In the world, there are some well-known botnets, this paper briefly introduces these botnets. Enable readers to understand the current status of botnets. In order to make the description more intuitive, I will give a score for each botnet from four aspects: infection degree, income degree, popularity and vitality, and give a comprehensive score for the hazard degree of these botnets.
** Infection: ** The number of hosts infected by a zombie program, including the geographical distribution of infected hosts. The host infection
The larger the quantity, the wider the geographical distribution, the higher the score.
** Revenue: ** refers to the revenue generated through this botnet. The higher the yield, the higher the score.
** Popularity: The global influence of **, including whether it is open source and widely reported by major media.
The higher the exposure, the higher the score.
Vitality: Vitality refers specifically to its ability to survive. It can also be interpreted as resistance to shock. The stronger they are, the longer they survive,
The higher the score.
** Degree of harm: The average value of the first four terms (rounded by four to five) represents the overall degree of harm of the botnet.
1. ZeroAccess
9 has infection degrees
8 has yield degrees
Popularity has 9
Life consists of 9
Nine has harm degree
ZeroAccess, which emerged in 2011, is one of the best-known and most active botnets. It uses advanced Rootkits to hide itself, using industry-popular modular designs, by creating hidden folders, downloading and storing specified functional modules and executing them. The communication protocol uses P2P architecture to make it highly anti-attack. The number of global host infections is between 1 million and 2 million, and its main income source is “click fraud”. Once, it also made profits through bitcoin mining, and its daily income is estimated to be about $100,000.
2. Zeus
8 has infection degrees
8 has yield degrees
Popularity has 9
Life consists of 9
8 has damage degrees
Zeus is one of the most profitable botnets in history and was first discovered in 2007. Zeus is primarily used to monitor victim machines, recording user keystrokes to steal bank account information. Criminals can transfer money from users’ accounts and use users’ bank cards to make purchases. The control server controls the operation of the botnet and issues commands to it. By the time this book was published, the amount of money stolen amounted to millions of dollars. In 2011, the source code of Zeus was leaked, resulting in the explosive growth of its variants, and some hackers added P2P modules for it, causing great harm to the Internet and far-reaching influence.
3. Pushdo/Cutwail
6 has infection degrees
8 has yield degrees
Popularity has 7
Life consists of 9
Harm degree has 7
Pushdo itself is a “loader” that can download other components to install on the system, first discovered in 2007. Pushdo allows customers to customize the installation of specific malware, charging for each installation. After Pushdo enters an infected computer system, the spam program Cutwail is usually downloaded. Pushdo uses Cutwail to replicate itself, expanding its botnet, as well as renting out spam services. The Pushdo/Cutwail botnet sent a variety of spam messages, including medical products, online gambling, phishing emails and links to websites containing malicious code. Infected about 100,000 hosts and became the largest spam botnet after Storm was destroyed. The controllers may have made between $1.7 million and $4.2 million.
4. Mariposa
9 has infection degrees
7 has yield degrees
Popularity has 6
4 has vitality
Harm degree has 7
Mariposa, also known as the “butterfly” botnet, was used to steal credit cards and other valuable data, as well as DDoS attacks, and has been destroyed by Spanish authorities. The botnet emerged in 2008 and then quickly spread to more than 190 countries and regions around the world. More than 10 million computers were affected by Mariposa, and computers of more than half of the world’s 1,000 largest companies and at least 40 major financial institutions were infected. It is still impossible to estimate the losses caused by it.
5. Waledac
6 has infection degrees
6 has yield degrees
Popularity has 7
4 has vitality
5 has damage degrees
The Waledac botnet, whose control servers are mostly located in European countries such as Germany, the Netherlands, Sweden and Russia, controls hundreds of thousands of computers around the world and is expected to send more than 1.5 billion spam messages a day. In 2010, China, the United States and Europe jointly cracked down on the Waledac botnet and gradually weakened. However, monitoring information from 2012 showed signs of a resurgence. The cost of damage is unknown.
How do botnets work in the next video
