6th European Conference - Academic Conferences

2.2 Attack vector
Ivan Burke and Renier van Heerden
Botnets are usually goal orientated. For the most part their goal is either profit or service disruption.
There are several means of achieving these goals using botnets. In this Section, we discuss some
attacks commonly used by Botnets.
2.2.1 Distributed denial of service attack
Due to Botnet size and the distributed nature of Botnets, Distributed Denial of Service attacks (DDoS)
are a popular form of attack (Felix et al., 2005). In this attack the Botherders issue a command to all
its subordinate Bots to connect to a targeted system at the same time. The targeted system can
usually not handle the sudden influx of requests and which cause system services to be temporarily
disrupted. Botherder rent out these services to competitors to disrupt competitor services (Kiefer,
2004).
2.2.2 Spam relay
The first generation of Botnets where reliant on email to spread and infect various hosts. Botnets
would open a SOCKS v4/v5 proxy on compromised machines, allowing it to send spam at the request
of the Botherder. Botnets also harvested email addresses from infected hosts to add to its spam lists.
(Engate, 2009)
2.2.3 Data harvesting
Botnets report back valuable system information to Botherders. This information can include key
stroke logs, system vulnerabilities, service availability on host machine, open port data and network
traffic. Botherders collect and collate this data to retrieve data such as user names and passwords
which could be used for mass identity theft. Botnets scan for system weakness that could possibly be
exploited at a later stage if Botnet functionality is compromised in future. By sniffing network traffic
Botnets could become aware of rival Botnets infecting host PCs and disrupt these rival Botnet
functionality.
2.2.4 Ad serve abuse
Botnets can be utilized for monetary gain. Botnets can be used to exploit the Pay Per Click or
Impression Based internet advertising models. By forcing infected machines onto ad serve sites or
using iFrames to fool users into clicking on advertisements, Botherdes can generate revenue from
marketing companies.
Botherders infect host PC with browser add-ons, Browser Helper Objects (BHO), or browser
extensions which changes user browser interaction to relay them to ad serve sites or simply generate
brows requests to ad serve sites automatically. These Add-ons can serve a dual purpose, as it can
collect user data from browser and relay it to Botherder.
2.3 Viral capability
One of the great strengths of a Botnet is its sheer size. This also makes Botnets so tough to take
down. Hence it is essential for a Botnet to spread fast and to vastly distributed systems.
The first generation of Botnets where primarily reliant on email and malicious page redirects to
spread. Modern Botnets such as Asprox, Koobface, Zhelatin and Kreios C2 spread via social media
(Denis, 2008) (Eston, 2010). The Botnet posts users content on social networks sites which infect any
user that follows the malicious links. Some Botnets have been known to hide within popular trusted
applications. Trojans drop malicious code in trusted address spaces and exploits weaknesses in
hosts PC to compromise it and make it part of Botnet network.
2.4 Stealth component
Botnets are only useful as long as they are not detected. Hence stealth is a fundamental requirement
for all Botnets.
It is the opinion of the researchers that stealth is required in each of the components previously
identified in this section. If communications are noisy, infected host might become aware of malicious
34