Social Network-Based Botnet Command-and-Control: Emerging Threats and Countermeasures

Abstract

Abstract. Botnets have become a major threat in cyberspace. In order to effectively combat botnets, we need to understand a botnet's Command-and-Control (C&C), which is challenging because C&C strategies and methods evolve rapidly. Very recently, botmasters have begun to exploit social network websites (e.g., Twitter.com) as their C&C infrastructures, which turns out to be quite stealthy because it is hard to distinguish the C&C activities from the normal social networking traffic. In this paper, we study the problem of using social networks as botnet C&C infrastructures. Treating as a starting point the current generation of social network-based botnet C&C, we envision the evolution of such C&C methods and explore social networks-based countermeasures.

Investigating survivability of configuration management tools in unreliable and hostile networks

“…Other social networks and third party services could be used as a CC channel by new botnets. [17] Cryptolocker and similar software encrypt user files and extort for money. The ransom must be paid in Bitcoin to receive the key to decrypt the files.…”

Social Networking for Botnet Command and Control

“…They all were tested simultaneously and the tests were successful and performed as expected. Kartaltepe [19] mentions one Twitter based command and control botnet identified recently. He has nicknamed it NazBot [19].…”

“…Kartaltepe [19] mentions one Twitter based command and control botnet identified recently. He has nicknamed it NazBot [19]. NazBot makes an HTTP GET request to upd4t3s twitter RSS feed [19].…”

Understanding socialbot behavior on end hosts

“…In order to understand and analyze socialbot behaviors both on end hosts and on the network side, researchers have also proposed several socialbot prototypes. EJ Kartaltepe et al 6 designed Naz+, which is based on Nazbot. It checks Really Simple Syndication (RSS) feeds on CompactSocial for experimental purposes.…”