What Is Command and Control?

What Impact Will C&C Bring?

Currently, as most network border defense measures are effective, directly connecting to a target host from the extranet is difficult for an attacker. However, there are often no strict restrictions on connections initiated from the intranet, which gives attackers a chance. C&C communication can exploit this to infect a host. If a malicious program has been implanted to a victim host, the program usually establishes an outbound connection to the attacker's computer. After the attacker successfully accesses the intranet host, the attacker can perform the following operations:

• Lateral movement

  The first compromised host is usually not a high-value target, as critical systems are well protected. Instead, attackers exploit this compromised host as a pivot to gather information about other hosts and move laterally within the network toward more valuable hosts. Attackers repeat this process to access and control high-value targets.

• Confidential data theft

  As C&C communication is bidirectional, an attacker can both send instructions to a victim and instruct the host to send confidential data back to the C&C server. Attackers often steal confidential data and use it to extort victims. If the victims refuse to pay, the attackers may leak or sell the stolen information.

• DDoS attack

  Distributed denial of service (DDoS) attacks are launched by botnets. A botnet is a group of hosts that have been infected by malicious programs and controlled by attackers. The infected hosts are generally called zombies. An attacker sends instructions to a zombie through a C&C server to launch a DDoS attack on a target.

• APT

  An advanced persistent threat (APT) usually takes a long time and is sometimes suspended by an attacker in a certain phase on purpose. For example, after an attacker obtains control over some hosts through a C&C server, attackers may remain dormant to await optimal attack opportunities, or alternatively, sell the C&C server and victim hosts as a package to other malicious actors.

Harmfulness of C&C

C&C Communication Modes

C&C communication involves two important roles: C&C server and C&C client. The C&C server is a host controlled by hackers, and the C&C client is a victim host that is implanted with malicious programs. A C&C server not only collects information about C&C clients, such as the operating system (OS), application software, and open ports, but also sends control instructions to the C&C clients to instruct them to perform malicious activities. Attackers can also use C&C clients as springboards to infect more hosts on the network, increasing the number of C&C clients.

Key roles in C&C communication

Generally, malicious programs can be disguised as normal software to infect victim hosts through phishing emails and malicious websites. As the infection process is random, attackers cannot predict which hosts are infected. As such, malicious programs on the victim hosts need to proactively communicate with the C&C server. The malicious program on each victim host maintains communication with the C&C server and re-initiates a connection in case of a disconnection.

Common C&C communication methods are as follows:

• Accessing the C&C server through an IP address

  This is the most common type of communication with the C&C server. An attacker hardcodes the IP address of the C&C server in a malicious program, and then the C&C client sends a communication request to the IP address. This communication mode is simple, but the server can be easily detected. To defend against such an attack, a network administrator can block the IP address. By doing this, the attacker can no longer control the C&C client.

• Accessing the C&C server through a domain name

  An attacker hardcodes the domain name (instead of the IP address) of the C&C server in a malicious program, which makes the server covert. However, the server is also easy to detect. To defend against such an attack, a network administrator can block the domain name. By doing this, the attacker can no longer control the C&C client.

• Fast-flux

  Fast-flux technology constantly changes the mapping between domain names and IP addresses. As such, it is difficult to discover all mappings between the IP addresses and domain names and block them in one go. This technology can be mitigated by discovering the mappings between IP addresses and domain names. For example, a network administrator can mine all mappings between IP addresses and domain names using a short time to live (TTL) setting.

• Using a website or forum as a C&C server

  Attackers send C&C control instructions in unpopular areas of some forums or on popular websites, and then allow malicious programs to obtain the instructions from the website or forum through a crawler, making detection difficult. However, mitigation is relatively straightforward—reporting the issue to the website administrator, who can block the malicious account.

• Generating random domain names using DGA

  The Domain Generation Algorithm (DGA) can be used to generate a large number of random domain names that are to be accessed by C&C clients. This is a mainstream C&C communication method. As domain names are randomly generated, the attack is difficult to detect and defend against. Generally, machine learning is used to detect DGA domain names and automatically add such domain names to a blacklist or block related traffic.

How to Detect and Defend Against C&C

The key of C&C attack defense lies in whether an attacker can successfully hide the C&C service. After discovering a hidden C&C service, a network administrator can take technical measures to terminate C&C communication before processing victim hosts.

The following methods can be used to detect C&C traffic and attacks:

• Detecting traffic to external networks

  Most network security defense measures focus on the presence of threats in incoming traffic but less on outgoing traffic, which can be exploited by C&C attacks. After a C&C connection is initiated by a victim host, many subsequent interaction processes and malicious program downloading are not blocked. In this case, rules can be configured on a gateway to detect intranet-to-extranet traffic to prevent the traffic from being unsupervised.

• Detecting beacons

  If a malicious program infects a host, a beacon is sent to notify the attacker of successful infection. Thereafter, the malicious program can stay idle and periodically checks in to the C&C server for further instructions. Beacons can also be sent as a type of heartbeat to inform the attacker that a host is active.

• Logs

  A network administrator can collect as many logs as possible and analyze them. In the past, security analysts relied on massive logs to look for abnormal information, such as HTTPS or DNS requests that might contain malicious program file data. Currently, many security products and systems support intelligent analysis of massive logs, which greatly improves analysis and processing efficiency.

• Correlation analysis

  Sometimes attackers hide malicious behaviors so that it is difficult for network administrators to detect threats from individual events. In this case, massive data can be collected and analyzed on the entire network to discover the correlation of the data and hidden malicious behaviors.

C&C technology is mainly used after malicious programs infect hosts. We believe guiding users on preventive security behaviors in advance will prevent hosts from being infected. The following are some preventive suggestions:

• Try to download software from official websites instead of small websites, web disks, and forums.
• For security software installed on a host, periodically scan the system to prevent viruses and Trojan horses.
• Upgrade and update software and systems in a timely manner to prevent attacks exploiting known vulnerabilities.
• Strengthen network security construction, make attacks and intrusions more difficult, and intercept most attacks and threats.

How Does Huawei Help You Defend Against C&C Attacks?

When a C&C client remains dormant, detection is challenging. However, once it initiates communication with the C&C server, this activity provides a valuable opportunity to identify potential threats. C&C communication traces can be discovered using raw data such as beacons, logs, and traffic, or by applying correlation analysis.