427 Botnet fm qxd

www.syngress.com
Alternative Botnet C&Cs • Chapter 3
81
427_Botnet_03.qxd 1/8/07 11:56 AM Page 81

---

as always. In essence, although IRC was still the control channel, it was now a
lot more robust.
Reporting, which results in a “takedown” for a DNS record, is often more
difficult than a compromised IP address. Several such RRs could be put in
place for the same IP address, or different ones, making the C&Cs much
more robust.
botnet1.example.com pointing to 127.0.0.1
botnet2.example.com pointing to 127.0.0.2
botnet3.example.com pointing to 127.0.0.2
botnet4.example2.net pointing to 127.0.0.2
botnet5.example3.net pointing to 127.0.0.3
botnet6.example6.net pointing to 127.0.0.1
Multihoming
Multihoming is a concept in network administration for when a DNS record
has several IP addresses.
By setting up one A record, which will point to several IP addresses, if one
of these IP addresses is no longer available, the others are still responsive.
botnet1.example.com pointing to 127.0.0.1
botnet1.example.com pointing to 127.0.0.2
botnet1.example.com pointing to 127.0.0.3
botnet1.example.com pointing to 127.0.0.4
botnet1.example.com pointing to 127.0.0.5
botnet1.example.com pointing to 127.0.0.6
Both the introduction of domain names, as well as the use of multi-
homing, assisted the bad guys in creating more robust C&Cs, but once a
server is down, it is down, and needs to be replaced.The weak spot, however,
moved from being the IP address (the computer serving as the C&C) to the
DNS record, which points to it.This technology facilitates better redundancy
and robustness of the control channel; it is not limited to just IRC.
Alternative Control Channels
Alternative control channels are exactly as named, an alternative communica-
tion channel by which to control a botnet.