Re: understanding the botnet C&C..

[T Biehn <tbiehn () gmail com>]

There were some trojans back in the day that would imitate normal browsing
(proxying cnn.com for instance) and it'd stuff a encrypted command packets
in there.
Combine that with a load balancing check-back time in the response, you can
probably support a very large number of bots on a single webserver.

-Travis

On Sat, Sep 17, 2011 at 8:10 PM, Corey Nachreiner <
Corey.Nachreiner () watchguard com> wrote:

> This basic video series may help:
>
>
> http://www.watchguard.com/tips-resources/video-tutorials/botnets-part-one.asp
>
> http://www.watchguard.com/tips-resources/video-tutorials/botnets-part-two.asp
>
> http://www.watchguard.com/tips-resources/video-tutorials/botnets-part-three.asp
>
> http://www.watchguard.com/tips-resources/video-tutorials/botnet-source-code-for-overachievers.asp
>
> That said, we made that ages ago. It is quite dated. Most modern botnets
> have started to use HTTP C&C channels, often encrypted. They also sometimes
> obfuscate their C&C via proxies and p2p. Leaked source code for Zues and
> spyeye probably would provide a better idea of how modern botnets work.
>
> Cheers,
>
> Corey Nachreiner, CISSP | Senior Network Security Strategist
> WatchGuard Technologies, Inc. | www.watchguard.com
>
> 206.613-0873 Direct
> 206.227.6905 Mobile
> corey.nachreiner () watchguard com
>
> Office Hours: 9:15 AM to 6:15 PM Pacific (GMT-8), Mon - Fri
>
> Better be despised for too anxious apprehensions, than ruined by too
> confident security. - Edmund Burke
> . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
> WatchGuard: Stronger Security, Simply Done
>
>
> -----Original Message-----
> From: full-disclosure-bounces () lists grok org uk [mailto:
> full-disclosure-bounces () lists grok org uk] On Behalf Of RandallM
> Sent: Friday, September 16, 2011 8:38 AM
> To: full-disclosure () lists grok org uk
> Subject: [Full-disclosure] understanding the botnet C&C..
>
> hi
> an area that I am basically "stupid" on is botnets. Not what they are
> but "how" they work through IRC as the control center. Not just that
> but the various modern programs used. I am aware for instance LOIC can
> be used to connect to an IRC channel.. but, how then does the "herder"
> do the job from IRC..how does he issue commands that all the computers
> connected act upon, etc. ? My curiosity has just got the best of me
> and I would like some pointers to good material that can feed it.
>
> Sorry for the "troll" like post but I really would like to understand
> this further. Have done a number of Google searching but have hope
> someone here has done personal research.
>
> --
> been great, thanks
> RandyM
> a.k.a System
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/



-- 
FD1D E574 6CAB 2FAF 2921  F22E B8B7 9D0D 99FF A73C
http://pgp.mit.edu:11371/pks/lookup?search=tbiehn&op=index&fingerprint=on
http://pastebin.com/f6fd606da

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/