Is there a way to prevent comments from being abused for command and control?

Question

Botnets typically are coordinated over protocols like HTTP or IRC. However, to make such command and control traffic harder to spot, attackers have occasionally turned to other channels, including normal-looking communication channels like comments on Instagram. Facebook has also been seen in the wild as a method for command and control. The Instagram case linked above used a fairly innocuous-looking comment, and the only way to unravel the command from it was to use a complex regular expression.

I would believe the main responsibility of preventing this abuse of comments usually falls on the security team responsible for identifying and removing the botnet from the infected computers. However, is there any way to prevent this abuse of comments on my own profile/website? I know there are solutions to identify comments that are spam or comments looking for vulnerabilities, but I don't think those comment-filtering solutions would block these C&C comments.

Answer 1

If you allow content generated by others at your site there is no way to detect if the content contains hidden messages in all cases because there are simply many ways such content could be embedded. Any attempts to detect and block such content have the risk of overblocking and thus impacting innocent users. From the example of the Instagram comments you see that the attacker only needs to hide a message of a few bytes in a much larger message. Such small hidden content could be spread over multiple comments (like using the first character from each comment only), could be contained in the username, could be hidden in the timestamp, could be contained in images ... .

At most you could try to detect the bots which read this message in that they don't really look or behave like real users. But also in this case it would not be too hard for an attacker to fool such detection system or make it throw lots of false positives so that it impacts innocent users of the site.

Answer 2

One idea - you can use moderators for comments and publish only comments, approved by moderators (if possible). This way your channel/page/website will be unreliable for botnet communication, as it would be impossible to predict, if the comment would be published and when.