A command and control server (C&C server) is the centralized computer that issues commands to a botnet (zombie army) and receives reports back from the coopted computers.
In the traditional botnet, which includes a C&C server, the bots are typically infected with a Trojan horse and subsequently communicate with a central server using IRC. The botnet might be used to gather misappropriated information, such as credit card numbers. Depending on the purpose and structure of the botnet, the C&C server might also issue commands to start sending spam or begin a DDoS (distributed denial of service) attack.
Depending on its topology, a botnet may have multiple C&C servers or none at all.
Typical botnet topologies include:
- Star, in which the bots are organised around a central server.
- Multi-server, in which there are multiple C&C servers for redundancy.
- Hierarchical, in which there are multiple C&C servers that are organized into tiered groups.
- Random, in which there is no C&C server at all and coopted computers communicate as a peer-to-peer botnet (P2P botnet).
Since IRC communication is typically used to command botnets, it is often guarded against, which has motivated the drive for more covert ways for C&C servers to issue commands. Alternative channels used for botnet command include JPG images, Microsoft Word files and posts from LinkedIn or Twitter dummy accounts.
Learn more about botnet command and control in this video: