Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Can someone please explain the C&C for bots ? im reading a paper about Android bot , and its explaining something called URL flux as method of C&C . however i couldn't really get it , so i need to know how normal bots preform c&c so i can understand this . for example why the bot needs a public key to authenticate commands ? and what the username generator algorithm for ?

share|improve this question

2 Answers 2

up vote 6 down vote accepted

You have two questions in there, and these are well documented in various places, but let me have a quick stab at it:

  • you don't want your bot taking commands from the wrong place, so you need an authentication mechanism. Public/Private key pairs provide an easy, scalable mechanism

  • it helps to be able to keep unique id's for all bots so you can address them or seems specific commands

Traditionally the C&C had been the weakest point as if it was taken out the botnet would fail, so improvements included using a selection of URLs, and URLFlux takes that a step further.

share|improve this answer

Fastflux is a technique in which DNS records are change constantly for a given C&C server. With botnet C&C server have a DNS name rather then the IP address, if anyone of the C&C server is taken down it can be immediately move down to different IP address. So this technique practically makes impossible to take down a complete botnet.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.