There were some trojans back in the day that would imitate normal browsing (proxying cnn.com for instance) and it'd stuff a encrypted command packets in there. Combine that with a load balancing check-back time in the response, you can probably support a very large number of bots on a single webserver.
-Travis On Sat, Sep 17, 2011 at 8:10 PM, Corey Nachreiner < [email protected]> wrote: > This basic video series may help: > > > http://www.watchguard.com/tips-resources/video-tutorials/botnets-part-one.asp > > http://www.watchguard.com/tips-resources/video-tutorials/botnets-part-two.asp > > http://www.watchguard.com/tips-resources/video-tutorials/botnets-part-three.asp > > http://www.watchguard.com/tips-resources/video-tutorials/botnet-source-code-for-overachievers.asp > > That said, we made that ages ago. It is quite dated. Most modern botnets > have started to use HTTP C&C channels, often encrypted. They also sometimes > obfuscate their C&C via proxies and p2p. Leaked source code for Zues and > spyeye probably would provide a better idea of how modern botnets work. > > Cheers, > > Corey Nachreiner, CISSP | Senior Network Security Strategist > WatchGuard Technologies, Inc. | www.watchguard.com > > 206.613-0873 Direct > 206.227.6905 Mobile > [email protected] > > Office Hours: 9:15 AM to 6:15 PM Pacific (GMT-8), Mon - Fri > > Better be despised for too anxious apprehensions, than ruined by too > confident security. - Edmund Burke > . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . > WatchGuard: Stronger Security, Simply Done > > > -----Original Message----- > From: [email protected] [mailto: > [email protected]] On Behalf Of RandallM > Sent: Friday, September 16, 2011 8:38 AM > To: [email protected] > Subject: [Full-disclosure] understanding the botnet C&C.. > > hi > an area that I am basically "stupid" on is botnets. Not what they are > but "how" they work through IRC as the control center. Not just that > but the various modern programs used. I am aware for instance LOIC can > be used to connect to an IRC channel.. but, how then does the "herder" > do the job from IRC..how does he issue commands that all the computers > connected act upon, etc. ? My curiosity has just got the best of me > and I would like some pointers to good material that can feed it. > > Sorry for the "troll" like post but I really would like to understand > this further. Have done a number of Google searching but have hope > someone here has done personal research. > > -- > been great, thanks > RandyM > a.k.a System > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ > -- FD1D E574 6CAB 2FAF 2921 F22E B8B7 9D0D 99FF A73C http://pgp.mit.edu:11371/pks/lookup?search=tbiehn&op=index&fingerprint=on http://pastebin.com/f6fd606da
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
