Posts

A defining characteristic of a bot is its ability to be remote-controlled by way of command and control (C2). Typically, a bot receives commands from its master, performs tasks and reports back on the execution results.

ARP, the address resolution protocol, is used on an Ethernet network to map IP addresses to hardware (MAC) addresses. By default, a Linux box with several network interfaces will respond to ARP requests received on any interface for any of the IP addresses of its interfaces.

DNS as carrier for botnet C&C seems to be getting popular. Concerning its usage as botnet C&C, DNS has not been seen so far. Additionally, in typical network environments, DNS (at least when destined for the preconfigured DNS resolvers) is usually one of the few protocols – if not the only one – that is allowed to pass without further ado.

On Thursday 11/11/2008, the US company McColo (AS26780) got cut off the Internet. McColo has been known for some doubtful activities - some say that McColo is responsible for as much as 75% of all spam sent on the Internet.