[Asmo]

Although botnet masters increasingly use platforms other then IRC to command their zombie networks, it remains the biggest platform in use to date.

These botnets are being used by malicious users to perform DDoS attacks, collect personal data such as banking info and creditcard details and for example to use as a base to send spam. The machines used in the botnets are usually compromised home PC's.

About 75% of the software used in botnets consists of Sdbot and Gaobot. ""This dominance is not so much due to any special features of Gaobot or Sdbot, but simply because their code is much more widely available on the Internet. This means that any criminals that want to make a bot can simply base it on the source code of these threats, making any modifications they choose. Essentially, this saves them a lot of work," said Luis Corrons, technical director at PandaLabs.

IRC networks have been very active in hunting and shutting down botnets. Also security software such as firewalls increasingly warn users for IRC traffic, adding to the chance that the compromised machine is being cleaned. To prevent detection, the botnets increasingly are making use of HTTP, normal website traffic which is far less being looked suspiciously at. Also peer-to-peer type of networks are now in use.

"Control through IRC is useful for controlling isolated computers. However, this system is not so useful when it comes to botnets. By using HTTP, bot herders can control many more computers at the same time, and can even see when one of them is online or if the commands have been executed correctly," Corrons continued.
_________________
Asmo

webmaster www.IRC-Junkie.org