4

This is something i have pondered about for a while now, but never really thought to ask. How is it that botnets can communicate with a controller of some sort to co-ordinate DDoS attacks and other nasties without it being traced back to the operator of the botnet?

Surely the botnet needs to know where to recieve its commands from to stay in sync with what the rest of the botnet is doing, how is it that this source cant be found and traced back to the perpetrator?

Another thought I had was that perhaps botnets work on a peer-to-peer basis, and that all bots know about all the other bots in their 'network', and all the controller needs to do is pose as another unwilling member of the botnet to make the controlling machine indistinguishable from the bot machines, but I cant see how this would work well enough to hide their indentity entirely either?

How is it they can get away with doing this without getting caught?

| improve this question | |
3

In additional to Jay's Answer about DNS Fluxing, another way to circumvent blacklists of domains is for a botnet operator to use a DGA (Domain generated algorithm).

The botnet will use a shared secret algorithm to generate the next check-in domain. This algorithm is kept secret to prevent law-enforcement or a rival C&C operator from determining the next check-in and taking control of the bot.

When a domain is taken down due to malicious content (or the domain is added to a blacklist), there is a chance that the bot cannot check-in with the server. The use of a DGA increases reliability of the communication between server and bot.

This is the method that was used by Conficker and was a back-up protocol used by Zeus.

More Information on DGAs: http://resources.infosecinstitute.com/domain-generation-algorithm-dga/

Cracked DGA Algorithm leads to 200k+ domains takendown: http://blog.malwaremustdie.org/2014/02/the-takedown-of-209306-nuclear-pack.html

| improve this answer | |
  • One thing i don't get is how the botnet owner manages to register all that domains. I mean, if you generate 24 domains per day you need a way to respond to that 24domains when the infected pc tries to access it. how does it work with the DNS? it should be "faked" as well, right? this thing is not yet clear to me. – EsseTi Jan 11 '17 at 16:51
2

One method is 'DNS fluxing', where bots query a series of domain names to find a valid CnC server. The bot owner only needs to register one of the domains, which can be taken down and replaced with another.

It's possible to detect these with traffic analysis.

This paper goes into a lot of detail https://web.archive.org/web/20161130193110/http://www.ece.tamu.edu/~reddy/papers/tnet12.pdf

| improve this answer | |
  • 1
    But then how are they not traced back from the domain purchase and/or the server/address the domain is pointing to? – Trotski94 Oct 16 '15 at 13:16
  • I'm drifting towards the edge of my knowledge on the subject now, but I would imaging domains registered under fake names, anonymous payments and good OPSEC will play a part. – Jay Oct 16 '15 at 13:20
  • @JamesTrotter It's not terribly difficult to purchase a domain anonymously. The payment can go through a VISA/Mastercard gift card which can be purchased anonymously with cash. There's various other means of getting pre-purchased gift cards. Tying back payments to purchasers in the modern world is very difficult if the purchaser takes some basic precautions. Tracing is difficult, but not impossible. This guy en.wikipedia.org/wiki/Strip_search_phone_call_scam was caught via video surveillance, and a lot of legwork. – Steve Sether Oct 16 '15 at 16:24
0

Because it's possible for anyone of us to move around in darkness if we choose. Look into services such as TOR. You can register DNS names or do pretty much anything you want from behind an untraceable proxy.

| improve this answer | |
  • I realised TOR was a possibility, but alot of these bots have been around since before TOR. – Trotski94 Oct 16 '15 at 18:02
  • stolen wifi connections, hacking into someone elses computer and using it, other proxy services, etc. There has been means to proxy through a service or hijack a proxy for a long time. TOR is just an example. – David- Oct 16 '15 at 19:06
0

Botnets can communicate with encrypted\custom protocols, most of the time they also use some "bullet" proof hosting that allow them to host controlpanels and not being taken down because these ISP\Hosting services are located in some countries like China,Russia,Asia..
Also:
-Bots can reach their C&C with other Bots connection tunneling making so hard to locate a real C&C
-Rendundancy.. (for example if C&C1 goes down.. bot connects to C&C2 or C&C3.. or it could receves commands from another bot)
-Infected routers with malicious DNS servers makes harder to track where your data goes
-Botnets controlled via tor

| improve this answer | |
  • Both China and Russia are in Asia. – Mathemats Jan 27 '16 at 22:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.