Zombie (computer science)

In computing, a zombie is a computer connected to the Internet that has been compromised by a hacker via a computer virus, computer worm, or trojan horse program and can be used to perform malicious tasks under the remote direction of the hacker. Zombie computers often coordinate together in a botnet controlled by the hacker, and are used for activities such as spreading e-mail spam and launching distributed denial-of-service attacks (DDoS attacks) against web servers. Most victims are unaware that their computers have become zombies. The concept is similar to the zombie of Haitian Voodoo folklore, which refers to a corpse resurrected by a sorcerer via magic and enslaved to the sorcerer's commands, having no free will of its own. A coordinated DDoS attack by multiple botnet machines also resembles a "zombie horde attack", as depicted in fictional zombie films.

Advertising

Zombie computers have been used extensively to send e-mail spam; as of 2005, an estimated 50–80% of all spam worldwide was sent by zombie computers. This allows spammers to avoid detection and presumably reduces their bandwidth costs, since the owners of zombies pay for their own bandwidth. This spam also greatly increases the spread of Trojan horses, as Trojans are not self-replicating. They rely on the movement of e-mails or spam to grow, whereas worms can spread by other means. For similar reasons, zombies are also used to commit click fraud against sites displaying pay-per-click advertising. Others can host phishing or money mule recruiting websites.

Distributed denial-of-service attacks

Zombies can be used to conduct distributed denial-of-service (DDoS) attacks, a term which refers to the orchestrated flooding of target websites by large numbers of computers at once. The large number of Internet users making simultaneous requests of a website's server is intended to result in crashing and the prevention of legitimate users from accessing the site. A variant of this type of flooding is known as distributed degradation-of-service. Committed by "pulsing" zombies, distributed degradation-of-service is the moderated and periodical flooding of websites intended to slow down rather than crash a victim site. The effectiveness of this tactic springs from the fact that intense flooding can be quickly detected and remedied, but pulsing zombie attacks and the resulting slow-down in website access can go unnoticed for months and even years.

The computing facilitated by Internet of Things (IoT) has been productive for modern day usage but it has played a significant role in the increase in such web attacks. The potential of IoT enables every device to communicate efficiently but this increases the need of policy enforcement regarding the security threats. Through these devices, the most prominent attacking behaviors is the DDoS. Research has been conducted to study the impact of such attacks on IoT networks and their compensating provisions for defense.

Notable incidents of distributed denial- and degradation-of-service attacks in the past include the attack upon the SPEWS service in 2003, and the one against Blue Frog service in 2006. In 2000, several prominent Web sites (Yahoo, eBay, etc.) were clogged to a standstill by a distributed denial of service attack mounted by ‘ MafiaBoy’, a Canadian teenager.

Smartphones

Beginning in July 2009, similar botnet capabilities have also emerged for the growing smartphone market. Examples include the July 2009 in the "wild" release of the Sexy Space text message worm, the world's first botnet capable SMS worm, which targeted the Symbian operating system in Nokia smartphones. Later that month, researcher Charlie Miller revealed a proof of concept text message worm for the iPhone at Black Hat Briefings. Also in July, United Arab Emirates consumers were targeted by the Etisalat BlackBerry spyware program. In the 2010s, the security community is divided as to the real world potential of mobile botnets. But in an August 2009 interview with ''The New York Times'', cyber security consultant Michael Gregg summarized the issue this way: "We are about at the point with marthones that we were with desktops in the '80s."

See also

* BASHLITE
* Botnet
* Denial-of-service attack
* Low Orbit Ion Cannon
* Malware
* RDP shop
* Trojan horse (computing)

References

External links

Botnet operation controlled 1.5 million PCsIntrusive analysis of a web-based proxy zombie network
* ttp://radsoft.net/news/roundups/grc/wkd/ Correspondence between Steve Gibson and Wickedbr>Zombie networks, comment spam, and referer [sic] spamThe New York Times: Phone Hacking Threat is Low, But It ExistsHackers Target Cell Phones, WPLG-TV/ABC-10 MiamiResearcher: BlackBerry Spyware Wasn’t Ready for Prime TimeSMobile Systems release solution for Etisalat BlackBerry spyware

LOIC IRC-0 - An Open-Source IRC Botnet for Network Stress Testing

An Open-Source IRC and Webpage Botnet for Network Stress Testing
{{Malware
Computer network security
Denial-of-service attacks
Zombies
Botnets