Boten ELISA: A novel approach for botnet C&C in Online Social Networks

Abstract

The Command and Control (C&C) channel of modern botnets is migrating from traditional centralized solutions (such as the ones based on Internet Relay Chat and Hyper Text Transfer Protocol), towards new decentralized approaches. As an example, in order to conceal their traffic and avoid blacklisting mechanisms, recent C&C channels use peer-to-peer networks or abuse popular Online Social Networks (OSNs). A key reason for this paradigm shift is that current detection systems become quite effective in detecting centralized C&C. In this paper we propose ELISA (Elusive Social Army), a botnet that conceals C&C information using OSNs accounts of unaware users. In particular, ELISA exploits in a opportunistic way the messages that users exchange through the OSN. Furthermore, we provide our prototype implementation of ELISA. We show that several popular social networks can be maliciously exploited to run this type of botnet, and we discuss why current traffic analysis systems cannot detect ELISA. Finally, we run a thorough set of experiments that confirm the feasibility of our proposal. We have no evidence of any real-world botnets that use our technique to create C&C channels. However, we believe that finding out in advance potential new types of botnets will help to prevent possible future malevolent applications.

Malware command and control over social media: Towards the server-less infrastructure

“…While the appearance of a certain uncommon character set in public SM posts cannot be a single factor in identifying such SM C2 communications, it may be one of the factors to take into account. Compagno et al [30] have devised yet a different model. In their peer-topeer botnet model called ELISA, the bot hides its exchange with a C2 server within the legitimate Facebook post of the ignorant owner of a bot: it attaches a set of non-printing characters, marking the start of the sequence by an invisible separator U+2063.…”

Construction and Performance Analysis of Image Steganography-Based Botnet in KakaoTalk Openchat

“…Especially, as the popularity of SNS (Social Network Service) and smartphones increase, researchers studied on SNS-based stegobotnets which are constructed in popular SNS platforms such as Facebook and Twitter [11,13]. The SNS-based stegobotnet has a couple of advantages over existing botnets.…”

“…Compagno et al [11] proposed a steganography-based botnet in Facebook and Google Plus. They used Unicode steganography technique in web pages.…”

“…To improve the stealthiness of botnet C&C communication, a novel type of stealthy botnet using image steganography techniques was introduced, which is known as steganography-based botnet (or stegobotnet in short) [10][11][12]. The stegobotnet hides its botnet C&C communication messages Figure 1.…”

Design e implementação de uma arquitetura conceitual para a criação de social botnet em redes sociais

“…Uma social botnet (SbN)é gerenciada através do seu controlador, também denominado formalmente como um botmaster, representado como um indivíduo sistema mal-intencionado com acesso a uma mais contas da OSN, sendo esse o modo pelo qual interage com a rede social. As atividades que um controlador executa através de uma social botnet são delimitadas pelo conjunto de ações que o OSN disponibiliza para qualquer usuário verdadeiro [Compagno et al 2015].…”