What are botnets?

Video:
http://news.bbc.co.uk/1/hi/programmes/click_online/default.stm

Some of you might not be able to see it if your not in the UK/US, so find a US based proxy.

Botnets is a group of zombie computers all infected with a certain type of malicious software, but unlike other malware, this type of malicious just sits and goes un-noticed until a command is given to the bot. Botnets can be used for spamming inboxes and DDOS'ing websites.

A simple website can be taken down within minutes since botnets like Storm are massive, more than 200,000 computers all sending around 1000 requests to the server a second.

Other botnets like Srizbi and Rustock are both spambots that just sit there until a command is given.

The video shown is quite interesting to watch, a representative from Prevx shows how this all works with great detail.

I'm from Singapore and can see the video... Interesting!

I wonder, what does big companies do if there is DDOS attack in their site?

Reboot the server.

A DDOS attack floods only one IP adress, so rebooting the server means the IP would change and the DDOS no longer works until whoever has the new IP.

Interesting...

Belahzur wrote:

Reboot the server.

A DDOS attack floods only one IP adress, so rebooting the server means the IP would change and the DDOS no longer works until whoever has the new IP.

Is it easy to find their new IP?

Yep.
Worms like Conficker/downadup can get it, backdoor, keyloggers. Port scanning also has the same effect pretty much.

Belahzur wrote:

Reboot the server.

A DDOS attack floods only one IP adress, so rebooting the server means the IP would change and the DDOS no longer works until whoever has the new IP.

Not necessarily......If the attack is conducted on a sufficiently large scale, entire geographical regions of Internet connectivity can be compromised without the attacker's knowledge or intent (ie. Whole IP ranges can be comprimised so simply rebooting and allowing DHCP to allocate new IP's is futile).

Botnets can also launch DOS attacks between the WAN and LAN therefore comprimising complete networks by targeting a single IP (machine).

Those affected are usually lazy with network security as they almost always have incorrectly configured, or flimsy network infrastructure equipment and have never heard of a firewall.

Just my opinion!

:victory: