> I wonder, though, is this how real botnets are controlled? > > Surely it would be fair easier, and less obtrusive, to control your > botnet via a updated http site. like > http://<mikeiscool>/instructions.txt. Every day the bots would log on > and receive their latest orders. Makes sense to hide in http rather > then risk a protocol that might be blocked, doesn't it? > > -- mic
Correct but botnets came from the underground IRC world, where most of the reusable c&c code was developed. These people know IRC well, it is an easy channel for them to develop upon. The second factor is available zombie management. A pure pull method with http would make it hard for the bot herder to track his available zombies, rather than just looking how many users are in an IRC channel. Common sense tell us botnets will continue to use IRC less as detection efforts such as the one described in the thread become more common. The real challenge will be when they go to covert tunneling capabilities for C&C such icmp and dns packets. -Greg ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw to learn more. ------------------------------------------------------------------------
