427 Botnet fm qxd

www.syngress.com
Alternative Botnet C&Cs • Chapter 3
95
Frequently Asked Questions
The following Frequently Asked Questions, answered by the authors of this
book, are designed to both measure your understanding of the concepts pre-
sented in this chapter and to assist you with real-life implementation of these
concepts. To have your questions about this chapter answered by the author,
browse to 
www.syngress.com/solutions
and click on the 
“Ask the Author”
form. 
427_Botnet_03.qxd 1/8/07 11:56 AM Page 95

---

427_Botnet_03.qxd 1/8/07 11:56 AM Page 96

---

Common Botnets
Solutions in this chapter:
■
SDBot
■
RBot
■
Agobot
■
Spybot
■
Mytob
Chapter 4
97
Summary
Solutions Fast Track
Frequently Asked Questions
427_Bot_ch04.qxt 1/9/07 3:03 PM Page 97

---

Introduction
According to the 
Web@Work Survey 
conducted in early 2006 by the
Computer Crime Research Center, “Only 34 percent of IT decision makers
said they are very or extremely confident that they can prevent bots from
infecting employees’ PCs when not connected to the corporate network.
Furthermore, 19 percent of IT decision makers indicated that they have had
employees’ work-owned computers or laptops infected with a bot.”
With bots emerging as possibly the biggest threat to Internet and Web
security, numbers like these are of grave concern. Botherders or botmasters
can typically amass an army of 10,000 to 100,000 compromised machines
with which to do their malicious bidding. It is estimated that as many as 100
million machines on the Internet are compromised, and botnets of up to
350,000 or more have been detected.
Some of the more common bots just continue to evolve. In fact, rather
than new bots being developed from scratch, it seems that malicious devel-
opers almost exclusively adapt or modify an existing bot program into a new
variant. Some bots, such as SDBot, have hundreds of variants and make the
standard antivirus-naming convention of using the alphabet (variant A, variant
B, etc.) cumbersome at best.