SCBot: Building Lightweight and Flexible C&C Based on Smart Contract

As a decentralized ledger, blockchain possesses characteristics like anonymity, immutability, public transparency, and minimal censorship. Various blockchain-based botnet Command and Control (C&C) approaches have been proposed. However, existing works overlook the potential of integrating with other technologies, leading to issues like low efficiency, high costs, and poor scalability. To highlight these risks, we introduce SCBot, a smart contract-based botnet C&C system. By leveraging publicly available Ethereum JSON-RPC services, botmasters can achieve lightweight deployment of C&C without maintaining blockchain data or developing contract. By integrating with Web 2.0 technologies, the proposed C&C achieves flexible scalability to meet various bots control scenarios. We demonstrate three scenarios for SCBot: issuing simple commands directly, using URL shortening services (USS) for complex commands, and serving as a backup channel. Our measurement of Ethereum smart contracts, Ethereum JSON-RPC services, and online USSs confirms that the public resources that SCBot relied on are abundant and open. We also evaluate SCBot through comprehensive experiments, demonstrating its feasibility and low cost. We hope this work will contribute to future efforts in thwarting such threats.