427 Botnet fm qxd

www.syngress.com
Common Botnets • Chapter 4
127
427_Bot_ch04.qxt 1/9/07 3:03 PM Page 127

---

Summary
Bots are a serious threat to Internet and computer network security. Viruses
and worms have certainly wreaked havoc on the Internet, and phishing
attacks and spyware are both growing threats to computer security as well, but
bots are unique among malware in their ability to provide tens or hundreds of
thousands of compromised systems lying dormant and waiting to be used as
an army for all kinds of malicious activities.
In this chapter we learned about some of the major bot families—specifi-
cally, SDBot, RBot, Agobot, Spybot, and Mytob.These bots have been around
for as many as five years, and new variants based on the core of the original
bot code are still created. Some of these bot families have hundreds and hun-
dreds of variants.
We discussed how almost all the bot families share one propagation
method. Seeking out unprotected or poorly secured network shares to attack
is a common means shared by virtually every bot family. We also covered ways
different bot families have introduced different unique aspects that set them
apart. For example, RBot introduced the use of compression algorithms to
encrypt the bot code. Agobot pioneered the use of P2P networks as a propa-
gation method. Spybot added spyware functionality such as keystroke logging,
and the Mytob worm combined a bot (SDBot) with a mass-mailing worm,
marking a shift in malware code to hybrid attacks that combine different
types of malware.
The bots discussed in this chapter are by no means all the bot threats out
there. Malware has shifted from “carpet-bombing style” viruses and worms,
intended to spread the fastest and gain infamy for the malware author, to pre-
cision stealth attacks aimed at financial gain. Some worms, such as those in
the Mytob family, still gain attention by spreading quickly. But the true goal is
to create as many compromised bot systems as possible that will lie dormant
and wait for orders from a botherder to initiate some sort of malicious
activity.