Additional information (bo)
Bot / Botnet / Zombie
A bot is a computer program that can autonomously perform tasks (normally performed by humans). For example: a bot can play a computer game, consult a web page, chat, or post a message on a site. Unlike humans, bots can perform their tasks continuously and fast, without making mistakes. Bots aren't necessarily malicious, they just perform tasks automatically. Mostly a bot is designed to scrape information off of websites (data-collection). An example of a benign bot is a search-engine spider analysing websites, or a chatbot. But bots can certainly be malicious too:
There are three types of malicious bots:
- File-sharing bots: these bots take the user's search-keyword and respond that they have the file available for download, providing a link which leads to a malicious destination.
- Spam bots: these bots flood your inbox with spam and interrupt your chats by sending you unsolicited instant messages. These types of bots are usually easy to spot because they mostly send you a link to click on.
- Zombie bots: this refers to a computer that has been compromised as part of a botnet. These bots are more difficult to detect and are more stealthy.
A botnet is a group of infected computers (or other devices). A (malicious) bot can read and write files, execute programs, intercept keystrokes, access the camera, send emails, install malware, etc. They are usually installed by a virus or worm after visiting a compromised website or opening a malicious attachment in a message or e-mail. Botnets can be categorized into two types: centralized (Client-Server model) and decentralized (Peer-to-Peer (P2P) model).
A cybercriminal (the bot herder or botmaster,) can give instructions to the bots from a distant machine (a command and control (C&C) channel). A botnet attack can be made up of hundreds or even more than a million infected devices that are all executing malicious code on behalf of the bot herder. A large enough botnet can flood networks with enough traffic to put them offline (DDoS-attack).