Re: detecting network crowd surges

[Greg Martin <gregm () econet com>]

> I wonder, though, is this how real botnets are controlled?
>
> Surely it would be fair easier, and less obtrusive, to control your
> botnet via a updated http site. like
> http://<mikeiscool>/instructions.txt. Every day the bots would log on
> and receive their latest orders. Makes sense to hide in http rather
> then risk a protocol that might be blocked, doesn't it?
>
> -- mic

Correct but botnets came from the underground IRC world, where most of
the reusable c&c code was developed.  These people know IRC well, it is
an easy channel for them to develop upon.

The second factor is available zombie management.  A pure pull method
with http would make it hard for the bot herder to track his available
zombies, rather than just looking how many users are in an IRC
channel.  

Common sense tell us botnets will continue to use IRC less as detection
efforts such as the one described in the thread become more common.  The
real challenge will be when they go to covert tunneling capabilities for
C&C such icmp and dns packets.


-Greg



------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw 
to learn more.
------------------------------------------------------------------------