• Spyware, viruses, & security forum
• CNET's Forum on viruses and spyware is the best source for finding the latest news, help, and troubleshooting advice from a community of experts. Discussions cover how to detect, fix, and remove viruses, spyware, adware, malware, and other vulnerabilities on Windows, Mac OS X, and Linux.

•  

    <!--gc-->  

  Secure Windows and Mac
• If you are seeking articles and other resources on how to secure your Windows PC or Mac, you've come to the right place. We'll show you how to harden your configuration and give you other tips to make your computer as secure as possible
• Protect Windows (7, Vista, XP)
• No matter what flavor of Windows OS you have, we've got you covered with all the security basics you'll need to lock down your system. Check out these links below to get started.
• Protect Mac OSX (Snow Leopard, Leopard, Tiger)
• Many people assume that Mac OS X is secure because there seem to be a limited number of viruses made for Mac. While this may be true, OS X is still vulnerable to many of the same types of attacks that plague Windows users. Our Mac security tips will help you protect your Mac OS device and the information on it.

4 more annotations...

• How to Enable Mac OS X’s Built-in Security Features
• Mac OS X is capable of providing robust security right out of the box; however, some of OS X’s best security features are disabled by default, requiring the user to set them up. This guide will walk you through configuration of the most important settings you need to make your Mac more secure

• Fight Cybercrime
• Are you tired of the bad guys winning? It's time to fight back against cybercriminals. Read the following articles to educate yourself on the latest scams and internet-based threats going around
• 1. Hacker and Cybercriminal Threats and Techniques
  2. Fight Back Against Cybercrime
  3. Hacker Tools and Cyberweapons

1 more annotation...

• 5 Ways to Stealth Yourself Online
• Invoke the cloak of online invisibility.
• 1. Use a Web Browsing Proxy Service
• Using an anonymous browser proxy service is one of the easiest ways to prevent the websites you visit from determining your actual IP address. Your true IP address aids advertisers in targeting you, hackers in attacking you, and stalkers in finding you. Your IP can also provide your actual location (at least down to the city and local zip code if you're using a local internet service provider).

• A couple of the more well known commercially available proxies include Anonymizer.com and GhostSurf.

    
• Whatever proxy service you choose, be sure to check their privacy policy to see how your identity and other information is protected.
• 2. Opt-out of Everything Whenever Possible
• Google and other search engines feature the ability for you to remove your personal information such as your phone numbers and physical address. They even let you control whether or not the Google Street View of your house is fully available to the public. If you've never used Google Street View, I urge that you try it. Google Street View can be used by criminals to virtually "case" your home or business. They can virtually pull up right in front of your door to see what the best method of entering your home or business is. While you can't have your house completely removed you can have it blurred. Visit the Google Maps Privacy page for details.
• 3. Setup a Throwaway E-mail Account for Site Registrations and Online Purchases
• 4. Check and Update Your Facebook Privacy Setting
• Most people set their Facebook privacy settings when they first sign up, but rarely check back to see what additional privacy options are available now. Facebook is constantly evolving and changing their privacy options. It's best to check them frequently to ensure that you haven't granted more information to the public than you intended to
• The best rule of thumb is to set most items viewable to "Friends Only"
• 5. Turn on Your Router's Stealth Mode
• Many home wired and wireless network routers have a feature called "Stealth Mode". Stealth mode allows you to make the computers on the inside of your home network virtually invisible to hackers.
• Stealth mode prevents your router from responding to "pings" from hacker's port scanning tools. Hackers use these scanning tools to find unsecured ports and services on your computer. They could use this knowledge to mount a port or service specific attack. By not responding to these requests your router makes it look like there is nothing running inside your network.

13 more annotations...

• 4 Secrets Wireless Hackers Don't Want You to Know

  Hacker: Nothing to see here. Please don't bother reading this.
• You're using a wireless access point that has encryption so you're safe, right? Wrong! Hackers want you to believe that you are protected so you will remain vulnerable to their attacks. Here are 4 things that wireless hackers hope you won't find out, otherwise they might not be able to break into your network and/or computer:
• 1. WEP encryption is useless for protecting your wireless network. WEP is easily cracked within minutes and only provides users with a false sense of security.
• 2. Using your wireless router's MAC filter to prevent unauthorized devices from joining your network is ineffective and easily defeated.
• 3. Disabling your wireless router's remote administration feature can be a very effective measure to prevent a hacker from taking over your wireless network
• 4. If you use public hotspots you are an easy target for man-in-the-middle and session hijacking attacks

4 more annotations...

• Rainbow Tables: Your Password's Worst Nightmare

  Don't let their cute name fool you, these things are scary.
• The Rainbow Tables that we are talking about are used to crack passwords and are yet another tool in the hacker's ever growing arsenal.
• Here's the basic concept behind Rainbow Tables:
• I'm a bad guy who has just plugged a thumb drive into a server or workstation, rebooted it, and ran a program that copies the security database file containing user names and passwords to my thumb drive.
• The passwords in the file are encrypted so I can't read them. I will have to crack the passwords in the file (or at least the administrator password) so that I can use them to access the system.
• What are my options for cracking passwords? I can try and use a brute-force password cracking program such as John the Ripper ,which pounds away at the password file, trying to iteratively guess every possible combination of a password. My second option is to load a password cracking dictionary containing hundreds of thousands of commonly used passwords and see if it gets any hits. These methods can take weeks, months, or even years if the passwords are strong enough.
• Enter the Rainbow Tables: Rainbow Tables are basically huge sets of precomputed tables filled with hash values that are pre-matched to possible plaintext passwords. The Rainbow Tables essentially allow hackers to reverse the hashing function to determine what the plaintext password might be. It's possible for two different passwords to result in the same hash so it's not important to find out what the original password was, just as long as it has the same hash. The plaintext password may not even be the same password that was created by the user, but as long as the hash is matched, then it doesn't matter what the original password was.
• How can you protect yourself against Rainbow Tables-based password attacks?
• My advice on how to defend against Rainbow Tables is really meant for application developers and system administrators. They are on the front lines when it comes to protecting users against this type of attack.
• Here are some developer tips on defending against Rainbow Table attacks:
• 1. Don't use MD5 or SHA1 in your password hashing function.
• 2. Use a cryptographic "Salt" in your password hashing routine

10 more annotations...

• The Shadowy World of Malware Affiliate Marketing
• Is your computer being sold into slavery without you even knowing it?
• I discovered that malware isn't as easy to detect and fix as it used to be in the good ole days when you could run a scan, find the problem, disinfect the computer, and be on your merry way.
• I also learned that cybercriminals have developed new classes of sophisticated malware such as rootkits that can be inserted into low-level drivers that load prior to your PC's operating system. Some rootkits can even be inserted into the computer's firmware, making them extremely hard to detect and remove even after completely wiping and reloading the computer.
• There is a new economy on the internet, and it's all about bad guys getting paid to infect computers. Control and use of the infected computers is sold to other criminals. Once purchased, the criminals use the infected PCs for whatever purposes they see fit. The hacked computers may be used in bot nets to attack other systems, or the victim's data may be harvested so that the criminals can steal their credit card information or other personal info useful for identity theft, blackmail, extortion, or other bad things.
• According to Kaspersky's Securelist site, malware developers may pay affiliates $250 or more per 1000 PCs that their malware is installed on. Each affiliate gets an ID number that is embedded in the installed software. The affiliate ID number makes sure the bad guy that installed the malware on the victims' computers gets credit for the installs so that the malware developer can keep track of how much money to pay them.
• Your probably saying to yourself: "My antivirus software is top notch, I keep it updated, and I run scheduled scans and everything is in the green. I'm safe, right?"
• I wish I could give you a pat answer and reassure you, but after the week I've spent trying to rid my in-law's computer of malware, I can say that no one is safe just because they have updated anti-virus. The bad guys are extremely vigilant and creative when it comes to developing new ways to fool anti-malware scanners into thinking that all is well and right with your computer.
• here are some tips on what to do about serious malware infections:
• 1. Look for warning signs of a possible undetected malware infection
• If your browser is getting constantly redirected to sites that you did not request or if you notice that your computer won't let you start applications or perform basic functions such as opening the control panel in Windows, then you might have undetected malware.
• 2. Get a "second opinion" malware scanner
• There is a high likelihood that your main anti-virus / anti-malware scanner may not catch all infections. It's always best to get a second opinion from a scanner that may be looking for malware using a different method. There are many free malware scanners that can detect things that aren't traditionally covered by regular anti-virus scanners. One that I found to be effective is a program called Malwarebytes(free version available). Do your research before installing any purported anti-malware software to your PC to avoid loading a malicious fake anti-malware product by mistake. They can look very convincing so be extra careful.
• 3. Seek expert help if needed
• There are some excellent free resources out there for people who believe their computer is infected by something that is not being caught by their virus or malware scanners. An excellent resource that I used was a site called Bleeping Computer. They have active forums with helpful techs that guide users through the process of ridding their computers of infection. They also have links to many legitimate malware scanners and other great tools.
• 4. If all else fails, backup your data, and then wipe and reload.
• Some malware infections, like the one on my in-law's computer, are extremely stubborn and just refuse to be killed. If you want to be extra sure you removed the infection you need to backup all your data and do a wipe and reload from trusted media . Make sure you check for rootkits with a anti-rootkit scanner when you reinstall your operating system.

15 more annotations...

• How to Protect Yourself From Clickjacking Attacks

  Keeping an eye out for an invisible enemy.
• What is Clickjacking?
• Clickjacking may sound like the latest underground dance craze, but it's far from it. Clickjacking occurs when a scam artist or other internet-based bad guy places an invisible button or other user interface element over top of a seemingly innocent web page button or interface element using a transparency layer (which you can't see).
• How can you prevent your clicks from being clickjacked?
• 1. Update your Internet browser and plug-ins such as Flash
• 2. Download Clickjacking Detection / Prevention Software
• Clickjacking prevention is not only the responsibility of the user. Websites and web application developers also have a role in preventing their content from being exploited by clickjackers. The Code Secure Blog has some excellent suggestions on how to write code to assist in the detection and prevention of clickjacking.

5 more annotations...

• Should you be Afraid of Scareware?

  It's not a slasher movie. It's much worse.

  By Andy O'Donnel
• Scareware is a term used to describe an application that is usually associated with a scam to trick unsuspecting users into thinking that they have a computer virus or some other kind of major computer issue that only the Scareware application can fix.
• Once the unsuspecting user downloads and installs the Scareware application that is supposed to fix the "problem", a malicious payload may also be installed on the computer that can be used to harvest a user's personal data or control the victim's PC remotely to carry out other attacks.
• Some Scareware's sole purpose is to make money for its developers. They may pass it off as an anti-virus program, PC performance enhancing software, or some other legitimate application. The application usually does not perform its advertised function at all and is merely a facade to scheme users out of their money or install malware onto their computers.
• The reason it's called Scareware is because it plays on people's fear and anxiety about computer viruses to convince them to install malware that they would normally not install.
• How do you recognize and avoid Scareware? Follow these simple tips below:
• 1. Turn on your browser's pop-up blocking featur
• Many Scareware programs enter a user's system when the user is presented with a cleverly designed pop-up box that looks like it is a message from their computer's operating system telling them that there is a virus and then giving them further instructions on how to fix it. The pop-up is actually created by the Scareware developer and is designed to convince the user that they have a virus when they really do not. If the user clicks a link anywhere in the pop up message it usually leads to them having Scareware installed onto their PC.
• 2. Never download any anti-virus software from a pop-up window or link sent to you via an e-mail
• 3. Update your anti-virus software often and run regularly scheduled scans
• 4. When closing a pop-up ad, always use the operating system's "X" button in the corner of the pop-up window

9 more annotations...

• ave you noticed that your PC has suddenly slowed to a crawl for no apparent reason? It might be nothing, but it could be that your computer is busy doing other things, and by other things I mean attacking other computers as part of a bot net controlled by hackers, or other assorted bad guys.
• Bot net software is usually installed on computers by users who are tricked into loading it. The software might pass itself off as a legitimate product claiming to be an anti-virus scanner, when in reality it is malicious Scareware that, once installed, provides a gateway into your system for malware software developers to install things like rootkits and bot net-enabling software.
• he bot net software effectively sets your computer up to receive instructions from a master control terminal that is controlled by the bot net owner who is usually a hacker or other cyber criminal that purchased the use of your computer from the person who infected it.
• It's like someone renting out your car for someone else's use while it's parked at a shopping center, and then putting it back before you discover it was gone.
• A typical bot net may consist of tens of thousands of computers that are all controlled by a single command and control terminal. Hackers love using bot nets because it allows them to combine the computing power and network resources of all the computers in the bot net to attack a single target. These attacks are called distributed denial of service attacks (DDoS).
• Once the system is bogged down by all the DDoS traffic from the bot net, legitimate users might not be able to reach the server which is extremely bad for business, especially if you're a large electronic retailer where constant availability is your lifeblood.
• How do these bot nets become so large?
• Malware developers who create the bot net software pay money via malware affiliate marketing programs to people willing to install their malware on victims' computers. They may pay $250 or more per 1000 "installs". Enterprising bad guys will use every means necessary to trick unsuspecting users into installing this crapware. They will link it in spam e-mails, post malicious links to forums, setup malicious websites, and anything else they can think of to get you to click the installer so they can get credit for another install.
• How can we stop these Sons of (insert favorite bad thing here)'s from enslaving our computers?
• 1. Get a malware-specific scanne
• 2. Get a "second opinion" scanne
• 3. Be on the lookout for fake anti-virus software

10 more annotations...

• Don't Panic Over the Latest Mac Malware Story
• I mention Safire because I suspect he would be amused to read about the recent wave of attacks on the Mac, or perhaps I should say, the current wave of predictions about attacks on the Mac. Longtime Microsoft columnist Ed Bott made national news on May 2nd, when he asserted categorically that “serious malware is coming soon to a Mac near you.” As evidence, Ed pointed to a video made by a Danish IT security company named the CSIS eCrime Unit, a company I have never heard of. That video describes a “crimeware” program that can build Mac-compatible Trojan-horse programs for capturing keystrokes and passwords. To lure customers into installing the Trojan, customers that visit poisoned websites are shown native-looking dialogs that try to scare them into downloading fake security software. Ed has since followed up his initial column with four more posts on the same subject. The most recent one describes a large increase in customers who are complaining about malware in Apple support forums. All of these posts are meant to persuade readers that, indeed, the Mac is becoming just like Windows: malware-laden and dangerous.
• As early as 2005, companies ranging from Symantec, McAfee and Trend Micro to Kaspersky and Sophos have all erroneously predicted the rise of Mac malware. Conveniently, these firms also sell subscription medicine that makes these future ailments go away. John Gruber, author of the popular Mac-centric blog Daring Fireball, assembled some of the choicest predictions in a post called “Wolf!”, which I recommend you read as entertainment. The security firms may yet be proved right, but to date they have been flat wrong — wrong enough to be called scaremongers. (Which I did, in print, five years ago.)
• the second question is, do we care about the prediction that “serious” malware is coming to Macs? Only a little. It is true that Macs aren’t dusted with some sort of magic unicorn Unix-y pixie powder that makes it less vulnerable to security flaws than Windows. But it is equally true that the Mac remains a less risky platform than Windows because of the fewer strains of malware written for OS X. By “fewer” I mean 99% fewer: a hundred malware samples versus 50 million. The Mac also has a much less evolved malware supply chain. By “less evolved” I mean “nonexistent,” this one example notwithstanding.
• The business of malware, in the Windows world, is a lot like the fast food industry, with results almost as toxic. Crime syndicates sell dozens of exploit kits, readily available from purchase or rental on underground forums. It’s a super-sized supply chain operation with raw materials manufacturers (who turn exploits into weapons), assemblers (who make the exploit kits), distributors (forums), franchisees (who run botnets) and customers (victims).
• It has taken the Windows malware supply chain twenty years to evolve to its current level of stratification and sophistication. It stands to reason that supply chain won’t be replicated overnight for the Mac. Charlie Miller, a noted security researcher with serious OS X and iOS creds, calls the Mac “safer, but less secure… Mac OS X is like living in a farmhouse in the country with no locks, and Windows is living in a house with bars on the windows in the bad part of town.” Could that change? Yes, although crime syndicates have a larger “addressable market” in at least one mobile operating system, and are much more likely to seek to replicate their business models there first. (More on that in a minute.) In the meantime, the Mac was a relatively low-risk computing platform last month, and will continue to be one next month, too.
• So, what’s next? Here are the two things I am thinking about:
• The desktop Mac OS might not be attractive to attackers as you might think
• Over time, the Mac App Store will increase customer security.

7 more annotations...

• Difference Between A Virus, A Worm, A Trojan Horse And Malware
• Virus- or computer virus refers to a computer program that infects another program. Technically a true computer virus attaches itself or a part of it into another program or a file. Computer virus, like its biological counter part needs a 'host' to infect and spread. It primarily attaches itself to an executable (.exe) or command (.com) files.
• It spreads when an infected program is opened then it will infect -by attaching a copy of its code to- another program.
• Worm - is a self replicating program. It creates copies of itself to available folders (directories) and drives, some later versions are even capable of replicating itself across networks. Unlike a virus, a worm does not need a host program to infect.
• rojan Horse - na
• n computers, a Trojan horse is seemingly harmless and even useful program and often very inviting. Unlike the virus or worm, a Trojan horse does not replicate itself, but once running it does some other routine that is hidden from the user, it could get some information from your computer, or download a virus or worm and/or could do something that would damage your system.
• Malware - short for Malicious Software, is any programs or script created with malicious intent. Virus, Worms and Trojan Horses are just three of the many forms of malware. Most often though the term virus is erroneously used to point out any of the Malware mentioned.

5 more annotations...

• Malware and Viruses
• TechNet Blogs
• each Online Safety

1 more annotation...

• How to protect yourself from malware
• What is the threat?
• But since the early 2000s, the primary motive for malware creation has been profit. Online criminals are after your banking information or your credit card numbers or your computer’s processing power. In the worst case scenario, they may even be after private information that could be used to extort you or harm your business. And these sorts of attacks generally have both financial and psychological costs.
• The true costs of malware can incl
• de your data, your content, your time, your effort and your heartache.
• Want a few examples of malware mayhem? Spyware tracks you for advertising purposes and slows down your computer doing so. Keyloggers monitors your every keystroke in an effort to steal your credit card information. Scareware imitates anti-virus software in an attempt to extort a quick payment from you. Ransomware takes your files and demand a ransom in return. Rootkits can turn you PC into a zombie computer and use it to send out email spam or to host illegal materials or to join in attacks on websites. There’s even a malware that exists just to create a fake login page for your bank’s website to steal your account information.
• How does malware end up on your PC?
• How do you end up downloading and installing malware? Sometimes malware gets packaged in with more legitimate software. Sometimes simply clicking on a fake error message can trigger a drive-by malware download. And you’re certainly aware of the classic method of disguising malware in an email attachment.
• How to protect yourself from malware
• 1. Make sure your PC is updated and secure
• Software companies know their programs are not perfect. That’s why they release updates. Microsoft, Apple and Adobe all release dozens of updates every year.
• Of course, we also recommend always running updated Internet security that includes anti-virus, spyware and firewall. Browsing Protection is another layer of security that can keep you from clicking on the wrong links.
• 2. Be very skeptical of random pop-up windows, error messages and attachments
• Modern browsers have reduced the burden of pop-up windows. But they do still exist. Most pop-ups are far more annoying than harmful. But you might think of pop-ups like broken windows into a neighborhood you were walking through at night. It’s a sign that you should be on guard.
• Avoid clicking on any pop-ups that imitate your Windows error messages or error messages that come up when you try to close out of a page. (Force quit out of the program, if necessary.) If any software begins to install itself, close out immediately and run a scan of your Internet security software.
• Avoid opening attachments at all unless you were expecting them and they come from a source you trust. If you can’t verify the source or feel anxious about a particular attachment yet have to open it, you can download it to your hard drive and have your updated Internet security scan the file before you open it.
• 3. Remove spam from your life
• If you get a piece of spam, let your mail software know. Identify it as spam. You could also unsubscribe but unsubscribe link have been used on rare occasions to trigger a malware attack. Better to let your software handle it. If you have a friend on Facebook who spreads spam or bad apps, let them know. And if they continue spreading spam, unfriend them. You are responsible for your social network. Refuse to associate with those people who are not responsible for theirs.
• 4. Think thrice before installing any new software

• Installing software should never be an impulse decision. Some people say think twice before downloading any software from a source you do not trust 100%. I say think three time.

   
• At the very least, Google the name of a product you want to install. If you’re at all uncertain about whether to click download, consult with a tech savvier friend or your company’s IT guy.
• When you install software, you could invite in a nasty predator that won’t leave until it’s done some serious damage. So think about installing software with a bit of the same sort of caution you use when deciding to let someone into your home.
• 5. Behave online as you would in real life
• There’s an old saying in my family: “Don’t go licking the floors of a hospital.” What it means is: “Use your common sense.” You have a natural sensor in your brain that tells you when something feels dicey or unsafe. Trust your gut.

22 more annotations...

• Gone Phishing!

  Experts Weigh In On Why Phishing "Works"
• "Phishing attacks use “spoofed” e-mails and fraudulent websites with the attempt to trick unsuspecting Internet users into divulging confidential personal information such as credit card numbers, account usernames and passwords, social security numbers, etc. By hijacking the trusted brands of well-known institutions, phishers are able to convince a small percentage of recipients to respond to them."
• The bottom line is that "phishing" is just an instance of a social engineering problem. The root cause (on one side) is the criminal, and (on the other side) the gullibiltiy of the victim. "Phishers" could just as easily be phoning people at home and claiming to be the credit card company, etc., etc. Adding attempts at technological "quick fixes" isn't going to work."
• On the issue of phishing scams Appleman says “For the average computer user the focus should be first on the basic security precuations they should be taking - those precautions will do a good job of blocking the wide array of specific vulnerabilities as they appear. The focus next should be on education and practice.”

2 more annotations...

•  

   

    Home > Did You Know > The Difference Between a Computer Virus, Worm and Trojan Horse

     

   

   

   

   

   

  The Difference Between a Computer Virus, Worm and Trojan Horse
• What Is a Virus?
• A computer virus attaches itself to a program or file enabling it to spread from one computer to another, leaving infections as it travels. Like a human virus, a computer virus can range in severity: some may cause only mildly annoying effects while others can damage your hardware, software or files. Almost all viruses are attached to an executable file, which means the virus may exist on your computer but it actually cannot infect your computer unless you run or open the malicious program. It is important to note that a virus cannot be spread without a human action, (such as running an infected program) to keep it going. Because a virus is spread by human action people will unknowingly continue the spread of a computer virus by sharing infecting files or sending emails with viruses as attachments in the email.
• What Is a Worm?

• worm is similar to a virus by design and is considered to be a sub-class of a virus. Worms spread from computer to computer, but unlike a virus, it has the capability to travel without any human action. A worm takes advantage of file or information transport features on your system, which is what allows it to travel unaided.

   

  The biggest danger with a worm is its capability to replicate itself on your system, so rather than your computer sending out a single worm, it could send out hundreds or thousands of copies of itself, creating a huge devastating effect. One example would be for a worm to send a copy of itself to everyone listed in your e-mail address book. Then, the worm replicates and sends itself out to everyone listed in each of the receiver's address book, and the manifest continues on down the line. 
• What Is a Trojan horse?
• A Trojan Horse is full of as much trickery as the mythological Trojan Horse it was named after. The Trojan Horse, at first glance will appear to be useful software but will actually do damage once installed or run on your computer.  Those on the receiving end of a Trojan Horse are usually tricked into opening them because they appear to be receiving legitimate software or files from a legitimate source.  When a Trojan is activated on your computer, the results can vary. Some Trojans are designed to be more annoying than malicious (like changing your desktop, adding silly active desktop icons) or they can cause serious damage by deleting files and destroying information on your system. Trojans are also known to create a backdoor on your computer that gives malicious users access to your system, possibly allowing confidential or personal information to be compromised. Unlike viruses and worms, Trojans do not reproduce by infecting other files nor do they self-replicate.

• Tips to Combat Viruses, Worms and Trojan Horses on Your Computer

   
• Keep The Operating System Update
• Use a Firewall

8 more annotations...

• What is a Botnet?
• Botnet Definition
• Botnet is the generic name given to any collection of compromised PCs controlled by an attacker remotely. Botnets generally are created by a specific attacker or small group of attackers using one piece of malware to infect a large number of machines. The individual PCs that are part of a botnet often are called “bots” or “zombies” and there is no minimum size for a group of PCs to be called a botnet. Smaller botnets can be in the hundreds or low thousands of infected machines, while larger ones can run into the millions of PCs. Examples of well-known botnets that have emerged in recent years include Conficker, Zeus, Waledac, Mariposa and Kelihos. A botnet is often discussed as a single entity, however the creators of malware such as Zeus will sell their wares to anyone with the money to pay for them, so there can sometimes be dozens of separate botnets using the same piece of malware operating at one time.
• Method of Infection
• There are two main methods through which attackers infect PCs to make them part of a botnet: drive-by downloads and email. Drive-by download infections require a few different steps for the attacker, and they require the attacker to find a popular Web site with an exploitable vulnerability. The attacker then loads his own malicious code on the site and rigs it to exploit a vulnerability in a common browser such as Google Chrome or Internet Explorer. The code will typically then redirect the user’s browser to another site controlled by the attacker where the bot code will be downloaded and installed on the user’s machine. The email infection vector is much simpler. The attacker sends out a large batch of spam that includes either a file such as a Word document or PDF with malicious code in it, or a link to a site where the malicious code is hosted. In either case, once the attacker’s code is on the user’s machine, that PC is now part of the botnet. The attacker can issue remote commands to the PC, upload data from the machine, download new components and generally do what he wants with it.
• The traditional and most common use for botnets is in DDoS attacks. These attacks rely on the computing power and bandwidth of hundreds or thousands of PCs to send huge amounts of traffic at a specific Web site in an effort to knock the site offline. There are many different flavors of DDoS attacks, but the goal is the same: preventing the target site from operating. Attackers used to employ this tactic as a way to knock their rivals’ sites offline, but they then began turning it on Web portals such as Yahoo and MSN, shopping and banking sites and government sites. Groups such as Anonymous, LulzSec and others recently have used DDoS attacks against defense companies, banks and other organizations. Meanwhile, cybercriminals have taken to using DDoS attacks against banking sites as a way to disguise deeper attacks on those banks. Botnets also are used in a number of other operations. Spammers employ botnets to send out millions of junk email messages from the infected PCs and cybercriminals use them in large-scale credit-card fraud operations.
• Attackers rely on the gullibility of users to open malicious attachments or click on shady links in order to get their malware onto new PCs. Removing that from the equation makes it far more difficult for attackers to build and use botnets.

5 more annotations...