What are some sure signs that a computer has been connected to a peer-to-peer (P2P) botnet?
Peer-to-peer (P2P) botnets are the insidious follow-ons to the traditional Internet Relay Chat (IRC) command-and-control botnets of the past. In the IRC model, infected systems connect to an IRC controller network to receive commands from the botnet owner. It became easy to detect these botnets by simply monitoring your network for connections to IRC servers. Botnet owners answered this countermeasure with the introduction of P2P botnets that use encrypted communications within the "cloud" of infected systems, eliminating the need for a centralized controller.
There are two main ways you can detect the presence of a P2P botnet on your system and they're not rocket science. In fact, they're basic security controls that you should be practicing already. First, install and maintain updated antivirus software on your systems. Botnets typically infect systems with outdated antivirus signatures. Second, monitor your host firewall configurations. The typical productivity workstation does not require any inbound access other than any remote administration software in use on your network. P2P botnets must open firewall ports on infected systems to support their participation in the botnet cloud.
Learn about shaping P2P packets.
Find out what risks are involved in logging into a botnet control channel.
Dig Deeper on Emerging Information Security Threats
Related Q&A from Mike Chapple, Enterprise Compliance
The HHS security risk assessment tool is designed to help healthcare providers meet the HIPAA security requirement. Expert Mike Chapple explains how ...continue reading
PCI DSS requirement 6.6 demands application security compliance through one of two options: an application firewall or a code review. Expert Mike ...continue reading
Are HIPAA-compliant hosting services a better option for compliance than a secure storage API? Expert Mike Chapple analyzes.continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.