rc3.org Strong opinions weakly held

Re the Botnets: except that you want to keep the botnet control mechanism non-obvious and distributed so it can’t merely be overridden by, say, Blogspot taking control of that account. Avoid single points of failure.

As a simple first pass, having the botnet do a search for some cryptographically difficult to anticipate string that appears only on web pages that exist on free hosting sites, that may actually be interspersed with legitimate content, and use control codes then embedded in those pages, means both that Google has to anticipate those strings (or shut down non-dictionary words, which is fraught with problems, and the bot makers can then escalate to non-dictionary phrases), and that all the pages on which those strings appear have to be controlled.

The war has escalated far beyond “subscribe to an RSS feed and wait for commands”.

Posted by Dan Lyke on 24 August 2009 @ 10pm

I can think of some ways to make the RSS feed approach more secure and robust, for sure.

Posted by Rafe on 24 August 2009 @ 10pm

An RSS feed is only one way. Using Twitter it can be many to many, allowing the botnet to avoid being disabled via a single point of failure.

Posted by John on 25 August 2009 @ 2am

I’m reluctant to give anyone any ideas, but there are ways to ensure that only messages from the original source are accepted as valid, which would help prevent hijacking. The major problem would seem to be the ability of administrators to block the addresses that the botnet attempts to connect to.

The use of Google prevents blocking any single source of the control messages, since nobody wants to block Google. You’re essentially using Google as a name resolver, where the resolution to a particular site is not under anyone’s control at Google. Definitely a problem when dealing with low-pagerank results (e.g. based on spurious combinations of words) where it’s easy to get into the index.

Posted by Jacob Davies on 25 August 2009 @ 3pm

Yesterday I started writing up how I’d communicate with a botnet if it were up to me, but then I realized that only bad could come from posting it. Still, it’s an interesting problem to think about as a design exercise.

Posted by Rafe on 25 August 2009 @ 3pm