2

One thing that I don't understand about peer to peer botnets, is how a bot stays connected to the network considering the protocol used is UDP.

Since the UDP is connectionless, and the bot is behind a firewall, the packets wouldn't reach it. What would happen then?

|improve this question
  • 1
    when I Google "UDP p2p" one of the first hits is en.wikipedia.org/wiki/UDP_hole_punching - I believe this answers your question. – schroeder♦ Mar 31 '16 at 23:55
  • While applicable to NAT, this still doesn't answer my question in the firewall department (article never mentions firewalls). Also, UDP hole puching is still not reliable afaik, so there should be some backup? – user106192 Apr 1 '16 at 0:51
1

P2P botnets deal with firewalls the same way as all the other P2P applications (like Bittorrent, Skype and other VoIP, ...) do:

  • Simple NAT firewalls can be passed with UDP hole punching techniques
  • With more complex firewalls, like application layer gateways which only allow HTTP traffic, it either fails or it uses some outside server as a relay for communications.

Failing in case of more restrictive firewalls is actually not that much of a problem for P2P bots because most users are either not protected by any firewall at all or only by simple and easy to bypass packet filters.

|improve this answer
  • You mean for the relay part, it's actually just some kind of VPN with http traffic? Since all other traffic is blocked. – user106192 Apr 1 '16 at 6:17
  • @j0ach1mmall3: VPN is completely unrelated. It just sends the data to some external server which then forwards them to some other host. There is no need for encryption or private IP addresses. I recommend that you have a look at how VoIP SIP deals with such issues, i.e. STUN, ICE and TURN. – Steffen Ullrich Apr 1 '16 at 6:28
  • @SteffenUllrich I'm curious now - could you tunnel UDP Traffic over a VPN to bypass less restrictive firewalls? – Nathaniel Suchy Aug 18 '17 at 17:10
  • @NathanielSuchy: Please don't ask a new question in a comment. Apart from that one can tunnel TCP, UDP, ICMP, ... inside a real VPN. – Steffen Ullrich Aug 18 '17 at 17:25
  • @SteffenUllrich Sorry I thought I was asking for clarification. I'll be sure to ask a new question next time. – Nathaniel Suchy Aug 18 '17 at 17:32
0

If the system connected to a botnet (in most cases added due to a malware infection) is behind a firewall traffic may still reach it depending on our your firewall is configured.

If no application you use on your network requires UDP access you could drop the protocol entirely with your firewall.

However, you will still need to address UDP Hole Punching techniques to completely block off UDP Traffic, and some malware may utilize these techniques. Stopping UDP Hole Punching will require highly restrictive firewall rulesets. See https://stackoverflow.com/questions/28790503/are-there-security-measures-against-udp-hole-punching for more information on this.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy