Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm experimenting with a Proof of Work system that tries to force the use of a browser in order to solve the client puzzle. Basically, instead of just handing off the puzzle as hash with a well known algorithm, I'm handing off the puzzle as actual JavaScript code which must be executed to get the solution (and also calls into the browser environment to really try and make sure its a browser). I've been able to script something like PhantomJS to automate an attack, but that's acceptable. It still runs the puzzle very slowly. However, one of the things I was hoping to deter is the ability for an actual botnet to attack and automate solving the puzzle. While I think the effort for that would be large, and unlikely, I was just curious how feasible it would be for a zombie computer to actually install and run something as substantial as PhantomJS (a full headless webkit browser) in order to be able to automate an attack.

From my knowledge of botnets, they mostly rely on much smaller, and often predetermined sets of functionality - keylogging, screenshotting, http calls, running smaller scripts.

Edit - Just to clarify, I know that a compromised computer can install whatever they want, its a question of feasibility. For example, how many botnets download and use a ~7MB tool after the initial payload (like phantomjs)?

share|improve this question
It could install and run anything with enough privileges, if you see Bitcoin as a puzzle then there already are, and have been, puzzle solving botnets. – Philipp Oct 2 '13 at 8:03
For extra fun, they could reverse your js, and write equivalent c (or even GPU) code which is much faster than your JS implementation. – CodesInChaos Oct 2 '13 at 10:17
The bitcoin mining bots had their bitmining code distributed as part of the initial payload from what I've read. I'm more curious how feasible it would be to turn a bot used for DDoS into one which could use PhantomJS as described. – Russell Leggett Oct 2 '13 at 13:11
@CodesInChaos They could not reverse the js, that is precisely one of the things it was designed against. The client puzzle is generated differently each time using a series of transformations which make it almost impossible to execute with anything but a JavaScript runtime. – Russell Leggett Oct 2 '13 at 13:13
up vote 4 down vote accepted

To be useful for puzzle-cracking, a zombie node must have network bandwidth (for the one-time download of the Javascript interpreter, and for each puzzle instance to obtain), RAM or disk space (for storing the Javascript interpreter), and spare CPU (to actually run the thing). Typical botnet nodes have all three:

  • A typical usage for botnets is to send spam; this means sending an awful lot of data. One must assume that typical botnet nodes have bandwidth. Home machines normally have more download bandwidth than upload, and yet spamming uses the upload, so zombie home machines can really download a lot.

  • Botnet nodes also have storage space by the gigabytes: when was the last time you saw a machine with a filled-up disk ? Actually, since filesystem performance tends to degrade when the disk is more than 80% full (because of fragmentation), there are incentives for keeping some spare room in disks.

  • Most machines out there are idle most of the time. In general, desktop systems use CPU only when the human user is in front of them (and only when that user does things which use a lot of CPU, like gaming, and unlike Web browsing); servers have spare CPU to deal with peak usage, but peak usage, by definition, occurs relatively rarely.

There are limits to what a botnet node would practically do, but they are much higher than mere 7 megabytes. 7 megabytes will be downloaded in 7 seconds or so; they can fit in RAM. 7 gigabytes might be more challenging for the botnet author; smuggling 7 gigabytes on the hard disk in a discreet way could be relatively uneasy. But mere megabytes ! Piece of cake.

share|improve this answer
Thanks, this all makes sense. The system I'm experimenting with does not depend on being impervious to bots, just challenging and resource intensive. I was mostly just trying to gauge the likelihood of a bot network going through the effort to run a full headless browser with a custom script to interact with it and the JavaScript. It would still be a massive resource hog in comparison to multi-threaded native code pounding directly on the http requests, and that's sort of the idea. Additionally, bot detection code can be hidden in the javascript to be potentially extra abusive. – Russell Leggett Oct 2 '13 at 18:19

Most botnets are extensible in that the bot master can upload any arbitrary application to the zombies. So - Yes quite possible for a zombie to install a headless webkit browser.

The BotNet could also act a GRID computer where the attacker runs PhantomJS on a single computer and distributes the actual CPU cycles across the entire zombie farm.

share|improve this answer
It would be very difficult to farm out the work because the puzzle itself must be executed as is. It is heavily obfuscated in loops, switches, and ifs that change every time through a sequence of randomized transformations. It might be possible to farm out cpu intensive portions of it for work, but you couldn't farm it all, and it would take a pretty tremendous effort. – Russell Leggett Oct 2 '13 at 13:25
Interesting. Yes, the cost can obviously be raised quite high. However, if distributed Turing machines can exist, then any program that runs on a normal computer can be distributed with a three-way trade-off between bandwidth:storage:processing per zombie. – LateralFractal Oct 3 '13 at 1:37


We have strong reasons to believe that there are some Botnets that already employee a combination of PhantomJS and Captcha solving capabilities.

share|improve this answer
Good to know. Thanks for the insight. Follow-up question - do you know how long it typically takes for a bot to solve a captcha these days? – Russell Leggett Nov 14 '13 at 15:58
No, but we should have the data to research this and publish a case-study. Thanks for the idea! – Igal Zeifman Nov 20 '13 at 9:23
Let me know if/when you do! – Russell Leggett Nov 21 '13 at 14:54

Botnets are viewed by botnet operators as a vast distributed computing grid. Generally, the operators have malicious intent behind their usage, and to that end most bots have payloads designed to perform some traditional exploit: send spam, DDoS a target, host fraudulent phishing sites, etc. Those are readily available in the form of pre-written code modules ("scripts" to use your term.)

However, the botnet operators will send out whatever someone will pay them to send, and that's the key. Botnets have been known to send code to crack CAPTCHAs in order to purchase mass quantities of tickets for resale.

What you really have to evaluate is the value of the service you're trying to protect. If your service is exceedingly valuable or profitable to someone who is willing to abuse it, the attackers will have that much incentive to crack it. If you're looking to simply stop spammers, just about anything will divert them to an easier target.

Finally, don't discount the inconvenience that "solve-the-puzzle" challenges place in front of your users. Despite most site owner's opinions of the relevance and value of their site, on the internet to most users one site is pretty much as good as another. Inconvenience sharply reduces the appeal and value to most people, who will quickly Google over to one of your less-inconvenient competitors.

share|improve this answer
This is a proof-of-work system, not an end user puzzle. It was specifically designed to be invisible for users, but resource intensive for bots. – Russell Leggett Oct 2 '13 at 18:08
@RussellLeggett, it's good that the user won't see it, but the problem is that botnet operators are almost never concerned about performance. If an end user's computer suffers grinding through 500MB of RAM for 5 minutes it's still not a penalty to them; not as long as they get a financial reward for the effort. In the eyes of a botnet operator, the computing is free. The programming is their biggest cost so that's where you might try to deter them, but if it's just launching javascript, that isn't particularly difficult. – John Deters Oct 2 '13 at 18:21
This just follows a similar path of other Proof-of-work systems. I fully expect that a bot network could get something running, but there's no immediate reward for success - its not bitcoin, there's no money in it. What it does is slow down a brute force attack against a login (for example) and help prevent DDoS attacks. The proof-of-work is just to get a session, without which you just can't do anything. Here is a different proof of work system using JavaScript for a little of what I'm going for: Ours is different in a few important ways, but this has a similar idea. – Russell Leggett Oct 2 '13 at 19:29
I certainly hope yours is different, as their "spam-resistant guestbook" is filled only with spam. As I said, as long as there is no financial reward for an attacker, absolutely anything you do extra would get bots to leave you alone. It still won't stop the Mechanical Turks from attacking you manually, however. – John Deters Oct 2 '13 at 20:00
@RussellLeggett Ah. Insightful. I get it. You don't need to make the cost prohibitive for a botnet, but simply make the opportunity cost much higher than other things the botnet operator could use their network for. – LateralFractal Oct 3 '13 at 1:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.