Two to three years ago, we saw the change in the control of many botnets from IR
ID: 3858242 • Letter: T
Question
Two to three years ago, we saw the change in the control of many botnets from IRC channels to websites, via HTTP. This shift to a common protocol was the clever move by cyber criminals and malware writers. According to the analysis done by security firms, botnets are the most insidious cyber threats that resulted in huge financial losses in the year 2012. These botnets have moved from public IRC to privately hosted servers. Now the boot master can control the victims with HTTP rather than IRC. What does this shift in control mean for us as individual users or enterprises? Is it good or bad? If its bad, how do we make it better?
Explanation / Answer
A botnet is a number of Internet-connected devices, each of which is running one or more bots.
Botnets can be used to steal data,send spam, and allow the attacker access to the device and its connection.
So introducing the website HTTP type they shift to a common protocol. So it is the clever move by cyber criminals
and malware writers.
According to the analysis done by security firms, botnets are the most insidious cyber threats that resulted in
huge financial losses in the year 2012.
These botnets have moved from public IRC to privately hosted servers. Now the boot master can control the victims with HTTP rather than IRC.
This shift in control mean for us as individual users or enterprises Because of the wide range of HTTP services used, unlike the IRC and P2P, it is not easy to block this service.
Moreover, this service is commonly used by normal applications and services in the Internet.
So some applications and services such as mail sessions, auto updaters, HTTP based download managers, self-refresh pages and some browsers toolbars can generate the same periodic pattern and increase false positive rates in the detection results.
Thus, detection of the HTTP botnets with low rate of false alarms has become a notable challenge.
The detection of HTTP Botnets gets even worse where the Botmasters use the legitimate websites or normal services to establish their command and controls.
The review of the characteristics of different types of botnets shows that HTTP-based botnets have a set of attributes that make it difficult for them to be detected.
No one ever thought the HTTP protocol used by one of the most dangerous Cyber threats called Botnet.
A bot is an application that can perform and repeat a particular task faster than a human.
When a large number of bots infect different targets and connect to each other, they form a network of bots or BotNet.
Related Questions
Navigate
Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.