Home > Ask the Security Experts > Network Security Questions & Answers > What warning signs will indicate the presence of a P2P botnet?
Ask The Security Expert: Questions & Answers
EMAIL THIS

What warning signs will indicate the presence of a P2P botnet?

Mike Chapple, featured expert EXPERT RESPONSE FROM: Mike Chapple, featured expert

Pose a Question
Other Security Categories
Meet all Security Experts
Become an Expert for this site


Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   


>
QUESTION POSED ON: 20 June 2008
What are some sure signs that a computer has been connected to a peer-to-peer (P2P) botnet?


BROWSE BY TAG
Network Security,   Information Security Threats,   Emerging Information Security Threats,   Network Intrusion Detection and Analysis,   Enterprise Network Security,   Monitoring Network Traffic and Network Forensics,   VIEW ALL TAGS

Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   


RELATED CONTENT
Network Security
Should enterprises be running multiple firewalls?
What are best practices for fiber optic cable security?
What are the disadvantages of proxy-based firewalls?
What is the difference between a VPN and remote control?
What are the best practices for IPS implementation?
How to prevent DDoS attacks on websites
How to configure firewall ports for webmail system implementation
How should service providers address VoIP security issues and threats?
Can S/MIME, XML and IPsec operate in one protocol layer?
How to set up a corporate cell phone management strategy

Emerging Information Security Threats
DDoS attacks hit U.S., South Korean government websites
New attack code targets Microsoft ActiveX zero-day vulnerability
Adobe ColdFusion websites being compromised
Antispyware buying guide for Indian enterprises
ATM malware lets attackers take over machines
FTC shutters rogue ISP for hosting malicious content, botnets
The failing war against cybercriminals
White House cybersecurity czar faces major hurdles
Cybercrime and threat management
The Pipe Dream of No More Free Bugs

Monitoring Network Traffic and Network Forensics
Chained Exploits: How to prevent phishing attacks from corporate spies
PCI compliance requirement 10: Auditing
Know when you need IDS, IPS or both
An inside look at security log management forensics investigations
How to analyze a TCP and UDP network traffic spike
How to perform a network forensic analysis and investigation
Tying log management and identity management shortens incident response
The telltale signs of a network attack
Cyberattack mapping could alter security defense strategy
Should the government reduce its external Internet connections?

RELATED GLOSSARY TERMS
Terms from Whatis.com − the technology online dictionary
DNS rebinding attack  (SearchSecurity.com)
drive-by pharming  (SearchSecurity.com)
JavaScript hijacking  (SearchSecurity.com)
man in the browser  (SearchSecurity.com)
phlashing  (SearchSecurity.com)
polymorphic malware  (SearchSecurity.com)

RELATED RESOURCES
2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems
Search Bitpipe.com for the latest white papers and business webcasts
Whatis.com, the online computer dictionary


Peer-to-peer (P2P) botnets are the insidious follow-ons to the traditional Internet Relay Chat (IRC) command-and-control botnets of the past. In the IRC model, infected systems connect to an IRC controller network to receive commands from the botnet owner. It became easy to detect these botnets by simply monitoring your network for connections to IRC servers. Botnet owners answered this countermeasure with the introduction of P2P botnets that use encrypted communications within the "cloud" of infected systems, eliminating the need for a centralized controller.

There are two main ways you can detect the presence of a P2P botnet on your system and they're not rocket science. In fact, they're basic security controls that you should be practicing already. First, install and maintain updated antivirus software on your systems. Botnets typically infect systems with outdated antivirus signatures. Second, monitor your host firewall configurations. The typical productivity workstation does not require any inbound access other than any remote administration software in use on your network. P2P botnets must open firewall ports on infected systems to support their participation in the botnet cloud.

More information:




Search and Browse the Expert Answer Center
Search and browse more than 25,000 question and answer pairs from more than 250 TechTarget industry experts.
Browse our Expert Advice



Find Security Solutions for Your Business
Targeted Security Channel Tips for Resellers, Integrators and Consultants
TechTarget Security Media
Information Security View this month\\'s issue and subscribe today.
Information Security Decisions Apply online for free conference admission.
SearchSecurity.com
HomeNewsMagazineMultimediaWhite PapersLearningAdviceTopicsEventsAbout Us

About Us  |  Contact Us  |  For Advertisers  |  For Business Partners  |  Site Index  |  RSS
TechTarget provides technology professionals with the information they need to perform their jobs - from developing strategy, to making cost-effective purchase decisions and managing their organizations' technology projects - with its network of technology-specific websites, events and online magazines.

TechTarget Corporate Web Site  |  Media Kits  |  Site Map




All Rights Reserved, Copyright 2003 - 2009, TechTarget | Read our Privacy Policy
  TechTarget - The IT Media ROI Experts