Feeds

IRC botnets dying off

Web-based zombies dominate

5 things you didn’t know about cloud backup

Web-controlled botnets now outnumber those controlled by the traditional method of IRC channel by a factor of five, according to the latest research from Team Cymru.

IRC channels used to be the only way to control networks of compromised PCs back in the day but the approach has fallen out of favour over the years as more script-kiddie-friendly approaches have begun to predominate.

IRC botnets are dying off, and would be dead and buried already but for weak corporate security policies that have allowed them to stick around, according to Steve Santorelli, former Scotland Yard Detective and now director of global outreach at Team Cymru.

Santorelli explained that many organisations do not filter port 6667, which is used for IRC channels and nothing else, allow infected PCs in corporate networks to receive instructions that would otherwise be blocked at the firewall.

"Infected machines that are part of IRC botnets often have persistent, continuous connections to their C&C, compared to HTTP based botnets which have their infected machines frequently 'check in' at pre-determined times," Santorelli explained. "These connections can be tell-tale symptoms if you know where to look."

IP blacklists and anti-virus software can also help combat comparatively unsophisticated botnet agents. "There is no excuse for allowing these relatively basic threats into your networks," Santorelli concluded.

HTTP-controlled botnets are easier than the IRC-controlled bots for miscreants to set up and run while being harder to detect, so it's no big surprise that they have become the preferred approach for the command and control systems of zombie networks. Web-based botnets are doubling in number every 18 months.

"HTTP based botnets often use ports (eg port 80 of course) that are unblocked on most networks and also hard to filter and easy to hide in a sea of noise," Santorelli told El Reg. "There is no persistent, constant connection to spot.

"They are very easy to configure and deploy - you need zero coding knowledge to run a web based botnet."

A short video explaining the changes in botnet control technology, published on Monday, can be found on Team Cymru's YouTube channel here. ®

Next gen security for virtualised datacentres

More from The Register

next story
Microsoft: We plan to CLEAN UP this here Windows Store town
Paid-for apps that provide free downloads? Really
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
Who needs hackers? 'Password1' opens a third of all biz doors
GPU-powered pen test yields more bad news about defences and passwords
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Hear ye, young cyber warriors of the realm: GCHQ wants you
Get involved, get a job and then never discuss work ever again
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.