1

Are there any detailed case-studies in which infected machines in a certain network or on the internet were communication with each other (I'm not interested in cases with only machine <-> C&C communications)?

E.g.: PC-A gets infected, then infects PC-B etc... PC-A and maybe others open a port and then the infected machines communicate with each other (and maybe with the C&C as well).

1 Answer 1

0

I don't know what you expect precisely when you ask for "detailed case-studies", but if PC-B has no Internet access, it is a well-known practice for the attacker to use PC-A as a relay between PC-B and the C&C:

PC-B <---> PC-A <---> C&C

To give a more concrete example:

  1. PC-A belongs to the users LAN, this is the computer where people access to their emails and browse the Web. Sadly, one email or web page was infected, thus contaminating PC-A.
  2. Once in running in the LAN, either in an autonomous way or remotely controlled by the C&C, the virus starts to scan the network and try to propagate itself. It reaches PC-B (unpatched vulnerability, poor password or whatever) and contaminates it.
  3. PC-B belongs to another, restricted network with no access to the Internet (with chances that it has access to more interesting resources!). The virus can setup a way for PC-B to use PC-A as a relay to get new orders from the C&C and exfiltrate data.

This relay can take any form depending on the attacker fantasy and requirements. It can range from simple proxy-like features to a full fledged peer-to-peer network ensuring that the virus' network will remain functional even if some relay machines are being decontaminated.

3
  • By detailed case-studies I mean papers/documents by security researchers that describe such techniques in the wild.
    – ENG
    Commented Sep 4, 2016 at 13:27
  • @ENG: You will find such techniques mostly in state sponsored espionage software as they are costly to design and implement. Two good examples may be Uroburos (see the intro and page 9 "Network capabilities", attributed to Russia) and Regin (see page 16 "Topology", attributed to US and/or UK). Commented Sep 4, 2016 at 18:50
  • I would add this to the answer as those are good examples : )
    – ENG
    Commented Sep 5, 2016 at 11:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .