Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

IRC seems still the most prominent way for communication within botnets.

Why do attackers choose IRC?

In my (very naive) opinion, to set up a web service is far more easier.

share|improve this question

5 Answers 5

I think a major reason is that to use a web service an attacker would have to run their own web service. To do this, avoid being shutdown, and cover their tracks is a PITA for the botnet controller. With IRC control they can use an existing IRC network, and control the bots by joining as a particular user.

share|improve this answer

skiddos who cant read good or code (but call themself h4xorZ) take what they can get, and php/perl/c - irc-bots are easily found. i recently wiped out a bot that dated back to 2001 but still was used.

The other part of the answer to your WHY - question: because sysadmins dont do their job. there is usually no need for a server to allow outgoing irc-connections (or any outgoing connection at all, gkiven the fact you use a mailgateway and an update-server for your dc)

share|improve this answer

I agree, websites are easier and Conficker, for one, proved that a scheme of random domain name creation can be used to set up C&C servers, where each of the domain names is valid only for a day (or whatever the period is that the code defines).

But in my opinion the killer argument for IRC as opposed to a website is that IRC allows interactive control of the bot. That means an attacker can pick out any of the bots from the botnet and send custom commands to it. This means you have a much higher degree of control over a botnet with IRC with a comparably low effort, while the same level of control with a website would require a custom web-server software first of all.

So while in general a website is simpler to set up and it's (on most systems) easier to get HTTP client functionality, the features that the bad guys are looking for are not easily (or readily) available on stock HTTP servers.

However, I also side with Mark Davidson in that IRC is simply better tested and that there are implementations out there that can be grabbed.

share|improve this answer
    
+1 for interactive control point. –  mrnap Mar 7 '11 at 16:41
    
+1 for the mention of conficker and its use of random domains. –  Mark Davidson Mar 7 '11 at 17:10
    
A little bit of coding on the web server backend could provide an interactive control channel to the web service. –  bstpierre Oct 16 '11 at 23:38
    
@bstpierre: you're certainly right. Still, most developers will prefer proven solutions and I reckon malware authors are no different in that respect (not to speak of script kiddies). –  0xC0000022L Oct 23 '11 at 18:33

IRC used to be the primary method for controlling botnets but according to research done by Team Cymru in November 2010, web-controlled botnets now outnumber those controlled by the traditional method of IRC channel by a factor of five. So your opinion may be correct.

One of the main reasons I would say behind the use of IRC for botnet control is that when botnets started emerging in 1999 ( History of the Botnet ) IRC had been around for 11 years already and probably was considered to be a tried and tested communication for many users.

share|improve this answer
    
I know. But a simple web page seems easier.... –  user1221 Mar 7 '11 at 14:22
    
@Dante Jiang: since botnets are nowadays being sold, it makes sense to keep them as reliable as possible. It's not about ease of implementation but about reliability of the resulting code, as sick as it sounds. –  0xC0000022L Mar 7 '11 at 14:52
1  
Setting up an IRC bot was always easier. Growing up I gained alot of experience with irc bots. The major issues with them are that they are easier to detect(unless using tunneling and full encryption for their connections), rival botnet operators easily find your botnet on one of their hosts, reverse your bot, get your pass and network info then steal all of your bots. With HTTP/HTTPS c&c, there are infinite places to hide your control panel, very easy for ids systems to see it as normal web activity and fast flux makes them difficult to track. I can speak on this for days but im out of space. –  detro Aug 18 '11 at 14:44

There are at least two types of schemes how to controls botnets:

  • via C&C;
  • decentralized scheme;

The following ways of C&C botnet networks exists:

  • IRC (one or many);
  • control via web servers;
  • internet messengers;

Without C&C:

  • peer to peer networks;
  • trust rings;

Combined schemes are also possible, thus taking the best of each technology. It is not rare case when botnet developers creates their own protocols to leverage the capabilities of control.

First of all, IRC is used because it allows simple way to deploy communication network. For very small amount of bots it is enough with one IRC server, when server is unable to handle some peak moments of when bots online, several IRC servers can be joined. But, this type of networks is not for serious botnets nowadays. See my comments here: Malware known to use port knocking to evade detection by network scanners?.

By minimal complexity control via web server is similar to IRC. However, it allows more possibilities of control scheme variations. Is easy to deploy, control and to loose too. One of the most popular ways how to control botnet.

Control via internet messengers is not popular, because it is hard to create such network without headache for botmaster. Registration of accounts for one person is not a problem, but when it comes to automation of process, the problems starts.

Peer-to-peer botnets are hard to develop, but they can provide more stable and robust network.

The so called "trust ring" is even more complex scheme, but because of it's way of decentralized scheme it is hard to kill it. This is similar to scheme that is used in Skype.

C&C botnets are easy to create, but also easy to kill - just destroy control center. The last two types of C&C-less botnets are often seen used in serious botnets, because of really serious authors intents to be in big business of bad boys.

By the way, botnets are used not only in malicious purposes.

share|improve this answer
    
What you've said is what I already know actually.... I would like to know why IRC is better than some simple web page. –  user1221 Mar 7 '11 at 14:22
    
Generally, sooner or later attackers choose web server setup - it is easier to monitor statistics and to control bots. However, choice might depend on the purpose of botnet. Thus, your the question is similar to "why the teaspoon is better than the soap-spoon?". Sometimes there is enough of IRC server capabilities. C&C based on the web server might also be complex to support and develop. –  anonymous Mar 7 '11 at 14:56
    
@Ams Any reference on choice on purpose? –  user1221 Mar 7 '11 at 15:39
    
@all: anyone can point me some useful resource about botnet? i want to know more about this. can you suggest some book ? blog ? twitter ? papers ? and must read/follow stuff ? great thanks –  boos Mar 7 '11 at 19:48
1  
>By the way, botnets are used not only in malicious purposes. Any examples? –  Capt.Nemo Sep 30 '11 at 12:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.