Robust Android Botnet C&C over GTalk Service

Abstract

The growing popularity and capability of smartphones have made smartphone-based botnets feasible, and the smartphones' environment more attractive to botnet developers. However, smartphone botnets are not easy to manage due to its mobility. To maintain smartphone botnets, robust yet covert communication channel is necessary. Most of smartphone operating systems maintain connectivity to their vendor servers for various reasons. Since each vendor uses most efficient way to manage devices, botnet developers can also take advantage of it. In the case of Android, GTalk service is used for communication with the Google Cloud server. % and can also be used for botnet communication. We propose an Android phone-based botnet communication model over the Google Talk; Google Talk is one of the way to use GTalk service. Because GTalk service provides robust connectivity with traffic encryption, botnet communication over the GTalk service network will be resilient against low signal levels and eavesdropping. In addition, botnet communication traffic will be blended into vast quantities of legitimate Android traffic, which makes botnet detection even harder. These characteristics possess malicious potentials of GTalk service communication channel. Our extensive simulation studies and Android implementations demonstrate the feasibility and efficacy of controlling Android botnets via the Google Talk.