# A Survey on Botnets, Issues, Threats, Methods, Detection and Prevention
## 3 Infection Methods  
One of the main causes of botnet malware infection is open ports. Although open ports have a vital role in network device communication, allowing packets to be transmitted freely [8]. Nevertheless, open ports may result in bot-masters transmitting botnet packets throughout the network. This can also apply to black hat hackers using the open ports to gain access to the network and use the software that would coincide with the open port to carry out privilege escalation. Once the threat actor has gained access through the port, the botnet can then be launched from the device by using the open ports as a route for the infected packets to reach other devices. HTTP ports allow a packet to be transferred throughout the internet. If unnecessarily opened, HTTP ports are in the hands of a bot-master, they could transfer the botnet codes at a faster rate [9]. Botnets can use flags to allow for flooding HTTP packets [10]. Flooding is where the network router would send an outgoing multi-cast to other connected devices. This can be an advantage to bot-masters as the flooding process would allow more devices to be reached more quickly [11]. HTTP is a more commonly used protocol bot-masters would favour in terms of propagation. Furthermore, flooding is a technique widely used within LANs that are scaled greater than others, which would coincide with companies that would contain more hardware making HTTP flooding approaches more ideal for bot-masters to use. Botnets have been recorded as capable of infecting Secure Shell (SSH) based sessions to propagate [10]. Despite the utilization of encryption to ensure security, SSH sessions can still be penetrated as the bot-master may create alterations within the botnet code to build a new variant. Within the variation, the botnet can conduct brute force attacks to access the SSH sessions as exploiting cases where weak passwords have been used [12, 13, 14]. Botnets can use dictionary-based attacks to be able to gain access to the sessions and allow for the infection to be performed [15]. [PERSON] et al. [16] elaborates that botnets are like Trojan-based malware as both botnets and Trojans may penetrate networks via phishing. This is also spread out by [PERSON] et al. [7], as the paper mentions that many bot-masters find methods of code obfuscation to avoid being detected by anti-virus and anti-malware software. [PERSON] [17] defines phishing attacks as a cyber-attack that coincides with the concept of social engineering. Phishing is where attackers send emails to a target and deceive them into responding to gain data or run malware. Phishing occurs in three stages, picking a target, the target responding to the email, and the phishing email acting. Phishing emails commonly present an urgent threat to users, informing them that they only have a certain period to open the link, causing the user to panic and respond, thus executing the malware. Bot-masters are responsible for sending phishing emails that have been weaponized to trigger the botnets [7, 15, 17]. The phishing emails persuade users to open the infected attachments. [PERSON] et al. [15] discusses hyperlinked attachments, where users would unknowingly click on a hyperlink, causing the botnet malware to be downloaded by the unsuspecting user. [PERSON] et al. [15] also state that the hyperlinks may take victim users to phishing websites, which trick users into downloading the botnet malware unwittingly. [PERSON] et al. [18] further justifies [15] and states that download links within emails may be classified as a \"Man in the Browser (MITB)\" cyber-attacks, which, according to [19], are like Man-In-The-Middle attacks. However, in MITB attacks, the attack exists within the Hypertext Transfer Protocol (HTTP) or the Hypertext Transfer Protocol Secure (HTTPS). The threat actor intercepts the session and causes code to be injected. In the case of botnets, the MITB attack could contain botnet code, and when the session between the user and the infected website occurs, the MITB attack will trigger the dormant code.