ELI5: When botnets attack (e.g. Mirai/Dyn), isn't it a huge weakness to have all the bots report back to a single control server?
Can't you just follow that one IP address and see where it goes?
Posted Oct 24, 2016, 10:55 AM UTC
011
They don't report back to a single control server. They have multiple control servers.
The source code I was looking at the other day, had a mechanism to calculate a list of future control servers. That way, when a control server is taken down, the owner of the botnet registers the next domain on the list and the bots will connect with that when it comes online. These were domains like Gh47agdnbGafs452211.com as an example.
2
Why use domain names and not just an ip addr?
1
There's no guarantee that a bot server will have the same IP address at a later stage.
You also can't really predetermine which hosts are going to be able to be compromised.
A domain name can be made to point at any IP address, therefore from the bot owners perspective, if things change, they simply point the domain name at a new IP and everything keeps working (until the domain gets taken down, and they move on to the next one of course)
2
So there's still a paper trail to register these domains?
If the botnet owner is carding too then I can see that paper trail ending.
1
Someone using a VPN/Proxy/TOR/Compromised host as an SSH tunnel, entering fake details, and using a prepay credit card from a 7-11
...what papertrail ? :)
2
a prepay credit card from a 7-11
US I'm not surprised. Other G8 nations I don't think this is available.
1
They don't report back.
Someone sends a signal telling the bots what to strike and when.
Then the bots that get the instructions attack.
How does the person know where to send the instructions? And isn't it difficult to send instructions to tens of millions of devices, in the case of the DYN attacks?
I'm not 100% sure, but I always thought botnet/DDoS attacks were carried out through Internet Relays, like IRC. They subscribe to an IRC-like channel and wait for the go signal from the controller.
I might be wrong on that though (which is why I didn't write it as a top-level comment) so I stand to be corrected by someone who knows better.
Some of them were controlled over irc in the past, so while it's not necessarily true anymore it's true enough to count.
I suppose the reason they stopped using irc was the obvious ability to eavesdrop on the controlling session that way.
But it's still indisputable that if you bother to put up a coordinated attack you need a controller or master system to give the go. The bot must have a way to get commands or it would be useless to create the bot net in the first place.
It's a fair assumption though that you don't tie up half a million hardware routers to one single IP that is capable of controlling the bot net, because if you loose control of that IP you loose the bots too. So, at the very least you have a few segments. But nothing says you can't activate them all at the same time.
Edit: spellchecker "helped". A lot.
Ah right, I'm not a security guy so my info is almost certainly out of date!