Ask the Expert

Is it possible to detect today's peer-to-peer (P2P) botnets?

How do today's peer-to-peer (P2P) botnets stack up against botnets of the past?

    Requires Free Membership to View

P2P botnets are just plain evil, I tell ya. Historically, botnets used centralized architectures for command and control. In this architecture, each bot-infected machine logs into a shared communications resource, such as an IRC (Internet Relay Chat) channel, and seeks evil commands from a bot-herder. Even today, most botnets are designed this way.

But the centralized architecture causes problems for the bad guys: it creates a single point of failure. If diligent investigators shut down the IRC channel or even remove the server(s) associated with that channel, the botnet becomes headless. An attacker might have spent a lot of time and effort setting up a botnet of 500,000 machines, possibly earning thousands of dollars per day, too, from the malware being propagated. If the IRC channel disappears, however, the whole criminal enterprise is blown out of the water.

To remedy this situation, attackers are turning to peer-to-peer (P2P) communication. In such an approach, an active bot on a machine can scan for other close machines that might have the same bot, one that's controlled by the same attacker. The bot can then join a botnet cloud of encrypted P2P communications. The bots can find each other nearby, making the collective unit self-aware, multi-connected and self-healing. If a given bot notices that its communicating peers have disappeared, it looks for more. So, in this arrangement, there is no single point of failure. The attacker can inject commands into any part of the botnet cloud, using crypto-algorithms to implement authentication. The bots will then dutifully distribute the commands amongst themselves, as the message cascades through the P2P botnet.

P2P botnets are persistent and difficult to remove in their entirety. It's important to carefully analyze a bot specimen and how it authenticates itself to nearby bot peers. It's also useful to investigate how commands from the attacker are formulated and authenticated. This required level of examination demonstrates just how insidious the average bot specimen has become.

More information:

  • Learn more about the risks of P2P networks.
  • Will the botnet threat continue? Ed Skoudis weighs in on the debate.
  • This was first published in July 2007

    There are Comments. Add yours.

     
    TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

    REGISTER or login:

    Forgot Password?
    By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
    Sort by: OldestNewest

    Forgot Password?

    No problem! Submit your e-mail address below. We'll send you an email containing your password.

    Your password has been sent to: