hackers and pirates use it to communicate?

What is so special about IRC that hackers use it to do online meetings, ignoring every other option, like messengers or social media? It seems to be very secure that it gets used to send commands to ...
1
vote
1answer
91 views

Why attacker do not care about masking the IP of the infected device of botnet?

I get a sentence: If an attack is created using a botnet the likelihood of tracking the attack back to its source is low. For an added level of obfuscation, an attacker may have each distributed ...
1
vote
1answer
76 views

What does “hijack” mean in networking security?

How should I understand the word "hijack" in network security? In Cloudflare's page about the Mirai botnet, there is a sentence: The Mirai botnet employed a hundred thousand hijacked IoT devices ...
1
vote
1answer
122 views

How do botnets self-propogate exactly?

I am learning about malware and botnets and came across that botnets can "self-propogate" and I am confused as to how they can do this. I know that a botnet can be created through multiple people ...
1
vote
1answer
111 views

Why fingerprint a browser if a fingerprint can be replayed?

I'm facing an issue with rampant scraping and abuse on a website that costs me a good chunk of money to maintain. So, I have been looking to implement a few solutions, and apparently these solutions ...
85
votes
10answers
16k views

How and why is my site being abused?

I own a popular website that allows people to enter a phone number and get information back about that phone number, such as the name of the phone carrier. It's a free service, but it costs us money ...
30
votes
10answers
9k views

Received email from ISP saying one of my devices has malware

My dad received a suspicious email from our ISP (mtnl.net.in). The email was from noreply@mtnl.net.in and it had our user ID (I masked it as xxxxxxxx@a) in the email so it must have come from the ISP ...
8
votes
4answers
1k views

Is it possible to be a hacker without being a criminal?

I am interested in information security, and I want to be a "hacker." I want to write hacking tools, make viruses, and other stuff... For me, programming botnets are a lot of fun, but how can ...
12
votes
1answer
2k views

Can/do botnets brute force “high value” users of services like Gmail?

On an intranet a login is generally disabled after a very small number of failed logins. But a public email service like Gmail can't do the same, otherwise pranksters would just be continuously ...
0
votes
1answer
309 views

Malicious IP addresses [closed]

I am looking for updated lists of IP addresses that belong to malware's C&C, botnets, malicious scanners, or other sort of malicious activities. Is there any public database of malicious IP ...
-3
votes
2answers
113 views

What's the main constituent part of botnet?

Is the botnet controlled broiler of servers or personal PCs? We know the botnet can be controlled to DDoS attack, but what's the main constituent part of botnet? I know the botnet's element maybe PC,...
5
votes
2answers
3k views

How does Mirai's C&C communicate with its bots?

I'm wondering how Mirai based botnets work. Specifically, I want to understand the communication mechanisms between the C&C servers and its bots. After reading this question I've understood that a ...
81
votes
5answers
14k views

Email Account under attack (really) - anything I can do?

Over the last week, there is a constant barrage of authentication failures to my email account from a variety of ip addresses - usually in blocks of exactly 575 attempts. My password is as strong as ...
1
vote
2answers
492 views

Zeus v3 - can I detect its existence “manually”?

A firewall in my company was triggered by a DNS query from one of our laptops. Specifically, the exact reason was MALWARE-CNC Win.Trojan.Zeus v3 DGA DNS query detected. Now, I could just follow this ...
1
vote
0answers
53 views

Question on a decentralized botnet, is this technically how communications would flow? (Flowchart)

I am trying to get into and researching botnets, to help myself learn and others prevent attacks. First thing is understanding how decentralized botnet's work. I asked a question yesterday explaining ...
0
votes
1answer
172 views

How does the server-client scheme work in a botnet?

I am having trouble wrapping my head around the idea on how a server-client botnet structure actually works. Let's say that the server is A, and the client is B. We know A is listening always on ...
1
vote
2answers
165 views

Are botnet nodes made to stop working during office hours?

Some network guys at my work seem to think that a client that we monitor may be part of a botnet, but the spike in traffic that we see at night always stops at the latest around 8am in time for office ...
2
votes
1answer
182 views

Honeypot SSH connection attempts with no interaction

I am seeing a lot (>50% of total events) of connection events on a honeypot I have set up but there is no further interaction, no brute force, just a connect then disconnect. I'm thinking this is ...
4
votes
4answers
2k views

How do botnets communicate without being caught?

This is something i have pondered about for a while now, but never really thought to ask. How is it that botnets can communicate with a controller of some sort to co-ordinate DDoS attacks and other ...
10
votes
3answers
2k views

How To Stop A Mobile Verification Attack

I am thinking of using mobile phone number verification for the sign up step in my web application but how do I prevent a hacker or a malicious user from sending mobile verification requests to an ...
-1
votes
2answers
391 views

Which are the most dangerous and popular botnets that came from IoT devices?

The ease of taking control of a cheap IoT device makes them the perfect target to craft a botnet to perform DDoS attacks. I heard about botnets created from a lot of hacked IoT devices used to ...
8
votes
2answers
3k views

How to attract traffic to a honeypot

I have set up a honeypot, but I am not happy with the low traffic load and I would like to trigger much higher traffic levels. What methods would attract high bot activity? These are the ideas I ...
3
votes
1answer
262 views

running botnet for analysis

I a very curious to understand botnets practically. I want to run a p2p botnet (storm or waledac) for analysis and learning. I have mainly two issues: Where can i get access to binaries of either of ...
2
votes
2answers
1k views

Is it still possible to run an online dictionary attack from a single machine, without anonymisation?

This question concerns dictionary attacks conducted: Over the Internet, using programs like THC Hydra Via protocols such as HTTP, FTP and SMTP I believe I'm right in thinking that: a) due to the ...
1
vote
0answers
43 views

How to (easily?) protect a mobile authentication endpoint?

I'm creating an app that runs both on the web and on mobile (loads offline files through cordova inside a webview) For my user's login forms in the web vesion, I use google captcha to protect ...
3
votes
1answer
544 views

How to successfully report DoS attack coming from a big ISP?

A few weeks ago I reported a small botnet which is coming from the network of a big Internet provider. They asked me for more details which I provided. But the attack is going for weeks already and ...
5
votes
1answer
693 views

Unusual GET Request

I am getting unusual get requests to my server: /op69okl?name=http://www.ntdtv.com/ or /op69okl?name=http://www.epochtimes.com/ or something similar with other sites in the param. Doing some searching ...
3
votes
0answers
207 views

Security Risks specific to IPv6-only hosts

Because I can get full IPv6 support now from my home office (Comcast did this right) I have started to bring up cloud servers with no IPv4 addresses -- only IPv6. I use a static address and create a ...
1
vote
3answers
518 views

Risks of deploying MIRAI on my local network for testing?

Once again for research purposes I would like to "release" the MIRAI botnet on an IoT subnetwork in my home. However I am unsure of the consequences that this may have (e.g. damage my devices). What ...
2
votes
0answers
97 views

How does Mirai (or any IoT malware) perform the initial infection? [duplicate]

From what I understand, Mirai and other related IoT malware use already infected bots to perform the scanning of various IPs for open ports to find potential new victims. How is the first bot infected ...
5
votes
1answer
2k views

I ran netstat and one thing that came up was MSN bingbot, does that mean my computer is being used as part of a Microsoft botnet?

I ran netstat on my computer, and one thing that came up was msnbot-65-52-108-216. I did some research and what came up was that it's from an IP originating in Redmond, Washington and that it's likely ...
48
votes
5answers
5k views

I managed to capture a botnet control host, what do I do with it?

A few days ago one of my webhosting customers had their FTP login compromised, and the attacker modified his index.php file to include some extra code, and roughly twelve thousand other bots have been ...
0
votes
1answer
36 views

Are emails from the Necurs bot net DKIM and/or SPF signed?

As the questions title already asks: Are emails sent by Necurs DKIM and/or SPF signed? Or are they unsigned and simply spoofed?
-1
votes
1answer
139 views

Can I identify which botnet is attacking my service?

My service is seeing a fairly sophisticated attack that is distributed across multiple IP addresses. I have a list of 'rogue' IP addresses. They are distributed all around the world. Is there some way ...
0
votes
1answer
75 views

Finding/Predicting BotNet Generated Domains Without DGA Knowledge

I will pose an academic perspective in my question, but I welcome any and every observation. So a botnet would generate 1000s of domain/day and an actual attacker will register a few, which will be ...