sponsors
usenix conference policies
Leveraging Honest Users: Stealth Command-and-Control of Botnets
Error message
You are not authorized to post comments.Diogo Mónica and Carlos Ribeiro, INESC-ID/IST
Botnets are large networks of infected computers controlled by an attacker. Much effort has already been invested in the detection and analysis mechanisms, capable of defusing this type of threat. However, botnets have been constantly evolving, and will certainly continue to do so. We must, therefore, make an effort to foresee and study possible future designs, if we are to be capable of timely development of adequate defense mechanisms.
Many of the most recent methods to detect and analyze botnets are based upon the vulnerabilities of their command-and-control (C2) infrastructure. We thus believe that attackers will follow a predictable evolutionary pattern, and start using designs with more robust and stealth C2 channels, thus minimizing the risk of shutdown or infiltration. In this paper, we will therefore analyze in detail a new kind of botnet C2 infrastructure, where bots do not possess any information concerning command-and-control mechanisms. These stealth, isolated bots are controlled through honest participants not pertaining to the botnet. This architecture eliminates the possibility of estimation of the botnet size, minimizes the probability of detection of individual bots, and eliminates the possibility of researcher infiltration.
Open Access Media
USENIX is committed to Open Access to the research presented at our events. Papers and proceedings are freely available to everyone once the event begins. Any video, audio, and/or slides that are posted after the event are also free and open to everyone. Support USENIX and our commitment to Open Access.
author = {Diogo M{\'o}nica and Carlos Ribeiro},
title = {Leveraging Honest Users: Stealth {Command-and-Control} of Botnets},
booktitle = {7th USENIX Workshop on Offensive Technologies (WOOT 13)},
year = {2013},
address = {Washington, D.C.},
url = {https://www.usenix.org/conference/woot13/workshop-program/presentation/m{\'o}nica},
publisher = {USENIX Association},
month = aug
}
connect with us