4

So recently I started to study how botnets work. But recently I stumbled onto a problem. I even tried brain storming how it would do it, but I couldn't think how a bot would update its code. I also tried researching it on google, but I got nothing. If someone could provide me with some sort of software updating algorithm, or a documentation on how a bot would update then that then that would be nice.

  • Download and replace executable with new one. Googling for "restart process from within" yields some interesting results. – multithr3at3d May 28 '17 at 22:50
  • Thank you. But what exactly was the need to down vote my post? – Fumerian Gaming May 28 '17 at 22:57
  • 3
    Why would updating a botnet be so much different than updating ordinary software? – Arminius May 28 '17 at 23:26
  • 1. The creator of the botnet might want to implement a method that will protect against any botnet take down attempt of just replacing the exe with code that renders every bot useless. Basically making the whole botnet also use less. 2. I was just curios. I didn't know what methods ordinary software used to update its self. – Fumerian Gaming May 29 '17 at 3:45
  • Your requirement 1. would also apply to regular software. – Arminius May 29 '17 at 3:55
3

Botnets reach out to a Command and Control (C2) server - typically a range of servers to help mitigate server takedown issues.

When they connect to a C2 server, the server may chose to initiate a function in the bot - for example to take part in a DDOS attack - or may chose to update code within the bot.

Clever bots will have the ability to rewrite themselves (or part of themselves) in memory as well as being able to update whatever file(s) the bot uses. Some bots only exist in memory and are lost on reboot.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.