Botnets Built from Connected Devices

What a botnet is

A botnet is a group of internet-connected devices that have been taken over by one party and can be told to act together. The owners usually have no idea. Each compromised device is sometimes called a bot, and the person controlling the group is often called a botmaster or operator.

The word has been around for decades and first described infected personal computers. Connected devices such as home routers, cameras and recorders became attractive additions because they are numerous, always on, usually connected to fast home internet and rarely checked. Descriptions of device botnets in security reports typically involve thousands to very large numbers of devices, though exact sizes vary by case and are hard to measure.

How devices get recruited

Recruitment is mostly automated. Software scans the internet for devices that are reachable and tries to get in. The usual routes are:

• Factory-set logins. The scanner tries lists of well-known usernames and passwords. A device whose owner never changed its default passwords can be taken over within minutes of being connected.
• Known software flaws. If a device runs old software with a published flaw, automated tools can exploit it without needing any login.
• Exposed management pages. Remote access features left open to the internet give the scanner something to try.

After getting in, the malicious software installs itself, often only in memory, and contacts a control server to wait for instructions. Many such programs also start scanning for new victims, so a single infected device helps recruit others. Some remove competing malware so the device stays under one operator’s control.

Notably, nothing about the owner’s behavior needs to be unusual. The device was simply reachable and poorly protected.

What the pooled devices are used for

Botnets are tools, and the controller can use them for different purposes:

• Distributed denial-of-service (DDoS) attacks. Thousands of devices send traffic at one target at the same time, overwhelming it so real users cannot get through. Because the traffic comes from many ordinary addresses, it is hard to block by simply banning one source.
• Sending spam or scams. Compromised devices can relay unwanted messages, which helps hide the true sender.
• Hiding other activity. Traffic can be routed through a device so it appears to come from a home connection rather than the attacker.
• Guessing credentials elsewhere. Bots may try logins against other services.
• Renting out access. Some operators are described as selling or leasing capacity to others, though specifics differ and are hard to verify.

Many of these uses affect other people more than the device owner. That is part of why the problem persists: the cost lands on someone else.

Signs an owner might notice

Many infected devices show no symptoms at all, which is the point. Still, a few clues can show up:

• The device or home internet is noticeably slower than usual, especially when no one is using it.
• A camera, recorder or router becomes sluggish, restarts unexpectedly or overheats.
• Settings change without explanation, such as a password that no longer works or a changed DNS setting.
• The router’s traffic or connection list shows heavy outgoing activity from a device that should be idle.
• Your internet provider sends a notice about unusual traffic from your connection.
• The device’s admin page reports unfamiliar accounts or remote sessions.

None of these proves infection. Slowness can be caused by Wi-Fi congestion, an overloaded plan or a failing device. Still, a pattern such as repeated restarts plus unexpected outgoing traffic is worth investigating. Watching for unusual device behavior is a simple form of anomaly detection that routers and network tools sometimes automate.

What to do if you suspect one

1. Disconnect the device from the network and power it off for a moment.
2. Check the maker’s guidance, then perform a factory reset. Many bots live only in memory, so a reboot can remove them, but a device that is still reachable and still has the old password can be reinfected quickly.
3. Before reconnecting, set a unique strong password, install the latest firmware updates and turn off remote access you do not need.
4. Change the router’s admin password as well, since routers are common targets.
5. If the device no longer receives updates, consider replacing it.

How to avoid joining one

The same basics that protect against most attacks apply. Change factory logins, keep software current, avoid exposing devices directly to the internet, and put gadgets on their own part of the network through network segmentation so an infected camera cannot easily reach computers. When buying, favor makers that publish how long they provide security updates.

Makers and regulators share the responsibility. Requirements such as unique per-device passwords and a way to report vulnerabilities are increasingly discussed in device regulation, though what applies depends on the region.

A note on proportion

Being part of a botnet rarely harms the owner directly, which makes it easy to ignore. But a device under someone else’s control can also be used to look at your network or data. Treating it as a hygiene issue, like locking a door, is a sensible way to think about it. The goal is to be a harder target than the many devices that never get touched.