A ‘bot’ – short for robot – is a software program that performs automated, repetitive, pre-defined tasks. Bots typically imitate or replace human user behavior. Because they are automated, they operate much faster than human users. They carry out useful functions, such as customer service or indexing search engines, but they can also come in the form of malware – used to gain total control over a computer.
Internet bots can also be referred to as spiders, crawlers, or web bots.
Computer bots and internet bots are essentially digital tools and, like any tool, can be used for both good and bad.
Good bots carry out useful tasks, however, bad bots – also known as malware bots – carry risk and can be used for hacking, spamming, spying, interrupting, and compromising websites of all sizes. It is estimated that up to half of all internet traffic today is made up of computer bots carrying out certain tasks, such as automating customer service, simulating human communication on social networks, helping companies search online for content and assisting with search engine optimization.
Organizations or individuals use bots to replace repetitive tasks that a human would otherwise have to perform. Tasks run by bots are typically simple and performed at a much faster rate when compared to human activity. Though not all tasks performed by bots are benign – sometimes bots are used for criminal activities such as data theft, scams, or DDoS attacks.
Malware bots and internet bots can be programmed/hacked to break into user accounts, scan the internet for contact information, to send spam, or perform other harmful acts.
To carry out these attacks and disguise the source of the attack traffic, attackers may distribute bad bots in a botnet – i.e., a bot network. A botnet is a number of internet-connected devices, each running one or more bots, often without the device owners’ knowledge. Because each device has its own IP address, botnet traffic comes from numerous IP addresses, making it harder to identify and block the source of the malicious bot traffic. Botnets can often grow themselves by using devices to send out spam emails, which can infect more machines.
One of the most common ways in which bots infect your computer is via downloads. Malware is delivered in download format via social media or email messages that advise clicking a link. The link is often in picture or video form, with either containing viruses and other malware. If your computer is infected with malware, it may be part of a botnet.
A bot can also appear as a warning saying that your computer will get a virus if you do not click on the associated link. Clicking the link subsequently infects your computer with a virus.
While malware bots create problems and issues for organizations, the dangers for consumers include their potential for carrying out data and identity theft, keylogging sensitive information such as passwords, bank details and addresses, and phishing.
Malicious bots can easily go unnoticed. They are easily hidden within a computer and often have file names and processes similar if not identical to regular system files or processes.
Examples of malicious bots include:
Spambots may harvest email addresses from contact or guestbook pages. Alternatively, they may post promotional content in forums or comment sections to drive traffic to specific websites.
Dating service websites and apps are havens for malicious chatterbots. These chatterbots pretend to be a person, emulating human interaction, and often fool people who don’t realize they are chatting to harmful programs whose goal is to obtain personal information, including credit card numbers, from unsuspecting victims.
These bots take the users’ query term (such as a popular movie or artist’s album) and respond to the query stating that they have the file available for download, providing a link. The user clicks on the link, downloads, and opens it, and unknowingly infects their computer.
This refers to bots “stuffing” known usernames and passwords (usually sourced from data breaches) into online log-in pages to gain unauthorized access to user accounts.
This is where excessive bot traffic is intentionally used to overwhelm a server’s resources and prevent a service from operating.
These attacks target online shops to list their products as ‘not available’. In this type of attack, malicious bots access the shopping cart, select items from the online store, and add them to the shopping cart, never completing the transaction. As a result, when a legitimate user wants to buy the product, they receive an out-of-stock message, even if the item is in stock.
Bots which scan millions of sites for vulnerabilities and report them back to their creator are known as vulnerability scanners. Unlike genuine bots that would inform the website owner, these malicious bots are specifically made to report back to one person who then sells the information or uses it themselves to hack websites.
These bots produce a huge amount of malicious bot traffic specifically targeting paid ads to engage in ad fraud. Responsible for fraudulently clicking paid ads, this non-human traffic costs advertisers billions every year and is often disguised as legitimate traffic. Without good bot detection software, this bot activity can cost advertisers a large proportion of their ad budget.
Bots which are used for overloading mail servers or carrying out large-scale data theft.
Hackers may use botnets to send phishing or other scams to trick consumers into giving away their money. They may also collect information from the bot-infected machines and use it to steal identities and incur loans or purchase charges in the user’s name.
Criminals may use botnets to create DoS and DDoS attacks that flood a legitimate service or network with a crushing volume of traffic. The volume may severely slow down the company’s service or network’s ability to respond, or it may entirely overwhelm the company’s service or network and shut them down.
Revenue from DoS attacks comes through extortion (i.e., pay or have your site taken down) or through payments by groups interested in inflicting damage to a company or network. These groups include "hacktivists" — hackers with political agendas as well as foreign military and intelligence organizations.
Cybercriminals may also lease their botnets to other criminals who want to send spam, scams, phishing, steal identities, and attack legitimate websites and networks.
Aside from malware bots, what do bots do? There are many different types:
Bots that simulate human conversation by responding to certain phrases with programmed responses.
Bots which operate on social media platforms, and are used to automatically generate messages, advocate ideas, act as a follower of users, and as fake accounts to gain followers themselves. As social networks become more sophisticated, it is becoming harder for social bots to create fake accounts. It is difficult to identify social bots because they can exhibit similar behavior to real users.
Bots that shop around online to find the best price for products a user is looking for. Some bots can observe a user’s patterns in navigating a website and then customize that site for the user.
Bots that read data from websites with the objective of saving them offline and enabling their reuse. This may take the form of scraping the entire content of web pages or scraping web content to obtain specific data points, such as names and prices of products on e-commerce websites.
Bots that collect knowledge for users by automatically visiting websites to retrieve information which fulfils certain criteria.
Bots used to monitor the health of a website or system. Downdetector.com is an example of an independent site that provides real-time status information, including outages, of websites and other kinds of services.
Bots used to complete transactions on behalf of humans. For example, transactional bots allow customers to make a transaction within the context of a conversation.
Bots that are used to automatically download software or mobile apps. They can be used to manipulate download statistics – for example, to gain more downloads on popular app stores and help new apps appear at the top of the charts.
They can also be used to attack download sites, creating fake downloads as part of a Denial of Service (DoS) attack.
Bots which automatically purchase tickets to popular events, with the aim of reselling those tickets for a profit. This activity is illegal in many countries, and even when not against the law, it can be a nuisance to event organizers, legitimate ticket sellers, and consumers. Ticketing bots are often sophisticated, emulating the same behaviors as human ticket buyers.
Typically, bots operate over a network. Bots that can communicate with one another will use internet-based services to do so – such as instant messaging, interfaces like Twitterbots or through Internet Relay Chat (IRC).
Bots are made from sets of algorithms which help them to carry out their tasks. The different types of bots are designed differently to accomplish a wide variety of tasks.
Take chatbots as one example – they have different methods of operation:
There are pros and cons to each – organizations which use bots will decide which approach is best based on their requirements.
Computer and internet bots - Pros:
Computer and internet bots - Cons:
The range and variety of bots mean they are used across a wide range of areas, such as customer service, business, search functionality, and entertainment.
Examples of well-known services which use bots include:
Ways in which you can tell if your computer is part of a botnet include:
If your computer is already infected by bots, the most important consideration is protecting your data.
Here are some steps to take:
Step 1: Disconnect your computer from the network as soon as possible – this will stop the theft of sensitive information and prevent your computer from being used to attack other networks.
Step 2: Move all important or personal data to another computer or an external hard drive. Ensure these are malware-free before you do.
Step 3: Carry out a factory reset of your machine (bear in mind that as well as targeting the problem, it will also remove files and programs you have created, delete drivers, and return settings to their defaults)
Step 4: Clean your computer using various security tools or by asking a professional to work on the device
Remember, prevention is the best cure when it comes to bots and all other forms of malware. So, it’s important to have cybersecurity installed on all your devices.
The difficulty for consumers is that many online customer touchpoints – including websites, mobile apps, and APIs – are being attacked by bots. It is possible to protect your computer from bots, but it requires vigilance and knowing what to look for.
Here are some steps to take to protect your systems from botnet infiltration:
Use comprehensive anti-malware software to protect your device. For example, Kaspersky Total Security blocks viruses and malware in real-time and stops hackers from taking over your PC remotely. Make sure your anti-virus and anti-spyware programs are set to update automatically.
Never ignore system updates. Routinely check for browser and operating system updates and patches.
A strong password is difficult to guess and includes a combination of uppercase and lowercase letters plus numbers and symbols. Avoid using the same password for multiple accounts. We recommend using a secure password manager tool.
Only click internet links or open emails if you trust the source. Common user risks occur when downloading content from unknown sites or from friends who don't have up-to-date protections and unwittingly pass infected files to other users.
Always use extreme caution when downloading information or files from someone whose computer is not protected. Avoid using flash drives, or thumb drives, in an infected computer.
A common way users are tricked into downloading malware bots is through intriguing ads or downloads they come across during web browsing. Be cautious about downloading free versions of software from websites you don’t recognize, and never click on pop-up ads that claim only they can fix your computer’s performance or virus issues. In many cases, interacting with these pages will trigger a malware installation on your computer.
A firewall can help to block malicious attacks.
Organizations can stop malicious bots by using a bot manager. Bot managers can be included as part of a web app security platform.
A bot manager can be used to allow the use of some bots and block the use of others that might cause harm to a system. To do this, a bot manager will classify any incoming requests by humans and good bots and known malicious and unknown bots. Any suspect bot traffic is then directed away from a site by the bot manager.
Some basic bot management feature sets include IP rate limiting and CAPTCHAs. IP rate limiting will limit the number of same-address-requests, while CAPTCHAs often use a puzzle to differentiate bots from humans.
Remember, good bots are a crucial part of the internet’s infrastructure and perform many useful tasks. But bad bots are difficult to detect without an anti-virus program because they are designed to hide in plain sight. So, it is important to be aware of the risks posed by malicious bots, and practice good cybersecurity at all times.