BOT & BOTNET
BOT & BOTNET
bot, is a software application that runs automated tasks
(scripts) over the Internet. Typically, bots perform tasks
that are both simple and structurally repetitive, at a
much higher rate than would be possible for a human
alone.
BOT & BOTNET
• A botnet is a number of Internet-connected devices used by a
botnet owner to perform various tasks.
• Botnets can be used to perform Distributed Denial Of Service
Attack, steal data, send spam, allow the attacker access to the
device and its connection. The owner can control the botnet
using command and control (C&C) software.
• The word botnet is a combination of the words robot and
network. The term is usually used with a negative or malicious
connotation.
The IRC protocol
• The IRC protocol takes the idea of a chat server/client to a
much
• higher level. IRC stands for Internet Relay Chat.
• What’s incredibly beautiful about the IRC protocol is that the
individual chat clients could be plugged into different
machines in different parts of the world, yet all of these
different machines (if they are part of the same IRC network)
would appear as a single logical chat server to all the clients.
Dos vs DDoS Attacks
All DDoS = DoS but not all DoS = DDoS.
Dos vs DDoS Attacks
• Denial of Service (DoS) and Distributed Denial of Service (DDoS)
attacks are two of the most intimidating threats that modern
enterprises face.
• Few forms of attack can have the financial ramifications as that
of a successful DoS attack.
• Security surveys indicate that the cost of a DDoS attack averages
between $20,000-$40,000 per hour.
• This is an astronomical figure and can put even the largest
organizations under pressure.
Dos Attacks
• Buffer overflow attacks – This type of attack is the most
common DOS attack experienced. Under this attack, the
attacker overloads a network address with traffic so that it is
put out of use.
• Ping of Death or ICMP flood – An ICMP flood attack is used to
take non configured or misconfigured network devices and
uses them to send spoof packets to ping every computer
within the target network. This is also known as a ping of
death (POD) attack.
Dos Attacks
• SYN flood – SYN flood attacks send requests to connect to a server but
don’t complete the handshake. The end result is that the network
becomes inundated with connection requests that prevent anyone
from connecting to the network.
• Teardrop Attack – During a teardrop DoS attack, an attacker sends IP
data packet fragments to a network. The network then attempts to
recompile these fragments into their original packets. The process of
compiling these fragments exhausts the system and it ends up
crashing. It crashes because the fields are designed to confuse the
system so that it can not put them back together.
DDos Attacks
• Ping of Death – During a Ping of Death (POD) attack the attacker sends multiple pings to
one computer. POD attacks use manipulated packets to send packets to the network
which have IP packets that are larger than the maximum packet length. These
illegitimate packets are sent as fragments. Once the victim’s network attempts to
reassemble these packets network resources are used up, they are unavailable to
legitimate packets. This grinds the target network to a halt and takes it out of action
completely.
• UDP Floods – A UDP flood is a DDoS attack that floods the victim network with User
Datagram Protocol (UDP) packets. The attack works by flooding ports on a remote host
so that the host keeps looking for an application listening at the port. When the host
discovers that there is no application it replies with a packet that says the destination
wasn’t reachable. This consumes network resources and means that other devices can’t
connect properly.
DDos Attacks
• SYN Flood – SYN Flood attacks are another type of DoS attack where the attacker uses the TCP connection
sequence to make the victim’s network unavailable. The attacker sends SYN requests to the victim’s network
which then responds with a SYN-ACK response. The sender is then supposed to respond with an ACK response
but instead, the attacker doesn’t respond (or uses a spoofed source IP address to send SYN requests instead).
Every request that goes unanswered takes up network resources until no devices can make a connection.
• Slowloris – Slowloris is a type of DDoS attack software that was originally developed by Robert Hansen or
RSnake to take down web servers. A Slowloris attack occurs when the attacker sends partial HTTP requests
with no intention of completing them. To keep the attack going, Slowloris periodically sends HTTP headers for
each request to keep the computer network’s resources tied up. This continues until the server can’t make
any more connections. This form of attack is used by attackers because it doesn’t require any bandwidth.
• HTTP Flood – In a HTTP Flood attack the attacker users HTTP GET or POST requests to launch an assault on an
individual web server or application. HTTP floods are a Layer 7 attack and don’t use malformed or spoofed
packets. Attackers use this type of attack because they require less bandwidth than other attacks to take the
victim’s network out of operation.
DDos Attacks
• Ping Flood – Much like a UDP flood attack, a ping flood attack uses ICMP Echo
Request or ping packets to derail a network’s service. The attacker sends these
packets rapidly without waiting for a reply in an attempt to make the target
network unreachable through brute force. These attacks are particularly
concerning because bandwidth is consumed both ways with attacked servers
trying to reply with their own ICMP Echo Reply packets. The end result is a
decline in speed across the entire network.
• Zero-Day Attacks – Zero-Day attacks are attacks that exploit vulnerabilities that
have yet to be discovered. This is a blanket term for attacks that could be faced
in the future. These types of attacks can be particularly devastating because the
victim has no specific way to prepare for them before experiencing a live attack.