3 ms·

well the evasion part is pretty huge diff.

• jerf 8y ago
  If you're referring to what is mentioned in this post: https://medium.com/@Ne0nd0g/introducing-merlin-645da3c635a https://medium.com/@Ne0nd0g/introducing-merlin-645da3c635a , I'm not sure "We use HTTP2 and TLS" is that significant of a difference. If there was some elaborate system in place for evasion, sure, but this is just "using a new, but standard, protocol before everybody else understands it yet". Heck, just the fact it's using TLS is about 90% of the evasion; HTTP2 is just icing on the cake. A more significant difference I was thinking of is that ansible et al are more focused on getting the system into a certain state, whereas a C&C server is likely to be oriented around executing commands and keeping certain tasks running. However, since the way you get a system into a certain state is by executing commands, well, the technical differences aren't that significant. Most of that difference would be in organization of the "UI" layer, rather than under the hood.
  • qaq 8y ago
    They are looking at adding domain fronting :)
  • SEJeff 8y ago
    My take is that HTTP/2 is more significant than you might expect, primarily because it is a full duplex protocol (unlike the typical request / response of HTTP/1). This makes it like a more efficient websocket, so the C2 bits can move faster than a polling based approach. That said, this makes it easier to detect.