Malicious bots threaten network security

Dan Geer

Computer · 2005 · 99 citations · 0 references

Concepts

TL;DR

Malicious bots are software agents that automatically operate on infected computers, posing a threat comparable to viruses, worms, and trojans. Hackers deploy bots to vulnerable machines, where they await remote commands and can be aggregated into botnets to launch distributed‑denial‑of‑service attacks. Botnets facilitate mass spam, key‑logging, credential theft, and serve as platforms for future virus infections.

Abstract

Viruses, worms, Trojan horses, and network intrusions are among the threats that security administrators worry about on a regular basis. However, there is a less familiar threat that many experts say could be just as dangerous: malicious bot software. A bot is a program that operates automatically as an agent for a user or another program. Hackers forward bots to victims by a number of means, and the software automatically infects vulnerable computers. The bots then wait for commands from a hacker, who can manipulate them and the infected systems without the user's knowledge. A hacker can install bots on multiple computers to set up botnets that they can use for massive distributed-denial-of-service (DDoS) attacks that overwhelm victimized systems' defenses. Botnets can also be used for mass spam mailings, installing key-logging software that can steal victims' passwords and data, and compromising computers to prepare them for infection by future viruses.