What command and control channels might a botnet use? Which would be most effective?

I found good info on IRC, what are other possibilities?

(Exam preparation - no harm intended :-) )

  • There are different classes of botnet like IRC based, HTTP based, P2P based etc. But your term effective is very ambiguous like it can mean stealth, or it can mean efficient communication bots between bot and server.
    – Ali Ahmad
    Commented Aug 17, 2013 at 15:02
  • Talking about botnets with malicious intent where C and C is present.The ones you give an example are decentralized asfaik like P2P, web server maybe centralized.
    – Aubergine
    Commented Aug 17, 2013 at 15:10
  • NTP is also a fun control channel!
    – forest
    Commented Apr 17, 2018 at 9:10

3 Answers 3


There are many alternatives being used by the malware creators. Some of them are:

  • Flashback Mac Malware used Twitter 1.
  • Google AppEngine 2.
  • Facebook 3.

For sure, there must be other channels as well, these are the one that I remember from recent news.

The botnet owners are diversifying from IRC as, Twitter, Facebook, Google AppEngine are services used a lot and the traffic is considered to be legitimate and less suspicious by the network administrators. Though I am not an expert, I hope this gives you some idea.


I remember of another one, presented in DefCon 2010 by Dennis Brown. Using Tor network. Using Tor2web botnet can access a .onion website and take commands from the server. Have a look at the presentation, it is informative. 4


HTTP is quite popular.

From a bot herder's perspective there is, of course, the issue with HTTP of how to keep the bots going when Law Enforcement takes down the web server you were using, or people start blocking access to it. To get around that some use domain names that are generated according to an algorithm that only the bot programmer knows and therefore (s)he can pre-register a series of next domains that the bots will try to contact.

There is social media like Twitter. You could have the bots follow a particular user on twitter, but that account could get closed so following a particular hash tag might be more useful, or like the DNS domains, you could have the bots follow user names generated according to a predetermined pattern.

The advantage of using IRC was the simplicity of setup and robustness of the system. Choose a popular IRC network and pick a channel to host communications. Creating an IRC channel hos no costs associated, and the IRC networks are already there with redundant servers etc.


Use the principle of "hidden in plain sight". Post messages in public, hidden by encryption

Usenet, with a pre-shared token and encrypted messages. Your bots would need to search Usenet message headers for the token. Limit the search by posting to a preselected list of newsgroups. Censorship is difficult because Usenet is a peer network. Every server duplicates the same data. Choose popular newsgroups to avoid censorship by deleting the newsgroup, but not so popular that message header searches take forever

Cryptocurrency blockchains, uncensorable, with fees. You can probably send 100 40-byte messages in a Litecoin transaction for about 1 cent. Not immediate, usually delayed up to 2.5 minutes, could be longer. Once the transaction is confirmed, it's permanent. No takedowns possible. Transaction outputs are implemented using a primitive scripting language. Most outputs are coins, with a signature checking script. One of the script operators is OP_RETURN, a null operator which allows a parameter containing up to 40 bytes of arbitrary data. Construct a transaction with one or more OP_RETURN outputs, and one payment output, paying to an address recognized by your bot's own wallet. No search required

Namecoin is probably better than Litecoin, because its purpose is to store key-value pairs. On the payment blockchains - Bitcoin and Litecoin - the use of OP_RETURN for storing arbitrary data is considered by some to be abusing the common resource

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .