A botnet is a group of computers or other devices that one operator can direct together, whether or not the people who own those devices know about the control.
This article is about that pool of devices, not about a particular campaign those devices might later carry out.
How it works
Devices join the pool after a person is tricked, after a device is left open, or after someone rents access that already exists.
The operator then treats the pool as capacity: many small machines that can log in, browse, or send traffic under remote direction.
Size and diversity matter because the devices sit in homes, offices, and sometimes inside cloud accounts.
Defenders who only picture one hostile server will miss a crowd of ordinary looking machines that share a hidden coordinator.
Concrete examples
- Thousands of home routers answer to the same coordinator and can each open a browser session when instructed.
- A cloud account that was left with weak keys becomes one more worker in a pool the account owner did not plan.
- A rented pool is handed from one operator to another, while the devices themselves stay in the original homes and offices.
Protective measures
- Patch network devices and computers that sit online all day, because they are attractive workers in someone else's pool.
- Replace default passwords on routers, cameras, and other appliances, and turn off remote admin you do not need.
- Watch for many internal devices that suddenly share the same unusual outbound destination.
- Segment guest and facilities networks so a compromised camera cannot freely reach finance systems.
How CDPCaptcha helps
Browser proof of work raises the operating cost of coordinated automation by making each participating client spend additional computation on the page.
CDPCaptcha is a self-hosted proof of work check in the browser, with no cookies, no tracking, and no picture puzzles.
It is made and hosted in the EU, in Germany, and the service is described at https://cdpcaptcha.com/.