Botnets and Zero-day attacks

 

🤖 BOTNETS

Definition

A Botnet is a network of infected computers or devices that are controlled remotely by a cybercriminal (called a Botmaster or Controller).

The infected devices are called:

• Bots

• Zombies

These devices work together to perform large-scale cyber attacks.

---

How Botnets Work

1. Attacker spreads malware (virus, worm, trojan).

2. Devices become infected.

3. Malware connects device to Command & Control (C&C) server.

4. Attacker sends commands.

5. All infected devices perform attack simultaneously.

---

What is Command & Control (C&C)?

A server used by attackers to:

• Control infected devices

• Send instructions

• Collect stolen data

---

Common Devices in Botnets

• Personal computers

• Laptops

• Smartphones

• IoT devices (CCTV, routers, smart TVs)

---

Uses of Botnets

🔥 Malicious Uses

• DDoS attacks

• Spam email sending

• Data theft

• Cryptocurrency mining

• Credential stuffing

⚠ Example

If 100,000 infected computers send traffic to one website at the same time, it causes a DDoS attack.

---

Types of Botnet Architecture

1️⃣ Centralized Botnet

• Controlled by one C&C server

• Easier to detect and shut down

2️⃣ Peer-to-Peer (P2P) Botnet

• No central server

• Harder to detect

• More advanced

---

Symptoms of Botnet Infection

• Slow internet

• High CPU usage

• Unknown background processes

• Unusual outgoing traffic

---

Prevention of Botnets

• Install updated antivirus

• Avoid suspicious downloads

• Secure IoT devices

• Change default passwords

• Keep software updated

• Enable firewall

---

⚡ ZERO-DAY ATTACKS

Definition

A Zero-Day Attack is a cyber attack that exploits a software vulnerability that is unknown to the software vendor or developer.

It is called “Zero-Day” because the developer has had zero days to fix the vulnerability.

---

What is Zero-Day Vulnerability?

A security flaw in software that:

• Is unknown to developers

• Has no patch available

• Can be exploited by attackers

---

How Zero-Day Attack Works

1. Attacker discovers unknown vulnerability.

2. Develops exploit code.

3. Launches attack before patch is released.

4. System gets compromised.

---

Why Zero-Day Attacks Are Dangerous

• No security patch available

• Antivirus may not detect it

• Very difficult to defend

• High damage potential

---

Targets of Zero-Day Attacks

• Operating systems

• Web browsers

• Banking software

• Government systems

• Corporate networks

---

Example Scenario

A hacker finds a flaw in a web browser.
Before the company releases an update, the hacker uses that flaw to steal user data.

---

Effects of Zero-Day Attacks

• Data breach

• System compromise

• Financial loss

• Identity theft

• Corporate espionage

---

🔥 Difference Between Botnet and Zero-Day Attack

Feature	Botnet	Zero-Day Attack
Type	Network of infected devices	Exploitation of unknown vulnerability
Main Purpose	Large-scale attacks	Exploit new security flaw
Requires Vulnerability?	Not necessarily	Yes
Detection Difficulty	Moderate	Very High
Damage Level	High	Very High

---

🛡 Prevention and Protection

Against Botnets

• Strong passwords

• IoT security

• Network monitoring

• Anti-malware tools

• Disable unused ports

Against Zero-Day Attacks

• Use intrusion detection systems

• Apply security patches quickly

• Use behavior-based antivirus

• Network segmentation

• Regular vulnerability scanning

---

🎓 Exam Important Short Notes

• Botnet = Network of infected devices controlled remotely.

• Zero-Day Attack = Exploiting unknown software vulnerability.

• Botnets are often used for DDoS attacks.

• Zero-day attacks are dangerous because no patch exists.