What is a botnet? A plain explanation for beginners

News stories say a botnet knocked a website offline, or that thousands of home cameras were hijacked at once. So what is a botnet? It is a network of computers and other devices that criminals have taken over without the owners knowing, so that one person can give all of them orders at the same time.

This guide explains what a botnet is in plain words, how ordinary devices get pulled into one, what botnets are used for, and why owners rarely notice. It uses the definitions from the US National Institute of Standards and Technology (NIST) and the Cybersecurity and Infrastructure Security Agency (CISA), and ends with the free browser game Tank City Reboot, where a botnet is an enemy you have to fight.

What is a botnet? The short definition

NIST's glossary entry for botnet starts with the name: it is formed from the words "robot" and "network". Criminals use trojans, harmful programs disguised as something useful, to break into many people's computers, take control of each one, and organize the infected machines into a network of "bots" that the criminal can manage remotely.

Each infected device is a bot. On its own, one bot is not much. The power of a botnet comes from numbers: thousands of devices doing the same thing at the same moment, all on one person's command.

How devices get recruited

CISA's guide to denial-of-service attacks describes a botnet as a group of hijacked internet-connected devices. Attackers take advantage of security holes or weak points in those devices to control large numbers of them with what it calls command and control software, the program the criminal uses to send orders.

The weak points are often simple:

• Malware that was run by mistake, such as a trojan inside a download, as in NIST's definition.
• Security flaws that were never fixed, on devices that missed their updates.
• Default passwords. CISA notes that internet-connected gadgets, the Internet of Things, often still use the password they came with from the factory, and often lack sound security.

Botnets are not only made of laptops. Cameras, routers and other small connected devices count too, and they are often easier to take over.

What botnets are used for

The use CISA describes in most detail is the distributed denial-of-service attack, or DDoS. A denial-of-service attack floods a website or network with so much traffic that it cannot respond, or simply crashes, so real users cannot get in. When many machines attack one target together, it is distributed. A botnet is exactly that: many machines that will do what they are told.

CISA adds two more points worth knowing:

• Botnets are rented out. They are often offered to "attack-for-hire" services, which let people with no technical skill launch an attack.
• The owners are victims too. The devices in a botnet are used without permission. Their owners did nothing wrong except leave a door open.

Why owners rarely notice

Botnets are designed to be quiet. A bot does not need to break your device or show you anything. It needs to stay connected and wait for orders. CISA notes that infection of connected gadgets often goes unnoticed by their users, and that an attacker could take over hundreds of thousands of them without the owners knowing.

That is what makes botnets hard to fight. Each owner sees a camera that still works and a router that still connects. Only the combined traffic, aimed at someone else, shows what is happening.

A worked example: a camera that joins an attack

Here is how a single home device can end up in a botnet, step by step, using the pattern CISA describes.

1. The setup. Someone buys an internet camera, plugs it in and never changes the password it came with.
2. The scan. An attacker's software tries common default passwords on many devices across the internet, and this camera lets it in.
3. The takeover. The attacker installs a small program that connects the camera to their command and control software. The camera still shows its video, so nothing seems wrong.
4. The wait. The camera sits quietly, one of many thousands of devices, until an order arrives.
5. The attack. The controller tells every device to send traffic to one website at the same moment. The site is overloaded and real visitors cannot reach it.
6. The aftermath. The site's owner is the main victim, but the camera's owner is one too: their device was used in an attack, without their knowledge.

The first step is where it could have been stopped. A changed default password, current updates, and a firewall that restricts traffic in and out, which CISA recommends in the same guide, each make a device harder to recruit. None of them makes a device untouchable, but together they close the easiest doors.

Learn the idea by playing: Tank City Zero Day

Tank City Reboot has two original tank games set inside a computer. In the second one, Tank City Zero Day, you defend the core against threats named for real security ideas, and one of them is the Botnet drone. It is fast, it comes in threes, and it hunts you rather than the core: many small attackers working together under one plan.

The card adds the idea in one line: "A botnet is many hijacked computers taking orders from one controller." The same game has a Ransomware tank and a zero-day boss, and the first game has worm, trojan, spyware and rootkit tanks.

A game teaches the name and one idea. It is not a security course, and playing it does not protect any device. For the next step, read our guides to the types of malware and zero-day flaws.

Frequently asked questions

What is a botnet in simple words?

A group of computers and other devices that criminals have taken over without the owners knowing, so that one person can control all of them at once.

What are botnets used for?

Mostly for distributed denial-of-service attacks, where thousands of devices flood one website or network with traffic until it stops responding. Botnets are also rented out to others.

Can my camera or router be part of a botnet?

Yes. CISA notes that connected gadgets often keep their default passwords, and that their infection often goes unnoticed by the people who own them.

How do I keep my devices out of a botnet?

Change default passwords, install updates when they arrive, and use a firewall that restricts traffic in and out. These do not make a device untouchable, but they close the easiest ways in.

Get started

Play Tank City Reboot: it is free, plays in your browser on a computer or a phone, and needs no account. Then try Zero Day and see how long you last when the Botnet drones arrive in threes.