syssec_red_book

11 The Botnet that Would not DieLinked through malware, botnets are cyber infrastructures consistingof hundreds, thousands, or even millions of hosts that are all underthe control of criminals. Botnets are responsible for most of the illegalactivities on the Internet today: spam, denial of service attacks, theft of sensitiveinformation (passwords, banking details and intellectual property), and spreadof further malware. Moreover, botnets are the workhorses in high-profileincidents such as the state-sponsored Stuxnet attack on the uranium enrichmentfacility in Iran.Despite the alarmist headlines in the popular press (sometimes echoedby researchers) about the highly advanced botnets that supposedly threatenthe very Internet itself—and everything connected to it—so far it has beenrelatively simple to take them down.This is about to change.11.1 What Is the Problem?In this chapter, we will argue that botnets are becoming so resilient that verysoon, they cannot be taken down using conventional means (e.g., using asinkhole, or taking down a few servers). In all probability, the only realisticway to take down such botnets will be to resort to what is known as “hackingback:” abusing vulnerabilities in the malware to compromise the botnet fromthe inside out. However, as doing so involves actively executing code on otherpeople’s machine (a criminal offense in most countries), this is something forwhich our legal system is not at all prepared. It is also hugely unpopular.In this chapter, we will describe the trends towards more resilience inmodern botnets. Moreover, we will back up our arguments with data from realbotnets—to convince the reader we are not yet another group of researcherscrying wolf.11.1.1 P2P BotnetsThe most common type of architecture for existing botnets is still based on acentral Command-and-Control (C&C) server. Consequently, these C&C servers