3

I know most bots use either IRC or HTTP to communicate with the C&C, and http unlike IRC can't be blocked. So if a botnet is using HTTP, how can this be prevented? Just theoretical!

2

I know most bots use either IRC or HTTP to communicate with the C&C

As far a I know IRC is not much used any longer in current C&C communication because it is to easy to detect. Current C&C communication tries harder to blend in and uses mostly HTTP, but DNS is also used.

So if a botnet is using HTTP, how can this be prevented? Just theoretical!

Since the communication is deliberately designed to blend in the normal traffic and sometimes even uses Twitter or common blog sites to exchange information it is very hard to detect. Looking at such a traffic nevertheless often shows small differences to normal browser behavior, like atypical HTTP requests (older User-Agent, special or missing headers...). But that's not guaranteed and malware can even instrument the browser on the system to do the requests and thus will blend in even more.

Another source of information is to look at the history of the target host, because often botnets have a flexible infrastructure where the IP behind a name changes often or where the target host changes often. Thus you might detect it because the traffic goes to unusual hosts or to the same hostnames or IP addresses known from other malware. But again, it's not guaranteed that this C&C communication works like this or rather uses sites where users can generate content (Twitter, Facebook, blogs...) to spread the commands.

Thus it is sometimes possible to detect such a communication when looking at specific requests and sometimes you need to look at the larger traffic pattern from the host (anomaly detection). There is no single technique and there is no guarantee that you'll find it, because like I said the traffic is designed to be indistinguishable from normal traffic.

  • Dynamic blacklists of domains as well SIEM solutions can help as well. – TheJulyPlot Dec 6 '15 at 9:55
  • 1
    @TheJulyPlot: You are right, but my answer covers more the traces the C&C leaves in the network and not the existing products which make use of such traces. Blacklists are only the result of analyzing such traffic and SIEM is about collecting lots of information and looking for anomalies. But of course once you have seen some traffic you can use it to find more of this and there these products will help. – Steffen Ullrich Dec 6 '15 at 10:02
  • Your answer only discusses local prevention. I'm not sure the OP was restricted to that. – Neil Smithline Dec 6 '15 at 16:04
  • @NeilSmithline: The OP made the case that the IRC botnets can be blocked by simply (locally) blocking IRC but that this is not feasible with HTTP. Therefore I assume that the question was restricted to detection and prevention inside the local network. But yes, there is no explicit restriction to the local network so the answer might also include the finding of the operators of the botnet and the punishing so they stop operating the botnet. – Steffen Ullrich Dec 6 '15 at 18:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.