Q

What warning signs will indicate the presence of a P2P botnet?

Expert Mike Chapple explains two easy ways to detect the presence of a P2P botnet on your system.

What are some sure signs that a computer has been connected to a peer-to-peer (P2P) botnet?

Peer-to-peer (P2P) botnets are the insidious follow-ons to the traditional Internet Relay Chat (IRC) command-and-control botnets of the past. In the IRC model, infected systems connect to an IRC controller network to receive commands from the botnet owner. It became easy to detect these botnets by simply monitoring your network for connections to IRC servers. Botnet owners answered this countermeasure with the introduction of P2P botnets that use encrypted communications within the "cloud" of infected systems, eliminating the need for a centralized controller.

There are two main ways you can detect the presence of a P2P botnet on your system and they're not rocket science. In fact, they're basic security controls that you should be practicing already. First, install and maintain updated antivirus software on your systems. Botnets typically infect systems with outdated antivirus signatures. Second, monitor your host firewall configurations. The typical productivity workstation does not require any inbound access other than any remote administration software in use on your network. P2P botnets must open firewall ports on infected systems to support their participation in the botnet cloud.

Next Steps

Learn about shaping P2P packets.

Find out what risks are involved in logging into a botnet control channel.

This was first published in August 2008

Dig deeper on Emerging Information Security Threats

Pro+

Features

Enjoy the benefits of Pro+ membership, learn more and join.

Have a question for an expert?

Please add a title for your question

Get answers from a TechTarget expert on whatever's puzzling you.

You will be able to add details on the next page.

0 comments

Oldest 

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

SearchCloudSecurity

SearchNetworking

SearchCIO

SearchConsumerization

SearchEnterpriseDesktop

SearchCloudComputing

ComputerWeekly

Close