What's a botnet? A botnet is a network of computers that have been compromised by malware, and have fallen under the partial control of a nefarious person (or people) someplace. Botnets are used for a variety of purposes. Most often they are used to send out excessive quantities of spam mail out. Less often, but more dangerously, they are used to collect personal information on people for criminals.

Botnets are big business for criminals, according to many security specialists. In a recent article from Dark Reading magazine, Tripp Coxx, vice president of engineering for the company Damballa, outlines the largest three botnets in operation today.

The largest botnet today is still the Storm botnet. Storm became by the largest botnet ever seen, and has "changed the botnet game", according to this recent article. Recent research puts the Storm botnet in control of around 230,000 computers in a typical day. It is a sophisticated creation that infects computers using a combination of worms, rootkits, and trojans, and propagates itself using distributed encrypted communications. This method makes Storm almost impossible to kill, but makes it much easier to trace, on such P2P networks as eDonkey and Overnet.

Most users infected by Storm don't know it. It seems to be under control by a small group of people based in Russia. It is also possible that the 'resources' of the Storm botnet are rented out to interested criminal organizations and parties.

You can read more about Storm from my previous news story here.

The second largest botnet seems to be Rbot. It resides in a much smaller group compared to Storm: apparently around 40,000 computers a day are under Rbot's control.

Rbot is an "old-school" botnet that uses rootkit malware, and spreads of IRC networks. "It's difficult to predict the intent of it. It's a utility bot," said one researcher. "It self-propagates by scanning local networks for exploitable vulnerabilities . . as well as via DDOS attacks and email." Rbot hands almost total control of your computer over, through the use of Backdoor programs. A computer infected by Rbot becomes susceptible to keyloggers, having files stolen, and having their anti-virus software turned off, amongst other things. Because of the nature of Rbot's propagation, it is unlikely ever to get very much larger than it is today.

The third largest botnet has been around for a long time, and called Bobax. It controls roughly 24,000 computers a day. Taking advantage of a buffer overflow vulnerability in Windows, Bobax utilizes backdoor programs to turn infected computers into specialized spam delivery devices. The infection measures network bandwidth, and adjusts itself accordingly, in order to sent out as much traffic as it think it can by with without being very noticeable. Bobax is "able to tailor spamming so as not to tax the network, which helps [it] avoid detection," according to Damballa.

And the situation is far from looking rosy. Damballa's research has lead them to the discovery of a new massive botnet, that may even rival Storm in size. Tripp Coxx did not want to reveal many details at this point, but had this to say: "We're investigating a new peer-to-peer botnet that may wind up rivaling Storm in size and sophistication. We can't say much more about it, but we can tell it's distinct from Storm."

With the massive amounts of money and power afforded by these big botnets, they will undoubtedly become an even more prevalent problem in the next few years to come.