Botnet masters hide command and control server inside the Tor network
Security researchers from German antivirus vendor G Data Software have identified a botnet that is controlled by attackers from an Internet Relay Chat (IRC) server running as a hidden service inside the Tor anonymity network.
This strategy offers several advantages to the botnet's operators, but also some disadvantages, the G Data researchers said Monday in a blog post.
For one, the botnet command and control server can't be easily shut down by researchers or law enforcement because its very hard to determine its real location. The Tor system was specifically designed to provide anonymity for its users. When using Tor to access resources on the Internet, the requests sent from a user's computer are routed randomly through a series of nodes operated voluntarily by other Tor users.
