1
00:00:00,120 --> 00:00:01,020
In this lesson,

2
00:00:01,020 --> 00:00:03,360
we're going to explore botnets and zombies.

3
00:00:03,360 --> 00:00:05,820
Now, a botnet is a network of compromised computers

4
00:00:05,820 --> 00:00:08,460
or devices controlled remotely by malicious actors

5
00:00:08,460 --> 00:00:09,293
and they're often used

6
00:00:09,293 --> 00:00:11,730
for cyber attacks or other malicious activities.

7
00:00:11,730 --> 00:00:14,250
A botnet is created by using other types of malware

8
00:00:14,250 --> 00:00:16,560
to gain access to a system, victimize it,

9
00:00:16,560 --> 00:00:18,000
and then add it to the botnet

10
00:00:18,000 --> 00:00:19,680
so the attacker who controls the botnet

11
00:00:19,680 --> 00:00:21,870
can use the processing, memory, storage,

12
00:00:21,870 --> 00:00:24,120
or networking capabilities of your system

13
00:00:24,120 --> 00:00:25,680
without your consent.

14
00:00:25,680 --> 00:00:28,110
Now each botnet is made up of hundreds, thousands,

15
00:00:28,110 --> 00:00:30,090
or even millions of compromised systems

16
00:00:30,090 --> 00:00:31,860
which we call zombies.

17
00:00:31,860 --> 00:00:33,180
Now, a zombie is simply the name

18
00:00:33,180 --> 00:00:34,770
of a compromised computer or device

19
00:00:34,770 --> 00:00:35,970
that is part of a botnet

20
00:00:35,970 --> 00:00:38,040
and used to perform tasks using remote commands

21
00:00:38,040 --> 00:00:40,800
from the attacker without the user's knowledge.

22
00:00:40,800 --> 00:00:42,630
So what happens to your computer

23
00:00:42,630 --> 00:00:44,520
if it becomes the victim of a botnet?

24
00:00:44,520 --> 00:00:45,780
Well, let's pretend that your computer

25
00:00:45,780 --> 00:00:48,330
picked up some kind of malware and that malware was designed

26
00:00:48,330 --> 00:00:50,520
to change your computer into a zombie.

27
00:00:50,520 --> 00:00:51,720
Your single workstation,

28
00:00:51,720 --> 00:00:53,490
which is now considered to be a zombie,

29
00:00:53,490 --> 00:00:55,200
is then added to the larger botnet

30
00:00:55,200 --> 00:00:57,270
as part of a collection of compromised computers

31
00:00:57,270 --> 00:00:59,460
under the control of a master node.

32
00:00:59,460 --> 00:01:01,230
If your computer is now a zombie,

33
00:01:01,230 --> 00:01:03,870
your system will now be under the control of the attacker

34
00:01:03,870 --> 00:01:06,360
and that attacker can use a command and control node,

35
00:01:06,360 --> 00:01:08,880
known as a C2 node, to control all the zombies

36
00:01:08,880 --> 00:01:10,950
inside of their specific botnet.

37
00:01:10,950 --> 00:01:13,170
Now, by sending commands to their C2 node,

38
00:01:13,170 --> 00:01:14,430
the attacker can tell the zombies

39
00:01:14,430 --> 00:01:16,020
to perform lots of different things,

40
00:01:16,020 --> 00:01:17,655
including using zombies as pivot points

41
00:01:17,655 --> 00:01:20,010
so they can get access to a new victim,

42
00:01:20,010 --> 00:01:21,750
or if they're attacking a server,

43
00:01:21,750 --> 00:01:23,670
they can actually access it through your computer

44
00:01:23,670 --> 00:01:25,680
to make it look like you're the one doing the attack

45
00:01:25,680 --> 00:01:27,870
or the hack instead of the actual attacker

46
00:01:27,870 --> 00:01:30,720
who sent the command through their master C2 node.

47
00:01:30,720 --> 00:01:33,240
Other attacks will try to create large botnets

48
00:01:33,240 --> 00:01:34,470
so they can store illegal content

49
00:01:34,470 --> 00:01:36,330
across a large number of devices.

50
00:01:36,330 --> 00:01:39,270
For example, if somebody wants to host child pornography,

51
00:01:39,270 --> 00:01:40,890
but they're afraid of getting caught with it,

52
00:01:40,890 --> 00:01:42,690
they can store their illegal videos and photos

53
00:01:42,690 --> 00:01:45,570
across hundreds or thousands of affected machines

54
00:01:45,570 --> 00:01:46,770
inside of this botnet.

55
00:01:46,770 --> 00:01:49,650
Another common use of botnets is use them to spam others

56
00:01:49,650 --> 00:01:52,230
by sending out phishing campaigns and other malware

57
00:01:52,230 --> 00:01:54,330
to their targets around the world.

58
00:01:54,330 --> 00:01:56,880
But, by far, the most common use of a botnet

59
00:01:56,880 --> 00:01:58,830
is to conduct a DDoS attack

60
00:01:58,830 --> 00:02:01,680
which is known as a Distributed Denial of Service attack.

61
00:02:01,680 --> 00:02:03,480
Now, a Distributed Denial of Service attack,

62
00:02:03,480 --> 00:02:05,010
known as a DDoS,

63
00:02:05,010 --> 00:02:07,140
will occur anytime you have a lot of machines

64
00:02:07,140 --> 00:02:08,729
targeting a single victim

65
00:02:08,729 --> 00:02:11,340
and then attacking them all at the same time.

66
00:02:11,340 --> 00:02:12,960
Now, let's assume that I'm a threat actor,

67
00:02:12,960 --> 00:02:15,420
and I have control over 100,000 machines

68
00:02:15,420 --> 00:02:16,860
as part of my botnet.

69
00:02:16,860 --> 00:02:19,230
If I wanted to take down your organization's website,

70
00:02:19,230 --> 00:02:22,740
I can use my C2 node to order all 100,000 zombies

71
00:02:22,740 --> 00:02:25,530
in my botnet to target your victimized server

72
00:02:25,530 --> 00:02:27,060
and make requests to it repeatedly

73
00:02:27,060 --> 00:02:29,220
until the amount of load is so much

74
00:02:29,220 --> 00:02:31,650
that it forces your web server offline.

75
00:02:31,650 --> 00:02:34,710
Essentially, your organization can't handle all the load

76
00:02:34,710 --> 00:02:35,580
that I'm sending to it,

77
00:02:35,580 --> 00:02:37,470
and so the web server will actually crash

78
00:02:37,470 --> 00:02:39,090
and not be able to perform its function

79
00:02:39,090 --> 00:02:41,640
for your legitimate users or customers.

80
00:02:41,640 --> 00:02:43,320
Since around 2015 though,

81
00:02:43,320 --> 00:02:45,180
many threat actors have begun to use botnets

82
00:02:45,180 --> 00:02:46,980
to make money by using their zombies

83
00:02:46,980 --> 00:02:49,650
to do processor intensive things like crypto mining

84
00:02:49,650 --> 00:02:51,090
on their behalf too.

85
00:02:51,090 --> 00:02:54,030
So if an attacker can get 10,000 or a 100,000 zombies

86
00:02:54,030 --> 00:02:55,260
as part of their botnet,

87
00:02:55,260 --> 00:02:56,580
they can command those zombies

88
00:02:56,580 --> 00:03:00,000
to give you 20 to 25% of their available processing power

89
00:03:00,000 --> 00:03:01,860
so they can continually mine cryptocurrency

90
00:03:01,860 --> 00:03:04,800
in the background without your knowledge or consent.

91
00:03:04,800 --> 00:03:06,870
Now, by doing this, they can have a lot of zombies

92
00:03:06,870 --> 00:03:08,670
working in parallel to mine coins

93
00:03:08,670 --> 00:03:10,860
that can be stored in the attacker's digital wallet

94
00:03:10,860 --> 00:03:12,510
by redirecting the gain coins

95
00:03:12,510 --> 00:03:14,700
through their command and control nodes.

96
00:03:14,700 --> 00:03:16,530
Another use of botnets by attackers

97
00:03:16,530 --> 00:03:18,480
is use this combined processing power

98
00:03:18,480 --> 00:03:20,850
to break through different types of encryption schemes.

99
00:03:20,850 --> 00:03:22,680
Here again, the attacker is trying to gather

100
00:03:22,680 --> 00:03:24,420
as many zombies as possible

101
00:03:24,420 --> 00:03:26,820
to add them to this distributed computational network

102
00:03:26,820 --> 00:03:27,960
in order to use some of each

103
00:03:27,960 --> 00:03:29,610
of the zombies' processing capabilities

104
00:03:29,610 --> 00:03:32,130
to brute force different encryption schemas.

105
00:03:32,130 --> 00:03:33,450
Now, to avoid detection,

106
00:03:33,450 --> 00:03:35,130
attackers will usually not take up all

107
00:03:35,130 --> 00:03:36,360
of your computing power

108
00:03:36,360 --> 00:03:39,180
but instead they'll usually use 20 or 25%

109
00:03:39,180 --> 00:03:40,890
of your available processing power,

110
00:03:40,890 --> 00:03:42,990
so it takes you a little bit longer to detect that,

111
00:03:42,990 --> 00:03:44,700
and that way you don't realize your machine

112
00:03:44,700 --> 00:03:45,840
has been compromised.

113
00:03:45,840 --> 00:03:47,910
After all, if I broke into your machine

114
00:03:47,910 --> 00:03:50,730
and took over 90 to a 100% of your processing power,

115
00:03:50,730 --> 00:03:53,400
your computer would fail to respond to your own requests,

116
00:03:53,400 --> 00:03:55,440
and then you'll start looking for the cause of that,

117
00:03:55,440 --> 00:03:56,730
which would, in this case,

118
00:03:56,730 --> 00:03:59,460
find that you are now part of my botnet as a zombie.

119
00:03:59,460 --> 00:04:01,770
And so most attackers aren't going to be greedy

120
00:04:01,770 --> 00:04:04,260
and they're not going to try to use up all 90 to 100%

121
00:04:04,260 --> 00:04:05,520
of your processing power,

122
00:04:05,520 --> 00:04:08,010
and they'll stick with only 20 to 25%

123
00:04:08,010 --> 00:04:10,290
across hundreds or thousands of zombies

124
00:04:10,290 --> 00:04:12,570
to still have a great computational network

125
00:04:12,570 --> 00:04:15,180
and tons of processing power at their disposal

126
00:04:15,180 --> 00:04:17,790
for all the malicious or nefarious things they want to do,

127
00:04:17,790 --> 00:04:20,190
like conducting Distributed Denial of Service attacks

128
00:04:20,190 --> 00:04:22,620
or making money through crypto mining.

129
00:04:22,620 --> 00:04:24,480
So remember, botnets and zombies

130
00:04:24,480 --> 00:04:27,540
are used to create large networks of compromised machines.

131
00:04:27,540 --> 00:04:30,480
A botnet is a network of compromised computers or devices

132
00:04:30,480 --> 00:04:32,610
that are controlled remotely by a malicious actor

133
00:04:32,610 --> 00:04:34,320
and they're often used for cyber attacks

134
00:04:34,320 --> 00:04:36,030
or other malicious activities.

135
00:04:36,030 --> 00:04:37,320
A zombie, on the other hand,

136
00:04:37,320 --> 00:04:39,840
is the name of a single compromised computer or device

137
00:04:39,840 --> 00:04:40,980
that's part of the botnet

138
00:04:40,980 --> 00:04:43,290
and it's used to perform the task using remote commands

139
00:04:43,290 --> 00:04:45,900
from the attacker without the user's knowledge.

140
00:04:45,900 --> 00:04:47,160
These botnets are used

141
00:04:47,160 --> 00:04:49,800
to create large distributed computing capabilities

142
00:04:49,800 --> 00:04:50,910
that can be used by an attacker

143
00:04:50,910 --> 00:04:53,250
to conduct a Distributed Denial of Service attack,

144
00:04:53,250 --> 00:04:55,890
for crypto mining, or breaking encryption,

145
00:04:55,890 --> 00:04:57,630
depending on the needs of that attacker

146
00:04:57,630 --> 00:04:58,620
and the commands they send

147
00:04:58,620 --> 00:05:00,570
through their command and control node.