Botnet

A botnet is a network of compromised devices under the control of an attacker via command-and-control infrastructure, used to launch DDoS attacks, distribute spam and malware, mine cryptocurrency, or proxy abuse traffic. Telecom-relevant botnets such as Mirai, Mozi, and successors have largely been built from poorly secured CPE and IoT devices, including those provisioned by carriers.

Categories: Threats and AttacksIoT

Botnet in context

Telecom threats range from opportunistic SMS phishing and SIM swap to nation-state grade location tracking and lawful-interception abuse. The common thread is that most attacks exploit the inherited trust model of legacy signaling. SS7 and Diameter were designed for a closed operator community that no longer exists.

Cellular IoT (NB-IoT, LTE-M and 5G mMTC) brings billions of devices with weak identities, long field lifetimes and limited patchability into operator networks. The same signaling attacks that target smartphones (location tracking, denial of service, credential exfiltration) apply, often at greater scale.

To place Botnet in the wider telecom-security picture, review VLAN, CPE, Egress, Cell Phone (Mobile Phone), IoT and MAC Filtering.

Related terms

Related topic hubs

  • Diameter Attacks S6a IDR/PUR/CLR abuse, subscriber tracking, LTE signaling attacks.

More from the TelcoSec Glossary

Browse the full TelcoSec Glossary, the Ultimate Guide to Mobile Network Security, or the P1 Arsenal of telecom-security tools.