Alternative Botnet C&Cs

This chapter discusses the alternative Botnet Command and Control Servers (C&Cs). Internet Relay Chat (IRC) is the origin as well as the most-used type of C&C. The most commonly used C&C type after IRC is the Web server. A Web-based C&C server does the same as an IRC-based C&C server. The main difference is the control channel, which is a different protocol altogether. There are two types of Web-based botnets: the echo based and the command based. The echo-based botnet means that the bot would simply announce its existence to the C&C. There are several ways of doing this with different volumes of data relayed: connect & forget, file data, and URL data. The Web-based botnets that are command based are an addition to any other type of botnet, which helps the botnet controller manage the army of compromised computers. These are the GUI Web interfaces by which the botnet controller can issue instructions, by working in push mode.