Botract: abusing smart contracts and blockchain for botnet command and control
by Omar Alibrahim; Majid Malaika
International Journal of Information and Computer Security (IJICS), Vol. 17, No. 1/2, 2022

Abstract: This paper presents how smart contracts and blockchains can potentially be abused to create seemingly unassailable botnets. This involves publishing command and control (C2) logic in the form of smart contracts to the blockchain and then calling the functions of the smart contract for sending and receiving commands and keeping track of the state of bots. We call this technique Botract, derived by merging two words: bot and contract. In addition to describing how hackers can exploit smart contracts for C2, we also explain why it is difficult to disarm Botract, given the distributed nature of the blockchain and the persistent nature of smart contracts deployed on top of them. We then describe the architecture for deploying blockchain-based botnets and implement a proof-of-concept using isolated testnet environments. Our goal is to prove the feasibility of our approach, which we hope will create awareness among the community on the importance of auditing smart contracts on the blockchain and defending against these botnets before they become widespread.

Online publication date: Fri, 04-Mar-2022

The full text of this article is only available to individual subscribers or to users at subscribing institutions.

 
Existing subscribers:
Go to Inderscience Online Journals to access the Full Text of this article.

Pay per view:
If you are not a subscriber and you just want to read the full contents of this article, buy online access here.

Complimentary Subscribers, Editors or Members of the Editorial Board of the International Journal of Information and Computer Security (IJICS):
Login with your Inderscience username and password:

Username:        Password:          Forgotten your password?

Want to subscribe?
A subscription gives you complete access to all articles in the current issue, as well as to all articles in the previous three years (where applicable). See our Orders page to subscribe.

If you still need assistance, please email subs@inderscience.com