6th European Conference - Academic Conferences

Who Needs a Botnet if you Have Google?
Ivan Burke and Renier van Heerden
Council for Scientific and Industrial Research, Pretoria South Africa
IBurke@csir.co.za
RvHeerden@csir.co.za
Abstract: Botnets have become a growing threat to networked operations in recent years. They disrupt services
and communications of vital systems. This paper, gives an overview of the basic anatomy of a Botnet and its
modus operandi. In this paper, we present a Proof of Concept of how Google gadgets may be exploited to
achieve these basic components of a Botnet. We do not provide a full fledged Botnet implementation but merely
to mimic its functionality through Google Gadget API. Our goal was to have Google act as proxy agent to mask
our attack sources, establish Command and Control structure between Bots and Botherders, launch attacks and
gather info while at the same time maintaining some degree of stealth as to not be detected by users.
Keywords: Botnet; Google Gadget; Command and Control; DDoS
1. Introduction
A Botnet is a collection of compromised computers or agents that are infected by malware. These
agents use sophisticated command and control techniques to execute complex and distributed
network attacks. Agents are usually unaware that they have been compromised and are partaking in
these attacks. They are often controlled by an external agent known as Botherders or master agents
(Banks 2007, Vamosi 2008).
According to Steward (in Vamosi, 2008), the techniques used by large Botnets such as Storm are
available online, but a Botnet is more than the sum of its parts. What makes a Botnet successful is
combining all these components into a coherent structure.
Stracener states in (Stracener, 2008), that future malware will run on the internet instead of
standalone computers. His premise is that, as the modern computer infrastructure moves closer to a
networked cluster or cloud so too will the threats to these infrastructures. He warns of his concerns
about malicious gadget and key vulnerabilities related to gadgets. A study conducted by WorkLight
Inc. (in MacManus, 2008), found that 48% of internet bank users, ages 18-34, would use secure thirdparty
Web 2.0 gadgets for their personal banking, if their banks did not provide them with such
functionality. This would imply the users would be able to make a informed decision about what it
means to identify a Web 2.0 gadget as being secure.
Stracener's concerns are mimicked by The Cloud Security Alliance in their paper (Hubbard et al.,
2010). They identify seven key threats to Cloud computing security:
Abuse and nefarious use of cloud computing
Insecure interfaces and APIs
Malicious insiders
Shared technology issues
Data loss or leakage
Count or service hijacking
Unknown risk profile
In this paper we demonstrate a rudimentary Botnet construct by exploiting Google services to host our
Botnet. We investigate the core components of a Botnet and then attempt to mimic the components
using Google Gadget API. It is not the goal of this paper to illustrate the weaknesses in a specific API
but rather to illustrate the danger of user generated content on the World Wide Web. Our aim is to
proof that online services can be organized into a botnet like structure.
Google Gadgets API is design for rapid development of small web based utility applications such as:
calendars, currency converters and news feed readers (Peterson, 2009). By including Open Social
API to a Google gadget, one can enhance shared gadget interaction and extend one’s gadget to the
Social Media domain.
32