What is the typical computer setup and hosting arrangement of malicious bots?

Question

It's quite well known that if an attacker wanted to, they could spoof their IP address by using a proxy server or some other means.

Whilst that's possible, whenever I perform a geo-location lookup on the IP addresses that conduct automated brute force attacks, probing, port scanning etc. against my servers, almost always the IP addresses do resolve to countries associated with cyber crime, like:

• China
• USA
• Russia
• Turkey
• Italy
• etc.

Knowing that the Internet is very independent of geography, for example it's possible to sign up with server hosts anywhere in the world and in fact it would be desirable - from an attackers point of view - that their IP was not associated with a country with a bad reputation.

Also, because servers are sometimes added to a botnet when compromised, I always assumed remote servers were the preferred "weapon of choice" for attackers.
However, I'm now wondering - are the people conducting this activity forced to use local ISP's in countries with more lax laws and that don't crack down on malicious activity (I'm assuming they can't get access to all the big name reputable providers - because their accounts would be shut down quite quicky)?

And does this also then mean that they generally have to supply their own machines? I know there are lots of ways to setup a computer and connect to the Internet - but what is the typical setup for these automated bots regarding whether they are remote rented servers or local physical machines and how do they get Internet access?

Answer 1

The ideal automated bot is somebody else's machine that you have compromised because their security wasn't good enough. You can then control that machine remotely, preferably via some channel that doesn't trace easily back to you (IRC used to be popular).

Answer 2

There are some academic papers that describe Windows botnets from an architectural viewpoint:

• Insights from the Inside: A View of Botnet Management from Infiltration
• An Inside Look at Botnets
• Spamcraft: An Inside Look At Spam Campaign Orchestration
• Inside the Storm: Protocols and Encryption of the Storm Botnet
• Your Botnet is My Botnet: Analysis of a Botnet Takeover
• Measurements and Mitigation of Peer-to-Peer-based Botnets: A Case Study on Storm Worm
• Exploiting Fundamental Weaknesses in Botnet Command and Control (C&C) Panels
• BYOB: Build Your Own Botnet

It appears that most botnets have at least 3 layers:

1. The computers running the working code. Looks like these are almost always compromised computers.

2. An intermediate layer, sometimes compromised, sometimes actually paid for.

3. The actual command and control machine. Almost always bought and paid for, not someone else's servers they've hacked.

The un-hacked, bought-and-paid for servers appear to either be in places like Kazakstan, or hosted on "bulletproof" ISPs. Some of those bulletproof ISPs have gone out of business or been taken down legally. Google for "McColo" for details of one of these.