A Novel Approach For Computer Worm Control Using Decentralized Data Structures
1–10 of 50 posts
Re: A Novel Approach For Computer Worm Control Using Decentralized Data Structures
#2is this a published paper? O_o
Re: A Novel Approach For Computer Worm Control Using Decentralized Data Structures
#3is this a published paper? O_o
No, it's not, and it's a pretty useless idea.
An expensive, slow, and extremely CPU and network intensive protocol is not what you want to use for stealthy malware communications. It could be done; you could also hammer a nail with a trout, but you'd look pretty foolish in the process.
Re: A Novel Approach For Computer Worm Control Using Decentralized Data Structures
#4is this a published paper? O_o
[deleted]
Re: A Novel Approach For Computer Worm Control Using Decentralized Data Structures
#5is this a published paper? O_o
No, it's not, and it's a pretty useless idea. An expensive, slow, and extremely CPU and network intensive protocol is not what you want to use for stealthy malware communications. It could be done; you could also hammer a nail with a trout, but you'd look pretty foolish in the process.
On what basis are you saying this paper "isn't published"? Just curious.
Re: A Novel Approach For Computer Worm Control Using Decentralized Data Structures
#6is this a published paper? O_o
No, it's not, and it's a pretty useless idea. An expensive, slow, and extremely CPU and network intensive protocol is not what you want to use for stealthy malware communications. It could be done; you could also hammer a nail with a trout, but you'd look pretty foolish in the process.
Yes, I agree with you on the part that it is not the most efficient network protocol, but you're overlooking the fact that blockchain is almost impossible to take down and is censorship-free. Even if they manage to locate the C&C; they simply couldn't shut it down, since BC is decentralised and a distributed database.
Re: A Novel Approach For Computer Worm Control Using Decentralized Data Structures
#7Haha, I had the same idea.
The since (valid) transactions are passed freely to all nodes in the Bitcoin network, one can just use the network as a signed messaging platform.
You don't need to query blockchain.info, all you need is a Bitcoin client that listens for incoming transactions.
I've been writing an implementation on and off for a while now. The general idea is as follows:
The botnet client connects to "n" Bitcoin nodes. If the same transaction is relayed by ceil(n/2) nodes, then we say that transaction is "confirmed" and examines the transaction to see if it's sent from botmaster's address (in fact we don't even have to use the botmaster's address, with BIP-0032 (https://github.com/bitcoin/bips/blob/master/bip-0032.mediawi...), we can use related public keys)
You don't even have to use transactions ("tx" messages), you can use the block messages if you are willing to tolerate an (on average) 10 minute delay, this would drastically reduce the network traffic sent/received by the botnet client.
But these guys forced my hand, so I suppose I'll have to release what I have so far. The current botcoin client (c++11 with boost::asio) connects to the network, and gets transactions. Data extraction from transactions is unfinished. The current problem I'm working on is making sure that people cannot easily scan the Blockchain to look for c&c transactions. This can easily be done by encrypting the messages with a client specific key. However, I would like to have perfect forward secrecy, that is, suppose a sample client was obtained by researchers, past c&c messages should not be able to be decrypted (otherwise the blockchain contains a log of all of your C&C messages).
[link redacted]
Re: A Novel Approach For Computer Worm Control Using Decentralized Data Structures
#8Earlier quoted context omitted.
No, it's not, and it's a pretty useless idea. An expensive, slow, and extremely CPU and network intensive protocol is not what you want to use for stealthy malware communications. It could be done; you could also hammer a nail with a trout, but you'd look pretty foolish in the process.
Yes, I agree with you on the part that it is not the most efficient network protocol, but you're overlooking the fact that blockchain is almost impossible to take down and is censorship-free. Even if they manage to locate the C&C; they simply couldn't shut it down, since BC is decentralised and a distributed database.
There's also the disadvantage of having every communication between the malware and the controller publicly logged, and the fact that that every command issued would have a small transaction free.
Re: A Novel Approach For Computer Worm Control Using Decentralized Data Structures
#9Earlier quoted context omitted.
No, it's not, and it's a pretty useless idea. An expensive, slow, and extremely CPU and network intensive protocol is not what you want to use for stealthy malware communications. It could be done; you could also hammer a nail with a trout, but you'd look pretty foolish in the process.
On what basis are you saying this paper "isn't published"? Just curious.
"Published" papers are papers published in a scientific journal after peer review. This just appears to be an un-reviewed article.
Re: A Novel Approach For Computer Worm Control Using Decentralized Data Structures
#10is this a published paper? O_o
No, it's not, and it's a pretty useless idea. An expensive, slow, and extremely CPU and network intensive protocol is not what you want to use for stealthy malware communications. It could be done; you could also hammer a nail with a trout, but you'd look pretty foolish in the process.
This would be the fallback com-channel, not the primary. If an ip or board gets taken down, no problem.