Tor Network Used to Command Skynet Botnet
Tor Network Used to Command Skynet Botnet.
Security researchers have
identified a botnet controlled by its creators over the Tor anonymity network.
It's likely that other botnet operators will adopt this approach, according to
the team from vulnerability assessment and penetration testing firm Rapid7.
The botnet is called Skynet
and can be used to launch DDoS (distributed denial-of-service) attacks,
generate Bitcoins -- a type of virtual currency -- using the processing power
of graphics cards installed in infected computers, download and execute arbitrary
files or steal login credentials for websites, including online banking ones.
However, what really makes
this botnet stand out is that its command and control (C&C) servers are
only accessible from within the Tor anonymity network using the Tor Hidden
Service protocol.
Tor
hidden services are most commonly Web servers, but can also be Internet Relay
Chat (IRC), Secure Shell (SSH) and other types of servers. These services can
only be accessed from inside the Tor network through a random-looking hostname
that ends in the .onion pseudo-top-level domain.
The Hidden Service protocol
was designed to hide the IP (Internet Protocol) address of the clients from the
service and the IP address of the service from the clients, making it almost
impossible for the parties involved to determine each other's physical location
or real identity. Like all traffic passing through the Tor network, the traffic
between a Tor client and a Tor hidden service is encrypted and is randomly
routed through a series of other computers acting as Tor relays.
Tor Hidden Services are
perfect for a botnet operation, said Claudio Guarnieri, a security researcher
at Rapid7 and creator of the Cuckoo Sandbox malware analysis system, in an
email on Friday. "As far as I understand, there is no technical way
neither to trace and definitely neither to take down the Hidden Services used
for C&C."
Guarnieri
published a blog post about the Skynet botnet on Thursday. He
believes that the botnet is the same one described by
a self-confessed botnet
operator in a
"IAmA" (I am a) thread on Reddit seven months ago. Reddit
"IAmA" or "AMA" (ask me anything) threads allow people who
perform various jobs or have various occupations to answer questions from other
Reddit users.
Comments