[Paper Review] Master of Puppets: Analyzing And Attacking A Botnet For Fun And Profit

Genki Saito, Gianluca Stringhini|arXiv (Cornell University)|Nov 19, 2015

Network Security and Intrusion Detection30 references3 citations

TL;DR

This paper reverse-engineers the command-and-control (C&C) infrastructure of the Cutwail/Pushdo botnet using its source code, enabling researchers to develop and test attacks that disrupt botnet operations. It demonstrates that just 2,000 compromised bots can overwhelm the C&C server, impersonate legitimate bots to inject false data, and enumerate bot counts—providing actionable, generic strategies for dismantling similar botnets.

ABSTRACT

A botnet is a network of compromised machines (bots), under the control of an attacker. Many of these machines are infected without their owners' knowledge, and botnets are the driving force behind several misuses and criminal activities on the Internet (for example spam emails). Depending on its topology, a botnet can have zero or more command and control (C&C) servers, which are centralized machines controlled by the cybercriminal that issue commands and receive reports back from the co-opted bots. In this paper, we present a comprehensive analysis of the command and control infrastructure of one of the world's largest proprietary spamming botnets between 2007 and 2012: Cutwail/Pushdo. We identify the key functionalities needed by a spamming botnet to operate effectively. We then develop a number of attacks against the command and control logic of Cutwail that target those functionalities, and make the spamming operations of the botnet less effective. This analysis was made possible by having access to the source code of the C&C software, as well as setting up our own Cutwail C&C server, and by implementing a clone of the Cutwail bot. With the help of this tool, we were able to enumerate the number of bots currently registered with the C&C server, impersonate an existing bot to report false information to the C&C server, and manipulate spamming statistics of an arbitrary bot stored in the C&C database. Furthermore, we were able to make the control server inaccessible by conducting a distributed denial of service (DDoS) attack. Our results may be used by law enforcement and practitioners to develop better techniques to mitigate and cripple other botnets, since many of findings are generic and are due to the workflow of C&C communication in general.

Motivation & Objective

• To understand the command-and-control (C&C) workflow of one of the world’s largest spamming botnets, Cutwail/Pushdo, active from 2007 to 2012.
• To identify systemic weaknesses in the C&C communication logic that can be exploited to disrupt botnet operations.
• To develop and validate practical attacks—such as DDoS, impersonation, and data manipulation—against the C&C server using a controlled botnet clone.
• To provide generic, reusable mitigation techniques applicable to other botnets based on common C&C communication patterns.

Proposed method

• Reverse-engineered the C&C server source code of the Cutwail botnet to fully understand its internal logic and communication protocols.
• Implemented a stub bot to emulate real bot behavior and establish controlled connections to the C&C server.
• Set up a private network of cloned bots to interact with a controlled C&C server, enabling safe experimentation.
• Conducted targeted attacks: DDoS to overwhelm the C&C server, impersonation to report false status, and database manipulation to alter spam statistics.
• Used the controlled environment to extract bot count, test deception techniques, and measure system resilience.
• Validated that 2,000 bots were sufficient to render the C&C channel inoperable, demonstrating a low-threshold attack vector.

Experimental results

Research questions

• RQ1 What are the core functional components of the Cutwail botnet’s C&C infrastructure that enable large-scale spam operations?
• RQ2 How can access to the C&C server source code enable the discovery of systemic vulnerabilities in botnet control workflows?
• RQ3 To what extent can misbehaving bots disrupt the C&C server through DDoS, impersonation, or data manipulation?
• RQ4 Can the insights from attacking Cutwail be generalized to other botnets with similar C&C communication patterns?

Key findings

• A DDoS attack with only 2,000 bots was sufficient to completely overwhelm the Cutwail C&C server, rendering the botnet non-operational.
• Misbehaving bots could successfully enumerate the total number of active bots registered with the C&C server, enabling accurate botnet size estimation.
• Bots could impersonate legitimate bots and report false status or spam statistics, deceiving the botmaster into removing trusted bots.
• The C&C server stored and relied on bot-reported data, making it vulnerable to manipulation that could degrade the botnet’s operational efficiency.
• The source code access allowed full reconstruction of the C&C protocol, including cryptographic mechanisms, without requiring reverse engineering from network traffic.
• The identified vulnerabilities are generic and stem from the C&C workflow rather than implementation-specific flaws, making them applicable to other botnets.