427 Botnet fm qxd

www.syngress.com
Alternative Botnet C&Cs • Chapter 3
83
427_Botnet_03.qxd 1/8/07 11:56 AM Page 83

---

Connect & Forget
Connect & forget means that the bot would connect to the Web server and
that’s that.The botnet controller would need to collect these connections
somehow, usually by the means of a log file, to be able to view the IP
addresses of the bots.
In some cases, Web counters (visit-count) services have been used for this
purpose, rather than a specially created Web site, as another example.The
botnet controller would then connect to each and every one of these bots,
mostly via a backdoor port that the Trojan horse opens.
There are some IRC-based botnets that run much the same way.The bot
connects to the IRC server and does nothing else. It is hidden to anyone but
the server administrators.
File Data
Another type of C&C similar to connect & forget botnets are Web servers
that host files with instructions for the bot, so that when it connects, it down-
loads the new instructions. Instead of instructions, an executable can be placed
on the Web site. In that case, the bot will download it as an update to replace
itself with, or as yet more malware to be installed on the compromised com-
puter.
URL Data
In some occasions, the bot would send a full URL to the Web server.That
URL would contain information of importance to the botnet controller, such
as the port of the backdoor software or the password required to access this
specific bot, both of which are randomly selected for each bot.
A URL will look something like:
http://botnet1.example.com/blah.txt?port=34556password=qwerty211
This URL will later be parsed for the relevant information, and the con-
troller will use it to connect to all the bots and give them instructions.
Command-Based Botnets
Web-based botnets that are command based are an addition to any other type
of botnet, which helps the botnet controller manage the army.