427 Botnet fm qxd

Why Do We Have This Problem?
Let’s back up a moment and talk about why we have this problem in the first
place. One basic reason is that botnets are a means of making money. Another
aspect to consider is the software engineering background where hard problems
in software engineering contribute to the problem. However, if engineering is
the problem, then possibly engineering is also the solution. We also find that we
make mistakes not due to technical wonders inherent in “exploits,” but because
our processes and practices are flawed. Simple attention to IT process can work
www.syngress.com
420
Chapter 12 • Responding to Botnets
427_Botnet_12.qxd 1/9/07 3:08 PM Page 420

---

wonders in the enterprise and possibly in the home if we can ever figure out
how to do tackle that particular arena.
Why are botnets spreading everywhere? Are there environmental condi-
tions or factors that make it easier or harder for botnets to exist and prolif-
erate? If they exist, then companies, universities, and organizations can affect
the desirability of their site for botnet colonization. In industry, are there
behaviors and practices that encourage the creation and use of botnets? Could
these behaviors and practices be changed? This section attempts to describe
environmental aspects that are useful to botnets. While we won’t be able to
cover all possible environmental aspects, we’ll address as many as time permits.
Fueling the Demand: 
Money, Spam, and Phishing
As in most things, the primary motivation for the creation and use of botnets
is money.The headlines tell us that organized crime has gotten into the spon-
sorship of botnets in a big way. Recently, the news media reported a Russian
Mafia group operating a 73,000-bot network for sending spam.Their prod-
ucts included pornography, pump and dump stocks, and Viagra. As long as
there are lucrative opportunities like these, there will be botnets. We know
that only a small percentage of recipients need to respond to make the opera-
tion profitable.The rationale for using mass mailing to individuals who do not
ask for or consent to the e-mails, is either that the population of potential
customers is difficult to discern, or the fear that most potential customers
would say no if asked if they would like advertisements of this nature. For
botnets to be useful in this kind of venture, the botherder must gather a large
number of computers for the generation of spam. Some of these computers
need to have high-speed connections and significant processing power to
serve as spam relays. Alternately, the botherder can locate and use other (not