A Peek At The Future Of Botnet Evolution
- Mar 29, 2013 8:00 AM EST
- [num] Comments
Botnets weren't always malicious. According to a report by Symantec called The Evolution of IRC Bots, botnets were originally designed to automate basic tasks on IRC and allowed IRC operators to link instances of the bot together and manage its power. Eventually, botnets were used to perform DoS attacks and other malicious activities as computer users realized the potential collective power botnets had.
According to Richard Henderson, a security strategist and threat researcher for Fortinet's Fortiguard Labs, botnet authors are "leveraging real-world business models in order to expand their presence online." Writing code for botnets has become their full-time job.Authors watch closely when vendors patch a vulnerability. As soon as the patch details are released, they update their code to infect computers that haven't been updated yet. Botnet authors will also hire groups of affiliates in order to spread malware and generate revenue using different methods.
Mobile Botnets on the Rise
Although not as prevalent as their computer counterparts, mobile botnets have been on the rise, with the rate of infections of mobile devices growing exponentially. Mobile malware has passed the point of simple hidden SMS fraud. According to Henderson, researchers are finding mobile malicious apps that are extensions of popular computer botnet software. For example, a mobile version of the Zeus bot intercepts mobile banking logins and sends the credentials back to its owners. This provides the owners with another means of stealing funds from victims.
The basic methods of writing malware for a mobile device aren't much different from writing malware for a PC. "All it takes is a skilled and determined coder," says Henderson.
The number of apps available for the Android OS makes it an easy target for botnets authors seeking to hide their code within pirated games, racy apps, and other fads. On the other hand, Apple's method of thoroughly inspecting and verifying all submitted apps has essentially kept their iOS malware-free. Luckily, Henderson says that "tracking and detecting mobile botnets is effectively the same as any other connected botnets."
Enjoy Social Networking? So Do Botnets
Now that botnets have upgraded to the affiliate model of spreading malware, social networks have become another means of infection and it can happen to anyone. Once a botnet controls your computer, it's a simple matter for the owner to post a malicious link on your social networking account.
Just clicking that link can be enough to infect your social network friends. "Many times these malware delivery sites are able to infect a victim without any intervention of the victim at all. Visit the site and the site has crafted special code that exploits an unpatched vulnerability," says Henderson.
In the world of social networking, the victims targeted are usually people of interest. For example Matt Honan, senior writer for Wired, was targeted last year. Honan's iCloud account, along with many other accounts, were hacked by a group of attackers who ultimately destroyed his digital life. Around the same time, Reuters blogging platform was hacked twice and both times were used to post false stories. It's all about numbers for botnet owners and they want to quickly infect as many people as possible.
Henderson says that he expects to see more "malware and botnets hidden inside seeming legitimate applications" and "the most elite of the elite holding their zero-day exploits close to their chests," providing the malware only to people willing to pay large sums of money for them.
In order to protect a mobile device, Henderson recommends that a user try out mobile antivirus, especially those who own Android devices. He also advises that users be cautious when installing third party apps, including iOS users who made the decision to jailbreak their phone. For non-mobile devices, Henderson suggests that users keep their software up-to-date at all times and uninstall unnecessary applications, such as Java and Flash. Botnet and malware authors take advantage of every vulnerable moment, don't get caught off-guard.