I have to admit, I've had a lot of fun in the past thinking of creative ways to control botnets. It's a fun thought exercise in developing in an area where everything is adversarial to your goal. And the fact that the amount of information you really need to transfer is so trivially small that you can get some really creative "solutions".
My favorite idea so far is to look for the existence of a specific username across several services for commands. Only the usernames are (in part) generated via a TOTP style rolling code. So to see if something should activate, it will look for the existence of a username of "imnotabot349556" on reddit, HN, and twitter. if it sees any of them, it can read a small command from any number of places on those sites that the user can post some kind of comment/profile/text.
This is super easy to control securely (could be done from anywhere, using any machine, over TOR or other networks), is hard to shut down (the rolling codes mean they would need to either have access to the "secret" and ban all future codes, or just ban "imnotabot*" which wouldn't be sustainable if multiple botnets started using this method, not to mention you could just switch to a hash of everything as the username), and is fairly fullproof (no reliance on any one network or channel). And with some forethought, an update mechanism can be built into it as well, so when someone gets close to your scheme, you could have all your bots update at a moment's notice to a new one.
At the end of the day, trying to stop a C&C server of a botnet is a futile exercise. Once the botnet is out there, there's no stopping it by shutting down a C&C server. There are just SO many ways to pass information, and when the information is on the size of hundreds of bytes in some cases, there's just no hope.
My favorite idea so far is to look for the existence of a specific username across several services for commands. Only the usernames are (in part) generated via a TOTP style rolling code. So to see if something should activate, it will look for the existence of a username of "imnotabot349556" on reddit, HN, and twitter. if it sees any of them, it can read a small command from any number of places on those sites that the user can post some kind of comment/profile/text.
This is super easy to control securely (could be done from anywhere, using any machine, over TOR or other networks), is hard to shut down (the rolling codes mean they would need to either have access to the "secret" and ban all future codes, or just ban "imnotabot*" which wouldn't be sustainable if multiple botnets started using this method, not to mention you could just switch to a hash of everything as the username), and is fairly fullproof (no reliance on any one network or channel). And with some forethought, an update mechanism can be built into it as well, so when someone gets close to your scheme, you could have all your bots update at a moment's notice to a new one.
At the end of the day, trying to stop a C&C server of a botnet is a futile exercise. Once the botnet is out there, there's no stopping it by shutting down a C&C server. There are just SO many ways to pass information, and when the information is on the size of hundreds of bytes in some cases, there's just no hope.