Botnets

5 important questions on Botnets

What newly features does new malware consist of by which it is harder to detect?

  1. Polymorphic - Bulk of the program code is obfuscated and changes between successive infections
  2. Metamorphic - Completely changes its shape between infections.

What technique is designed to make it harder to find C&C servers from botnets? What 2 fundamenntal approaches exist?

Domain-name generation algorithms (DGA)'s.
  1. Addresses are algorithmically derived, normally based on the current time as seed to the computation.
  2. Dynamic addresses can be based on recent externally available information as the seed of the calculation.

What strategy is used to increase the resilience of their systems? (Besides DGA)

Obfuscate destinations by IP fluxing, where IP addresses are assigned to domain names only for minutes.

This technique can be combined with a group of hosts forwarding packets into blind proxy redirection, here the pool of IP addresses obtained from the domain name resolution is not pointing to the actual location of the malicious content, but to a set of intermedia nodes.
  • Higher grades + faster learning
  • Never study anything twice
  • 100% sure, 100% understanding
Discover Study Smart

How does the double fluxed design strategy work with botnet design?

The authoritative domain server is continuously rotated. The DNS resolver of the clients will now escalate the query to one of many DNS servers under the botnet herder's control.

What C&C techniques exist besides centralized?

  1. Decentralized (P2P
  2. Hybrid

The question on the page originate from the summary of the following study material:

  • A unique study and practice tool
  • Never study anything twice again
  • Get the grades you hope for
  • 100% sure, 100% understanding
Remember faster, study better. Scientifically proven.
Trustpilot Logo