An overview over Botnets Contents: Short survey of Malware What is a Botnet and hoe does it work? Properties of a Botnet Applications of a Botnet Protection against Malware

1. Short survey of Malware Malware = artificial word out of malicious software = software which was developed to carry out unwanted or dangerous functions. Generic term for computer viruses, worms, trojan horses etc. Malware by categories With Malware infected computers Source: Wikipedia Source: http://www.was-ist-malware.de

2. What is a Botnet and how does it work? Source: http://www.was-ist-malware.de/allgemein/botnet/ Botnet = artificial word out of robot net = combination of many computers to one big Malware. backdoor software A trojan horse is a program which consists of a useful part and malicious part. The useful part disguises the malicious part. The latter installs the Malware on the infected computer. Each participating computer is infected e. g. by a trojan horse which installs a so called backdoor software, which is not recognised by the user and not noticed by the security means of the computer. The infection can be caused by using a “prepared website, email attachment etc.”. bot Botmaster The backdoor software allows a third party (so called Botmaster) unlimited access to all infected computers (so called bots)! This implies arbitrary misuse of the bots.

2. What is a Botnet and how does it work? Source: http://www.was-ist-malware.de/allgemein/botnet/ 3 The Botmaster sells the processing power of the Botnet to a (criminal) client. The Botmaster commands the bots e. g. to send spam mails from the clients.

4. Applications of a Botnet 3. Properties of a Botnet Source: http://www.was-ist-malware.de/allgemein/botnet/ One important property of a Botnet is the distribution of the resources. The installed backdoor malware must operate inconspicuously. Therefore this Malware runs with low priority so that the user will not notice it. Additionally maximal 15 % of the computer storage is allocated by the Malware. Furthermore the Malware reports to the Botmaster properties of its host computer so that the Botmaster can decide if the host computer can be used for the planned Botnet operations. 4. Applications of a Botnet Positive applications: Berkeley University: Use of a Botnet in research projects in order to decrease IT-costs. Search for intelligent life in space. Negative applications: Distribution of spam mails of commercial (criminal) users. This also includes pishing mails. The return address is disguised. Nearly 80% of the world wide spam mails origin from Botnets

4. Applications of a Botnet 5. Protection against malware Negative applications: Allocation of storage for criminal activities. Theft of sensitive data of the bots. DDoS (distributed denial of services) attacks of e. g. enterprise servers. Often these servers break down. Then the Botnet master may contact the enterprise for blackmailing reasons. 5. Protection against malware Always (automatically) actualize the operation system. Don´t open suspicious or unknown email attachments. Use an anti virus program. Always (automatically) actualize this program. Use a firewall which monitors the network traffic. A firewall protects a computer against unwanted network accesses.