-: Botnets and zombies.
What happens to your computer if it becomes
the victim of a botnet?
Well, let's say that your computer
has picked up some kind of malware
and that malware, its purpose
is to change your computer into its victim,
into what we call a zombie.
That's right, a zombie becomes part of the botnet
and a botnet is simply a collection
of compromised computers under the control of a master node.
So, what does this really look like?
Well, if your computer becomes a zombie,
it becomes under the control of some attacker
and that attacker has what they call
the command and control node or C2 node.
That command and control node controls
not just your computer but hundreds or thousands
or hundreds of thousands of other computers
that are part of their botnet.
What kind of things can these zombies do?
Well, they might be used as a pivot point
so that when they get a new victim,
or if they're attacking a server,
they can access it through your computer
and it looks like you're doing the attack
instead of the master node.
They'll jump from their command and control node
into one of the zombies
and from the zombie over to the victim
and they might go out and use those zombies
to host files that are illegal, like child pornography
so they don't get caught with them
and all sorts of things like that.
They may use them to spam other people
and send out phishing campaigns and other malware
or, most commonly, they can use this botnet
to conduct a DDoS, a distributed denial-of-service attack.
What exactly is a distributed denial-of-service attack?
Well, a distributed denial-of-service attack occurs
when many machines target a single victim
and attack them at the exact same time.
So let's assume that I'm the bad guy
and I control a botnet of 100,000 machines
and I want to go and take down somebody's website,
I can make all 100,000 of my victims, my zombies,
target that victim's server
and make the request simultaneously.
That type of load could end up
forcing the web server offline,
causing it to crash and not be able
to serve its real customers.
That is denying it the ability
to do its normal functions or its service.
That makes it a denial of service
and a distributed denial-of-service is just that,
it's the most common use of botnets
and it's been that way for a long time
but these days attackers aren't just
doing it for fun and games.
Instead they want to make money
and so they're using zombies to do things
that are processor intensive like bitcoin mining
or other cryptomining on their behalf.
That's right, when you have a botnet
with lots and lots of zombies,
you have a lot of processing power at your disposal
because each of those machines
can give you some of its resources
and then they can work in a distributive manner.
So, I can set them off
and let them start mining coins for me
and they'll return those coins back
to my command and control node where I can profit from them.
Botnets are great to be used
for anything that is processor intensive.
So that can be things like cryptomining.
That can be things like breaking encryption.
And again, if your computer becomes part of this network
and it becomes a zombie, it doesn't even know
it's doing a lot of these things
and you might not even know
that it's doing these things either.
Instead you just see your machine is slowing down.
Because the attackers don't take up
all of your computing power,
they might just take 10% or 20% of your power,
it might take you a long time to figure it out
but with only 10 or 20% of the power,
across hundreds of thousands of computers,
they have a ton of power at their disposal
for either nefarious things like
distributed denial-of-service attacks
or money making things like cryptomining.