What command and control channels might a botnet use? Which would be most effective?

I found good info on IRC, what are other possibilities?

(Exam preparation - no harm intended :-) )

  • There are different classes of botnet like IRC based, HTTP based, P2P based etc. But your term effective is very ambiguous like it can mean stealth, or it can mean efficient communication bots between bot and server. – Ali Ahmad Aug 17 '13 at 15:02
  • Talking about botnets with malicious intent where C and C is present.The ones you give an example are decentralized asfaik like P2P, web server maybe centralized. – Aubergine Aug 17 '13 at 15:10
  • NTP is also a fun control channel! – forest Apr 17 '18 at 9:10

There are many alternatives being used by the malware creators. Some of them are:

  • Flashback Mac Malware used Twitter 1.
  • Google AppEngine 2.
  • Facebook 3.

For sure, there must be other channels as well, these are the one that I remember from recent news.

The botnet owners are diversifying from IRC as, Twitter, Facebook, Google AppEngine are services used a lot and the traffic is considered to be legitimate and less suspicious by the network administrators. Though I am not an expert, I hope this gives you some idea.


I remember of another one, presented in DefCon 2010 by Dennis Brown. Using Tor network. Using Tor2web botnet can access a .onion website and take commands from the server. Have a look at the presentation, it is informative. 4

| improve this answer | |

HTTP is quite popular.

From a bot herder's perspective there is, of course, the issue with HTTP of how to keep the bots going when Law Enforcement takes down the web server you were using, or people start blocking access to it. To get around that some use domain names that are generated according to an algorithm that only the bot programmer knows and therefore (s)he can pre-register a series of next domains that the bots will try to contact.

There is social media like Twitter. You could have the bots follow a particular user on twitter, but that account could get closed so following a particular hash tag might be more useful, or like the DNS domains, you could have the bots follow user names generated according to a predetermined pattern.

The advantage of using IRC was the simplicity of setup and robustness of the system. Choose a popular IRC network and pick a channel to host communications. Creating an IRC channel hos no costs associated, and the IRC networks are already there with redundant servers etc.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.