Why do researcher need to control all C&C servers of a botnet?

Question

Why do researcher need to control all C&C servers of a botnet?

Wouldn't it be easier to spread a deinstall command to all reachable PCs to cripple the botnet? This could be done over and over again until most PCs are clean.

Apparently I don't know enough about botnets, so please help me out. Do clients check commands from multiple sources? I.e. in a P2P botnet, do they accept multiple commands from various other bots and then compare them to check which one is valid? Same for C&C servers. Will they connect to the first active C&C and execute whatever command is placed for there? If so, the only two things hindering researchers from using the botnet infrastructure is access to C&C servers and possibly encryption keys to send valid commands.

The point is that simply removing the C&C servers leaves the affected PC wide open an possibly even in a state where it constantly tries to communicate with other bots / download commands? So if ever another C&C server gets reachable, the bots will be active again.

A possible reason that sprung to my mind was that deinstalling anything from a target PC could possibly be seen as an unlawful interaction with one's PC.

Answer 1

In answer to your questions about bots, this depends on the bot itself, I mean it is up to its designer to design how the bot itself receives commands.

The 'traditional' method is ofcourse to connect to a IRC channel and wait for instruction,

P2P is often more difficult to implement (due to NAT/Port Forwarding) and easier to detect (because holes in firewalls are easier to see. )

'Taking ownership' of C&C Servers, it is primarily to ensure that nobody else does, even by accident, and primarily to ensure that a IP address does not get 'hammered' to much if the IP is allowed back into general circulation (for example, imaging a botnet of 2 million machines hitting a IP address once per day, thats 1388.8 tcp connections per minute. could have a detrimental effect. )

As for 'not self destructing' the bots themselves, it is because it is not ethical to run code on another machine without the users consent (even if it is for their own good. ). Its possible that the removal might require a reboot in some cases, or might effect running processes. (if my machine reboots without my knowledge I am going to go out hunting for blood. can you imagine the backlash if the un-install process caused some damage by accident?)

Answer 2

There are likely legal and ethical implications in utilizing a botnet's infrastructure to uninstall it remotely on all affected hosts. It may not be legal for even the authorities in a country to access personal or corporate resources. In addition, if the uninstall is not successful or poorly planned it could have further negative consequences. There is also no guarantee that it would uninstall from all affected nodes.

By shutting down the C&C servers, law enforcement is also often targeting the people and the resources- i.e., they are seeking more than a technical fix.