427 Botnet fm qxd

www.syngress.com
72
Chapter 2 • Botnets Overview
427_Botnet_02.qxd 1/9/07 9:49 AM Page 72

---

The demand for free or cheap movies, software, games, and other
intellectual property and law enforcement’s confiscation of computer
equipment engaged in the commission of major thefts of these
commodities has created another opportunity for the botherders.
Botnets are being used to store an amazing amount of stolen
property on their botclients. With hard drive capacities growing, the
botherders are finding that they can snag 20G or 30G of hard drive
space from most of their clients without the user noticing.This type
of venture yields either cash, services, or other stolen intellectual
property.
Botherders recognized that some of their client’s owners might pay if
certain data were held for ransom. A group of ransomware Trojans
have been used to encrypt all of the user’s files.The botherder then
has the victim pay by e-Gold, Western Union, or the old fashion way
by making purchases from designated online stores. Ransoms ranged
from the budget-minded $10.99 to $300 for the Zippo ransomware
Trojan.
Q: 
How do I know if my computer is part of a botnet?
A: 
If you are part of a company or organization, you will likely learn that
your computer is part of a botnet from either network administrators,
system administrators, or your information security organization. It is diffi-
cult for an individual to know for sure. Here are some signs to look for.
Not all signs will be present in all cases and the presence of these signs
could also be explained by other phenomena.
www.syngress.com
Botnets Overview • Chapter 2
73
Frequently Asked Questions
The following Frequently Asked Questions, answered by the authors of this
book, are designed to both measure your understanding of the concepts pre-
sented in this chapter and to assist you with real-life implementation of these
concepts. To have your questions about this chapter answered by the author,
browse to