Zombies attack! Bot software sounds a bit like a low-budget horror movie, but it's quietly making
trouble and stealing data right now, using millions of PCs worldwide. These malicious pieces of
code, often compared to an undercover army of robots, invade a PC and use its computing power
to do someone else's dirty work most often without the PC owner's knowledge.
The infected PC, known as a zombie, becomes another node on a bot network, typically 2,000 to
10,000 PCs strong, according to Symantec. Unfortunately, a bot network proves a practical tool for
people who want to spread PC viruses and worms, send spam emails, install spyware on PCs, or
carry out denial-of-service attacks on particular Web sites.
Technology publications have been buzzing about the bot threat ever since a flavor called Agobot
took a fast ride through the Internet in April, finding its way into PCs thanks to a Windows
operating system vulnerability. Security experts warn that large networks of Agobot-infected PCs
now sit at the ready, waiting for directions. Have the risks been overblown, or do bots deserve
special scrutiny?
"The risk has been overblown and [bots] deserve special scrutiny," says Bruce Schneier, founder
IEEE Distributed Systems Online June 2004
1
and chief technical officer of Counterpane Internet Security. "They deserve special scrutiny
because their risks are different than normal risks. Bots are risky because they do what they do
automatically, and lots of them can work in tandem. So the relatively minor damage they can do
spam, worms, and so on becomes nasty because a lot of it happens.