427 Botnet fm qxd

www.syngress.com
82
Chapter 3 • Alternative Botnet C&Cs
427_Botnet_03.qxd 1/8/07 11:56 AM Page 82

---

When the C&C server (or servers) is down, the botnet is effectively dead.
There is no way for the botnet controller to issue instructions or even know
what bots are under his control. For that reason, if all else fails, the alternative
control channels are introduced.
In most bots, these are hard-coded as a backdoor, opening a TCP port on
the system, allowing for remote connection, which will give administrative
control of the compromised computer. Effectively, a different control interface
for the bot. A push from the botherder rather than a pull from the bot client.
In other cases, there are backup C&Cs in place, at times using a different
control channel altogether.That way, if communication is lost, the bot can
reestablish communication with its master and be redirected—jumped, to a
new C&C server.
In one noteworthy case in late 2004 involving a large botnet, 350,000
hosts strong, the C&C server was sinkholed (redirected and tapped by the
good guys) to an IP controlled by botnet hunters. In a matter of just a couple
of days, most of these bots stopped connecting to the C&C. Presumably they
were jumped elsewhere.
Web-Based C&C Servers
IRC may be the origin as well as the most-used type of C&C, but it is not
the only one, by far.The most commonly used C&C type after IRC is the
Web server. A Web-based C&C server does much the same as an IRC-based
C&C server; the main difference is the control channel, which in this case is a
different protocol altogether.
There are two types of Web-based botnets: echo based and command
based.
Echo-Based Botnets
Echo-based means the bot would simply announce its existence to the C&C.
There are several ways of doing this with different volumes of data relayed.
■
Connect & forget
■
File data
■
URL data