6th European Conference - Academic Conferences

Ivan Burke and Renier van Heerden
Flaws in Google Gadgets have been demonstrated by Barth et al. (2009). They noted that JavaScript
can lead to exploitation. These vulnerabilities include session sharing vulnerabilities which enable
Cross-Site Scripting (XSS) and malicious redirects to Man-in-the-middle attacks. Google has been
reluctant to fix some of these vulnerabilities since 2004. (Robert 2008)
In Section 2, we investigate the composition of a basic Botnet. In Section 3, we describe our attempt
at mimicking these components. In Section 4, we discuss our Botnet model. In Section 5, we propose
possible future application of this work. In Section 6, we discuss our conclusion and possible means
of stopping these types of Botnets.
2. Anatomy of a botnet
Botnets tend to share communalities in their structure and design. In this Section, we describe the
common components of a Botnet as well as their role within the Botnet.
Figure 1: Anatomy of a Botnet
2.1 Command and control component
A large part of a Botnet’s success can be attributed to its ability to execute large, synchronized,
distributed attacks. This would require sophisticated command and control (C2) structures to coordinate
these attacks (Banks 2007, Ollmann, 2009).
Communication channels usually relay herder instructions, such as commands to execute on remote
PC. Bots use channels to send back retrieved data such as key logger information or command
response information. These communications need to be covert in order to hide the Botnet activities.
Over the years several covert channels have been used to communicate commands between Bot and
Botherder such as Twitter, Internet Relay Chat (IRC) and Instant Messages. Several advance C2
techniques such as steganography or social media sites to hide Botnet communication in plain sight.
Next we look at the types of attacks that could be executed by Botnots (Ollmann, 2009)
33