Steganographic Command and Control: Building a communication
channel that withstands hostile scrutiny Botnet command and
control channels have traditionally been carried over protocols
such as IRC (Internet Relay Chat) or the various P2P (Peer To
Peer) networks. If an incident response investigator knows where
to look, they could potentially discern a command and control
channel, if not by plain-text content, then at least by
statistical methods. Organizations could also attempt to filter
these protocols at their borders since their business use, in
the cases of IRC and P2P, is questionable at best. As time has
progressed work has been done to use less obvious protocols like
HTTP and websites with user generated content to pass messages
to a botnet's nodes. Projects like Robin Wood's KreiosC2 have
demonstrated using social media systems like Twitter, advancing
the idea of using Web 2.0 media as "blind drops" to help
obfuscate who is controlling the botnet, as well as making it
harder to block since the comman