Open WiFi networks: Lethal weapons for botnets?

Abstract

Abstract-This paper assesses the potential for highly mobile botnets to communicate and perform nefarious actions using only open WiFi networks, which we term mobile WiFi botnets. We design and evaluate a proof-of-concept mobile WiFi botnet using real-world mobility traces and actual open WiFi network locations for the urban environment of San Francisco. Our extensive simulation results demonstrate that mobile WiFi botnets can support rapid command propagation, with commands typically reaching over 75% of the botnet only 2 hours after injectionsometimes, within as little as 30 minutes. Moreover, those bots able to receive commands usually have ≈40-50% probability of being able to do so within a minute of the command being issued. Our evaluation results also indicate that even a small mobile WiFi botnet of only 536 bots can launch an effective DDoS attack against poorly protected systems. Furthermore, mobile WiFi botnet traffic is sufficiently distributed across multiple open WiFi networks-with no single network being over-utilized at any given moment-to make detection difficult.

Modeling and Control of Malware Propagation in Wireless IoT Networks

“…However, the above method to detect the malware cannot predict malware spread scale and explore the key factors affecting the spread of malware. In the wireless IoT network, malware hostile activities naturally extend to physical threats and can be launched by one wireless device and spread to another device [13]. Propagation vectors such as services or functions may be used to propagate malware due to different vulnerabilities that emerge across different technologies such as IoT or IPv6 and the lack of experience in technical implementation.…”

CPbot: The Construction of Mobile Botnet Using GCM

“…SUbot [4] is an improved and expanded version of Andbot. Wi-Fi [5] and VoIP [6] based C&C channels are also proposed in some articles. Although those special C&C channels are stealthy, they are difficult to construct.…”

Το Πρωτόκολλο DNS Ως Πολυλειτουργικός Φορέας Επίθεσης

“…Thereupon, traditional defence mechanisms that block requests stemming from blacklisted IP addresses are not normally applicable to this case. Furthermore, a resourceful botmaster could configure the bots to utilize only open Wi-Fi networks in an effort to eliminate the traces of the true perpetrator behind, say, a DDoS incident [227].…”