Leveraging Bitcoin Testnet for Bidirectional Botnet Command and Control Systems.

No ratings

Presented at FinancialCryptographyandDataSecurity 2020 by

Federico Franzoni

Vanesa Daza

Iván Abellán

Over the past twenty years, the number of devices connectedto the Internet grew exponentially. Botnets benefited from this rise toincrease their size and the magnitude of their attacks. However, they stillhave a weak point in their Command & Control (C&C) system, whichis often based on centralized services or require a complex infrastructureto keep operating without being taken down by authorities. The recentspread of blockchain technologies may give botnets a powerful tool tomake them very hard to disrupt. Recent research showed how it is possible to embed C&C messages in Bitcoin transactions, making them nearlyimpossible to block. Nevertheless, transactions have a cost and allow verylimited amounts of data to be transmitted. Because of that, only messages from the botmaster to the bots are sent via Bitcoin, while botsare assumed to communicate through external channels. Furthermore,for the same reason, Bitcoin-based messages are sent in clear. In this paper we show how, using Bitcoin Testnet, it is possible to overcome theselimitations and implement a cost-free, bidirectional, and encrypted C&Cchannel between the botmaster and the bots. We propose a communication protocol and analyze its viability in real life. Our results show thatthis approach would enable a botmaster to build a robust and hard-todisrupt C&C system at virtually no cost, thus representing a realisticthreat for which countermeasures should be devised.