What a Botnet Looks Like

Esther Schindler writes "CSO has an annotated, zoomable map of real botnet topologies showing the interconnections between the compromised computers and the command-and-control systems that direct them. The map is based on work by security researcher David Voreland; it has interactive controls so you can zoom in and explore botnets' inner workings. Hackers use botnets for spamming, DDoS attacks and identity theft. One recent example is the Storm botnet, which may have comprised 1 million or more zombie systems at its peak. As with any networking challenge, there are good (resilient) designs and some not-so-good ones. In some cases the topology may be indicative of a particular botnet's purpose, or of a herder on the run."

Comments

Flash site, very funny.

[inTheLoo]

To get a good look at a botnet they say, "You need to upgrade your Flash Player". How true!

What a Botnet Looks Like

[sm62704]

here's a photo of a botnet. Ok, it's a small botnet but if the botnet was a semi you wouldn't see the computers, now would you?

reminds of the sexual partners mapping...

[Anonymous Coward]

http://www.artsci.washington.edu/news/Autumn05/largermap_sexualnetworks.htm

Ob. XKCD reference

[DrYak]

Ok, it's a small botnet Randall Munroe's botnet look like that.

Check out the losers

[Hoplite3]

There are lots of well constructed stars, where a handful of master nodes control several slaves. Each slave knows two or three masters for redundancy. That's good design, and I expected it.

But what's hilarious is that there are some ip addresses that are slaves to four or five different botnets. I wonder what the owners of those machines think?

"Man, the internet sure is slow today!"

"I need a new computer, this one's all slow."

"Sweet! Five botnets and counting! I'm part of something! I belong!"

Re:Check out the losers

[Esther Schindler]

I do know what those users think, and it's very much like you posited: "My computer has become unusably slow, and I don't know why or how to fix it!" Unfortunately that was followed by, "Aunt Esther, can you tell me what's wrong?"—and thus I spent half a day killing enough of the junk that I could install a firewall, antivirus, etc.

People like my nephew aren't unwilling to learn. They're just lost when it comes to their computers. And they don't particularly mind being ignorant as long as the equipment works right (or appears to). Just as most of us don't feel the need to understand how a car works in order to drive one.

Some of us remember the days when we wistfully wanted computers to become easy enough for ordinary people to use them. Alas, we got our wish.

Re:Anonymous Coward

[Anonymous Coward]

No, it sucks. I zoomed in to close and saw my IP!

Re:Thanks for posting...

[multipartmixed]

I don't think you'd want to do that.

My current RBL has about 6.5 million entries, and is extremely permissive. It is also updated bi-hourly.

I sure wouldn't want my machine to traverse a hosts table of 7 million hosts every time I tried to look up a name in the DNS.

Same for your firewall, 7 million entries will cripple iptables. Hell, 30,000 entries causes visible slowness on a dual-core opteron system.

Of course, you might get better performance out of iptables with the ipsets kernel patch. But that's still a damned big list.