54
14,000 routers are infected by malware that's highly resistant to takedowns (arstechnica.com)
submitted 8 months ago by to c/technology@beehaw.org
22 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 11 points 8 months ago (3 children)

KadNap is a sophisticated peer-to-peer design based on Kademlia, a network structure that uses distributed hash tables to conceal the IP addresses of command-and-control servers

How I would love to have enough Networking knowledge to be able to dismantle this system.

  • permalink
  • fedilink
  • source
  • hideshow 3 child comments
    •
  • [–] 2 points 8 months ago (1 child)

    I’m a network engineer and I’m not entirely sure what’s going on. The ip addresses would be visible at some point or it wouldn’t work. I assume they’ve done the simple thing and ran a packet capture but a good chance it’s running through VPN so who knows

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 8 months ago

    I assume the goal is to make it so the c2 server(s) are basically indistinguishable from any other node, perhaps by making much more inter-node traffic than is strictly necessary. Couple this with almost all the participating IP addresses belonging to innocent parties (since it's malware) and I'm not sure how one would identify the true origin of commands

  • permalink
  • fedilink
  • source
  • parent