How the Rustock Botnet Used Stealth and Layered Command Servers

Summary

The video describes Rustock’s five-day delay after infection, rootkit-based concealment, and layered command servers that relayed instructions to bots and made the botnet harder to disrupt.

Key points

• Rustock was described as a botnet built by a spammer identified as Cosma.
• After infecting a computer, Rustock waited five days before acting.
• The botnet used custom encryption, made downloads look like compressed archives, and used rootkits to hide on infected machines.
• Rustock reportedly disabled debugging programs and hid its tracks.
• Its command-and-control servers relayed communications through multiple levels before instructions reached bots.
• The layered server design was intended to make the botnet harder to stop and keep it running longer.