ITPEC FE Morning April 2019 Question 42

Internet-connected devices infected and controlled by common malware — a botnet is a network of compromised machines that an attacker commands remotely.

Each infected device, a PC, router, camera or other IoT device, runs a bot program that connects to the attacker's command and control (C&C) server and waits for orders. The attacker then uses the whole group at once for DDoS attacks, spam, credential stuffing or cryptocurrency mining, usually without the owners noticing. Weakly protected IoT devices with default passwords are a favourite target, as the Mirai botnet showed.

Answer (a)

Why not others:

• •(b) — describes connected self-driving vehicles (V2V communication), a legitimate safety network with no malware involved
• •(c) — describes a honeynet, a set of honeypots that defenders deploy to lure and study attackers; the opposite side of the fight
• •(d) — describes an industrial wireless network for factory robots, a legitimate IIoT setup

Key rule: A network of devices is a botnet only when the devices are infected and remotely controlled by an attacker; "network of devices" alone is not enough.

Security · AI-written, may contain errors