What warning signs will indicate the presence of a P2P botnet?

What warning signs will indicate the presence of a P2P botnet?

What are some sure signs that a computer has been connected to a peer-to-peer (P2P) botnet?

    Requires Free Membership to View

    SearchSecurity.com members gain immediate and unlimited access to breaking industry news, virus alerts, new hacker threats, highly focused security newsletters, and more -- all at no cost. Join me on SearchSecurity.com today!

    Michael S. Mimoso, Editorial Director

    By submitting your registration information to SearchSecurity.com you agree to receive email communications from TechTarget and TechTarget partners. We encourage you to read our Privacy Policy which contains important disclosures about how we collect and use your registration and other information. If you reside outside of the United States, by submitting this registration information you consent to having your personal data transferred to and processed in the United States. Your use of SearchSecurity.com is governed by our Terms of Use. You may contact us at webmaster@TechTarget.com.

Peer-to-peer (P2P) botnets are the insidious follow-ons to the traditional Internet Relay Chat (IRC) command-and-control botnets of the past. In the IRC model, infected systems connect to an IRC controller network to receive commands from the botnet owner. It became easy to detect these botnets by simply monitoring your network for connections to IRC servers. Botnet owners answered this countermeasure with the introduction of P2P botnets that use encrypted communications within the "cloud" of infected systems, eliminating the need for a centralized controller.

There are two main ways you can detect the presence of a P2P botnet on your system and they're not rocket science. In fact, they're basic security controls that you should be practicing already. First, install and maintain updated antivirus software on your systems. Botnets typically infect systems with outdated antivirus signatures. Second, monitor your host firewall configurations. The typical productivity workstation does not require any inbound access other than any remote administration software in use on your network. P2P botnets must open firewall ports on infected systems to support their participation in the botnet cloud.

More information:

This was first published in August 2008