For internet browsing, a client system may send 10 packets (in this case implying data packets payloads, not just TCP packets) to a server for every 100 packets it receives, making the internal:external sent packets (or data size) a 1:10 ratio. Imagine, if you will, the size and the directionality of the network data in the standard client-server relationship. This is the standard client-server relationship.

The server then provides resources back to the client system. In the greater information technology space, the “client” is usually a program/user on a host/workstation (inside your network), and, in that relationship, the client sends numerous requests to the server (outside your network). Backdoor-Controller Relationship and Nomenclatureįor the purposes of this discussion, we will bypass the common lingo for client-server relationships and instead deviate into specific malware vernacular. Each service provider listed is working unremittingly to identify and stop abuse whenever possible.īefore we detail the variety of legitimate services and malware using them, let’s first address how backdoors typically connect and communicate. We by no means wish to imply that these providers are negligent in policing abuse, nor do we wish to suggest that these services are unsafe for use by the layperson. We would like to state at the beginning of this paper that in describing legitimate services C2 we will be specifying internet service providers that are being abused by malicious actors. In this report we expand on this concept, identify challenges and potential detection techniques, and provide an appendix of examples of what this network traffic may look like. One of the most notable trends in the evolution of malware is the rise of command-andcontrol (C2) channels using so-called “legitimate services,” or simply “legit services.” In this context, and for the purposes of this report, “legit services C2” refers to malware abusing common internet services such as Twitter and GitHub, employing fake users and accounts, and otherwise utilizing such service APIs as part of a C2 schema. Attackers, on the other hand, are constantly evolving their toolsets to subvert existing detection techniques and technologies. Backdoor Command-and-Control via “Legitimate Services”ĭefenders rely on their ability to identify attacks early, providing enough time for a thoughtful and thorough incident response. The purpose of this paper is to detail the technique, note its rise in prevalence, and suggest experimental methods to detect it. There is currently little public research on use of legitimate services for C2. There is a rise in the number of malware ecosystems that use legitimate internet services as part of a command-and-control (C2) schema, adding yet another layer of abstraction between attackers and network defenders.

Iexplorer registration code pastebin