Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

What command and control channels might a botnet use? Which would be most effective?

I found good info on IRC, what are other possibilities?

(Exam preparation - no harm intended :-) )

share|improve this question
    
There are different classes of botnet like IRC based, HTTP based, P2P based etc. But your term effective is very ambiguous like it can mean stealth, or it can mean efficient communication bots between bot and server. –  Ali Ahmad Aug 17 '13 at 15:02
    
Talking about botnets with malicious intent where C and C is present.The ones you give an example are decentralized asfaik like P2P, web server maybe centralized. –  Aubergine Aug 17 '13 at 15:10
add comment

2 Answers

There are many alternatives being used by the malware creators. Some of them are:

  • Flashback Mac Malware used Twitter1.
  • Google AppEngine 2.
  • Facebook 3.

For sure, there must be other channels as well, these are the one that I remember from recent news.

The botnet owners are diversifying from IRC as, twitter, facebook, google appengine are services used a lot and the traffic is considered to be legitimate and less suspicious by the network administrators. Though I am not an expert, I hope this gives you some idea.

Edit:

I remember of another one, presented in DefCon 2010 by Dennis Brown. Using TOR network. Using Tor2Web botnet can access a .onion website and take commands from the server. Have a look at the presentation, it is informative. 4

share|improve this answer
add comment

HTTP is quite popular.

From a bot herder's perspective there is, of course, the issue with HTTP of how to keep the bots going when Law Enforcement takes down the web server you were using, or people start blocking access to it. To get around that some use domain names that are generated according to an algorithm that only the bot programmer knows and therefore (s)he can pre-register a series of next domains that the bots will try to contact.

There is social media like Twitter. You could have the bots follow a particular user on twitter, but that account could get closed so following a particular hash tag might be more useful, or like the DNS domains, you could have the bots follow user names generated according to a predetermined pattern.

The advantage of using IRC was the simplicity of setup and robustness of the system. Choose a popular IRC network and pick a channel to host communications. Creating an IRC channel hos no costs associated, and the IRC networks are already there with redundant servers etc.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.