2

I may be a bit naive on the subject, so bear with me.

I know that hackers can use a botnet as a proxy to hide their IP, but there are ways to discover their IP when the traffic is intercepted. I also know that they can use TOR for the same purpose, but the fact that most exit nodes are controlled by the US government would make me nervous if I was planning illegal things.

Isn't it way better to use the TOR idea of multiple encryption layers so that every node only knows the previous and next node, but in a botnet? Exit nodes would be as random as any other node and it doesn't seem like this idea is harder to implement than any other botnet (of course we're ignoring things like hidden services, rendezvous points, etc.).

Is there a mistake in my reasoning, has this already been done or is this idea just a bit of an overkill?

| improve this question | |
  • Have you used Tor before? Or tried to download something through Tor? I would imagine bandwidth/latency is the main reason it's not being used widely by botnets (or maybe it is, who knows?). Depending on the type of botnet the author is hoping to use it for, anything that involves sending large amounts of traffic will generally not work well. – tangrs Nov 23 '16 at 10:05
  • 3
    do you have proofs to affirm that "hackers don't use a botnet as a TOR network?" – Ay0 Nov 23 '16 at 10:11
  • How can you have proof of something not happening when it can be done in secret? The only reason I ask this is because I couldn't find someone on the internet discussing this. Should I assume this has been done? – JorisH Nov 23 '16 at 10:14
  • Some botnets use Tor/p2p-type networking for change of commands. Eg, what to do, where send data. But routing my own illegal/private data trough every AV-vendor network is some bad BlackHat practice. – Evus Nov 23 '16 at 15:55
1

1 You don't necesserialy need an exit node when using Tor. It has HSs. HS's can be used as C&C which can't be taken down because their addrsessing is based on crypto.

2 It is more profitable to ship TorProject's Tor with a troyan than to make own probably buggy implementation of Tor.

3 Allowing other people to use botnet allows malware owner to say "I was just using Tor".

So, some trojans are really shipped with Tor.

The problem with this approach is that AV vendors start target Tor. For example MS deleted an obsolete version of Tor from user's computers. It seems to be OK (as long as Tor is a security software, an obsolete versiion is a security risk and it is natural to expect their users to have the latest version), but it isn't : Iranian Tor users can lose an access to Tor website and become unable to download a new version because torproject website itself is blocked in Iran.

| improve this answer | |
  • you didn't understand the question. OP is not speaking about using TOR, he's speaking about simulate a network like Tor using infected computers. – Ay0 Nov 23 '16 at 15:24
  • I fully understood the question. The answer is that it is easier and more secure to reuse Tor instead of reinventing a wheel. – KOLANICH Nov 23 '16 at 18:24
  • If you fully understand the question, than I don't understand your answer. 2. How is taking one single feature of Tor reinventing the wheel? It's really not much more than encrypting the connection multiple times after exchanging public keys. 3. Why would he/she allow other people to use their botnet? After that you're talking about shipping a trojan with TOR, but it seems like you're talking about a Tor client. I'm talking about turning botnet nodes into TOR-like nodes. – JorisH Nov 24 '16 at 9:45
  • 2 It is not a simple feature. There are lot of features to prevent various attacks and optimize the throughput. – KOLANICH Nov 24 '16 at 21:40
  • 3 If a system has only malicious users you can surely say any its user is a criminal, jail everyone who use it and this will be legal. If a system has only one user he is not anonymous at all - any user is he with probability ~1. Malware author doesn't want to be jailed. Tor is the system to hide peoples/machines identities, this is what he needs. It works (?) because clients are thought (they are not) to be indistinguishable from each other. It works because adversaries cannot distinguish the users they are interested in and the users they are not interested in. IPaddr is just an identifier. – KOLANICH Nov 24 '16 at 21:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.