Comment by 0points

> Wow, that's smart. I was wondering whether there is a way for the bots to generate "unpredictable" domains such that security researchers could not predict them efficiently (even with source code), but the botnet controller can.

There is a fairly simple method which achieves the same advantage for a botnet controller.

1. Use a hash of the current day to derive, for that day, an infinite stream of domain names. This could be something as simple as `to_human_readable_domain(sha256(daily_hash + i))`.

2. A botnet slave attempts to access servers in a diagonal order over (days, domains), starting at the first domain for today and working backwards in days and forwards in domains. An image best describes what I mean by this: https://i.imgur.com/lcEbHwz.png

3. So long as one of those domains is controlled by the botnet operator (which can be verified using a signed response from the server), they can control the botnet.

This means that the botnet operator only needs to purchase one domain every couple of days to keep controlling their botnet, while someone trying to stop them will have to buy thousands and thousands every day.

And when you successfully purchase a domain you can publish the new domain to any connected slaves, so this scheme is only necessary for recruitment into the network, not continued control.

there are tools pretty good at detecting DGAs these days, but not often implemented.

the best thing to do afaik is use services normal user shave access to, and communicate via those. its hard to tell for anyone who's extracting the data from the third party so the server is hidden. (e.g bot posts images to twitter, and server scrapes the images from twitter, this is also already old news but easier and more likely to sail through that next gen firewall -_-)

i'd say having ur 'own' servers and domains is maybe even a bit dated ( though sadly still very effective!)

I can see a future where Cloudflare or similar offer a DNS + proxy + Root CA combo to intercept these. Maybe they already do.

Use a hash chain!

Each time you resolve, the resulting IP can be part of the hash for predicting a future hostname.

Oh, hah. Well that doesn't seem intentionally malicious then.

I added it in the first place as it was a non-resolving .gov in the top 50 list which seemed out of place to me.

> bldrdoc.gov: No address associated with hostname

I see that the time related subdomains in your link do resolve to the nist.gov timeserver.

But I really am wondering what's up with all of the rest of these domains.

Interesting how ad services and botnets behave similarly in some aspects