So Microsoft was partly responsible for taking down the Kelihos botnet back in Sept 2011. They used a variety of legal and technical measures to do so. I don't want to get into the global politics and legalities of what legal measures they took, but from a technical perspective, what makes up someone's toolchest when they are trying to take down a botnet? The toolset must be rather constrained due to the various -- potentially uncooperative -- players.

As a secondary question: Does Microsoft have an advantage on the war on botnets simply because of their ability to push out the malicious software removal update each month?

1 Answer 1


I'm going to take a stab at this question by pondering some various things I know. Don't take this as advice from a professional who actually works in this area or anything. This is written with what I've heard about botnets in mind, not that specific one. And what I've heard may now be historic. Basically, this isn't a great answer. With these things in mind...

Firstly, most traditional botnets are viewed as three entities from various types of people: the client, the master-client, and the server. The client goes on the victim, the server issues commands, and the master-client is just a spiffy interface to handle the server. Having the executable on the victim's machine as a server that allows a client to connect and control it is what many 'skids' do, but is worthless in 2012 due to decent firewalls being ubiquitous. Therefore, botnets use a system various types call 'reverse connection'.

So if you wanted to shutdown a botnet, you would hit the server, thus killing the ability for the master-client to issue commands to the victims. Sounds great on paper, but not so great when you go to apply it. For example, a lot of botnets are P2P, so there's no centralised control, or at least not one that's easy to locate. Some can detect when a server has been knocked off and then automatically start up a new one elsewhere. You could have servers managing servers managing servers, each step being done through layers of masquerading indirection. You get the idea.

Many botnets have updating features. That is, the server can issue upgrades to the client executable on infected machines. These updates may have new ways of bypassing newer heuristic scanners, for example. So one way to eliminate the botnet would be to get control of the server and issue an update that replaces the infecting client code with an empty executables across all of the victims. Just an idea...

I read a book by Symantec a while back (forgot the name). It detailed a process where anti-malware companies have vulnerable machines connected to the Internet purely to get infected so they can check out what's floating around. So perhaps a fad botnet would infect one of these machines, and then the company can check where the commands are coming from. Naturally such commands would go through dozens of layers of indirection, but it's a start, right?

Here's another idea: maybe such companies got a person into the areas where such botnets are developed. Private forums and the like. Crackers love to brag about their prowess, boiling all of their achievements down to an ego trip. It's pretty obvious how this can go wrong for them.

Also, you have different categories of people who write these nasty things. The herders, the researchers, etc. I don't honestly think all of them fit into this, but it's a good way of looking at it. So there may be multiple responsible, which complicates a permanent takedown.

It takes one person of technical prowess to make a new aspect that dozens of script kiddies then employ on their malware like botnet clients. RunPE, for example, was probably actualised by a geek who had no intention of infecting, but was then used by the kids since the said geek provided an easy-to-use interface that the kids could comprehend.

So when you do find those responsible for a botnet, no doubt a lot of the contributors get let off the hook. Who do you blame primarily? Anyone's who code was used in it, and that such code was specific enough to be /only/ used for nefarious purposes? Or Just the main coder? I don't know to be honest.

Sorry for this ramble. I was just pondering how botnets might get taken down in general =)

EDIT: To answer your second question, security updates can render a piece of malware completely inoperable from only a small tweak in the system. Malware is often highly specific to certain setups.

Windows is the top target of malware, so Microsoft being the official updater of it means they have a lot of power to get rid of the botnet clients. Not only by rendering botnet clients inoperable with system changes, but also by updating their security software like Malicious Software Removal Tool to pick such malware up.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.