What Is Botnet?

A botnet is a collection of compromised devices under common control, used to perform work at scale — denial of service attacks, credential testing, spam distribution, proxying malicious traffic, or mining.

There are two distinct concerns: being attacked by one, and unknowingly contributing devices to one. The second is more common and receives far less attention.

What they are used for

Distributed denial of service, which is the best-known use. Credential stuffing, where many addresses defeat rate limiting.

Residential proxy services, where compromised home connections are rented out so that malicious traffic appears to originate from ordinary consumers. That last use is commercially significant and is why compromised consumer devices have value.

Connected devices are the preferred population

Cameras, recorders, routers, printers and embedded controllers are numerous, permanently connected, frequently unpatchable and commonly shipped with default credentials.

They are also rarely monitored. A compromised camera generates no user complaint, appears in no endpoint console, and continues working normally, which is why infections on this population persist for years.

Your devices participating is your problem

The consequences are practical: your addresses appear on reputation blocklists, which affects mail delivery and can affect customers. Your connection capacity is consumed. And you may face questions about attacks that appeared to originate from you.

It also indicates a compromised device on your network with external control, which is a foothold regardless of what it is currently being used for.

Detecting participation

Outbound connections from devices that should not initiate any. Traffic patterns inconsistent with the device's purpose — a camera making thousands of connections, a printer resolving unfamiliar names.

Periodic beaconing to consistent destinations. Appearance of your addresses on reputation blocklists, which is worth monitoring because it is frequently the first indication.

Preventing enrolment

Change default credentials, which remains the single highest-value action for this population. Restrict devices to the network flows they legitimately need, particularly outbound.

Segment them away from everything else. Keep firmware current where the manufacturer supports it, and treat the absence of firmware updates as a procurement criterion for anything expected to remain in service for years. See IoT security.

When one is pointed at you

Being the target rather than a participant is a capacity problem, and it is not solved at your own perimeter — a large volumetric attack saturates your connection before your equipment sees it.

That makes upstream mitigation the only workable answer: a provider or network service that absorbs volume before it reaches you. The decision worth making in advance is whether that capability is contracted and how quickly it can be engaged, because arranging it during an attack takes longer than the attack lasts.

Takedown efforts by law enforcement and researchers disrupt these networks periodically, and they reform. That is worth knowing because a public takedown announcement is a poor reason to relax: the compromised devices usually remain compromised, and a new controller frequently reclaims them within weeks.

Where to start

Check whether your cameras, printers and embedded devices can make arbitrary outbound connections to the internet. In most networks they can, and they have no reason to.

See protecting connected devices. GuardsArm runs security program reviews.