Command and control (malware): Difference between revisions

Revision as of 07:36, 22 September 2016

Revision as of 08:38, 17 October 2016

Line 26:

Since most of the time IRC networks and Domains can be taken down with time, hackers have moved on to P2P as a way to make it harder to be taken down. Some have even been known to use encryption as a way to secure or lock down the botnet from others, most of the time when they use encryption it is Public-Key encryption and has presented challenges in both implementing it and breaking it. (See [[Gameover ZeuS]] See also [[ZeroAccess botnet]].)

Some newer botnets are almost entirely P2P. Command and control is embedded into the botnet rather than relying on external servers, thus avoiding any single point of failure and evading many countermeasures.<ref>{{cite book|authors=Wang, Ping|chapter=Peer-to-peer botnets|editors=Stamp, Mark & Stavroulakis, Peter|title=Handbook of Information and Communication Security|publisher=Springer|year=2010|isbn=9783642041174|url=httphttps://books.google.com/books?id=I-9P1EkTkigC&pg=PA335|display-authors=etal}}</ref> Commanders can be identified just through secure keys, and all data except the binary itself can be encrypted. For example, a spyware program may encrypt all suspected passwords with a public key that is hard-coded into it, or distributed with the bot software. Only with the private key (known only by the botnet operators) can the data captured by the bot be read.

In the P2P method of command and control the bot only tends to know a list of peers of which it can send commands to and that are passed on to other peers further down the botnet. The list tends to be around 256 peers which allows it to be small enough for it to allow commands to be quickly passed on to other peers and makes it harder to disrupt the operation of the botnet while allowing it to remain online if major numbers of peers are taken down in a takedown effort.