So, a botnet is different than isolated pieces of malware
in the fact that a botnet is a collection of infected machines
which are coordinated
through command and control by a central server,
which is called a "command and control server", or,
the C&C server.
So the power of botnets is basically
in the amount of distributed computation and storage power
that is available to a C&C server.
[Offscreen voice] It's short for robot, is it then, I'm guessing?
Yeah, so the "bot" is basically for
machines that can operate in an automated fashion,
which refers to the robot,
the thing that you mentioned.
[Offscreen voice] Okay, and a botnet is a collection of these
that somebody's using for
nefarious purposes; would that be right?
[Offscreen voice] Or does it have to be?
Yeah, usually it is for nefarious purposes,
so, the main two strengths of a botnet,
from the point of view of a bad guy,
is: One, that there is, um, they are, like,
bots on the order of hundreds and thousands of machines;
so, there is a lot of distributed computing and storage power available there.
And the other one is a certain delegation of responsibility or deniability,
which the infrastructure affords to the person who runs the botnet,
in terms of, that the person conducts all these nefarious activities
from the platform of the bots,
and not just directly.
Usually people are not aware;
and, basically,
stealth and botnets usually go hand in hand,
because, from the point of view of the C&C server,
it wants to ensure that the bots remain infected
and available, and
stay that way for the longest period of time possible.
So, if the user is aware that,
you know, it has been infected, then you
typically, they would probably
reinstall the operating system
or take other measures to clean the machine,
which doesn't work in the favor of the
botnet controller.
[Offscreen voice] I'm assuming this starts from people opening
dodgy emails, or something. Is that the sort of thing
that starts this off
for an innocent user sitting there
using their computer?
So, every botnet has a propagation mechanism;
and, nothing stopping it from using multiple propogation vectors.
So, for example, a botnet
can spread itself in passive ways,
or in active ways. So, active ways
usually involve little or no user intervention;
basically no user intervention
in the sense that, if a machine
has been infected, then
the bot binary has inherent mechanisms
to find other hosts on the internet to infect.
For example, by scanning for hosts
that have known vulnerabilities that can be exploited.
And then, there are passive mechanisms
that use -- that require some degree
of user intervention.
For example, drive-by downloads,
which are websites
that have, say, some active content
like JavaScript, or ActiveX controls.
So just a user,
when he or she visits the website,
the installation of the malware
takes place in an automated fashion.
[Offscreen voice] So, just because they visited that website,
the website might be doing something that they think,
Oh look, Flash, active
this, that, or the other, and
fancy graphics. But in the background,
it could be doing something much more serious.
Yeah, and um,
there are other passive ways, also.
I mean, social engineering is a very powerful way
of spreading malware in general, especially botnets,
which involves some kind of
human interaction to convince
a user to take steps that
they would otherwise not do.
For example,
a pop-up thing
that pops up and says,
You have won the lottery. Click on this link
to claim the money. And you click on the link,
and it initiates the download of the malware
to your machine.
And then, we also have propagation mechanisms
like, uh,
like media. For example, USB sticks.
Which is potentially very powerful,
because it allows the infection to spread
to private networks
which are otherwise inaccessible over the internet.
I mean, usually the malicious binary
is in the form of an executable.
So, it just starts running, right,
like, it doesn't need you to double-click it.
[Offscreen voice] Where does the command machine come in?
[Offscreen voice] You know, is that being controlled by someone,
or is that itself a bot?
So, I think we can make use
of some diagrams here. [Offscreen voice] Yeah, yeah, absolutely.
Okay, so here is the C&C server here.
And, here is the user.
The innocent user.
Say that, through whatever propagation vector,
either through clicking on some bad links,
or through some infected media,
the user installs the malicious software.
If it's associated with a botnet,
usually it's called a "bot binary".
Binary means the executable code which
can be directly run by the machine without the need to be compiled.
By installing the bot binary,
the user
has got the infection, but
it is not formally part of the botnet now.
It needs to find some way
to locate the C&C server
to be able to exchange messages with it.
So, it needs some rallying mechanism.
Now, the rallying mechanism can take place
in the form of an IP address.
That is, the IP address can be hard-coded
into the bot binary. Or the user
can obtain a seed list of IP addresses,
which would be basically IP addresses of
some other hosts which know
how to locate the C&C server.
So basically, like stepping stones between
the C&C server and the user
to locate the C&C server.
Apart from IP address, the user could
also potentially use some domain name
related to the C&C server, and
the domain name could likewise be hard-coded
into the bot binary; or the user can
make use of some algorithm,
which is known to the user,
and to the C&C server to generate
predictable domain names
which are then associated with the C&C server.
Either way, once the user finds out
how to communicate with the C&C server,
it connects to it.
Now the user is formally part of the botnet,
and it has kind of registered itself
with the botnet.
So typically, the C&C server wants the bots
to carry out certain nefarious activities
on its behalf. It is able to access
that particular bot.
Now, the purposes for which these bots can be used
are different.
For example,
the bots can be used for the purpose of information gathering,
which involves, uh,
sensitive information like passwords,
credit card information,
or information that is not of a financial nature
but's still valuable, for example,
intellectual property.
The other purpose for which the botnet
can use its bots is
for distributed computing.
For example, distributed password cracking,
getting bots to solve CAPTCHAs,
basically, anything that requires
proof of work, and is infeasible
for, um, for the botmaster,
the person who controls the botnet,
to carry out individually.
It can distribute it across
the recruited bots
and get them to do it on its behalf.
[Offscreen voice] The C&C machine is obviously
under the control of the -- whoever the botmaster is.
Yeah.
[Offscreen voice] Um, is that there usually their own computer,
or is that again remote from them?
[Offscreen voice] So is there -- I was wondering if there was a way
of tracing them?
Yes. So --
It would be very naive of a botmaster to directly
use its own machine for the C&C purposes.
And, usually, how it
evades detection
is to incorporate
several stepping stones between itself
and the machine.
And, for example,
it could login to that machine
or access that machine using the TOR network.
So that way, it is using that machine anonymously
and remove all traces of its identity,
and basically be untraceable.
[Offscreen voice] How many botnets are actually operating on the internet at the moment?
[Offscreen voice] Is there -- can anyone hazard a guess
at those numbers, or --
It's hard to say, because
um, I mean, how can you count
the number of bots that are controlled, right?
Like, if it's a centralized
botnet, and there is, say,
one, or like a limited number
of C&C servers -- In one specific case,
they looked at all the
incoming connections to the C&C server,
which kind of helped them estimate
the footprint of the botnet, which is the number of bots
that formed part of the botnet.
But, who knows if there are other C&C servers
related to the same botnet?
Because, you know, like, looking from the vantage point
of one C&C server would afford you visibility
into only its own footprint.
So, there have been academic
studies on estimates of
botnet footprints.
Um, but one cannot really
be completely accurate about that.
[Offscreen voice] Is there any way that that kind of technology can be
used for good? Or, is it always for nefarious reasons? [Laughing]
Well, uh --
It's kind of being used for the good,
in the context of censorship resistance systems,
where good users are trying to access
some content which has been banned in their country,
using more or less the same evasive measures
which are used by botnets
or malware to evade security people.
So, it's the same model, turned upside-down.
By subtracting these frames from each other,
we can virtually shroud [camera shutter sounds]
the influence of daylight.
So, we can even eliminate
cast shadows...