Researcher builds botnet-powered distributed file storage system using JavaScript

The system can make it very hard for a third party to recover the data, the researcher said

The latest Web technologies can be used to build a secure and distributed file storage system by loading a piece of JavaScript code into users' Web browsers without them knowing, a researcher demonstrated Sunday at the Defcon security conference in Las Vegas.

The botnet-type system is called HiveMind and was built by Sean T. Malone, a principal security consultant at penetration testing firm FusionX.

HiveMind uses technologies like HTML5 WebSockets and Web Storage that are also used by legitimate Web applications.

There are no malicious exploits being used, so there is nothing that can be patched to prevent it, Malone said. However, building the botnet by getting other people's browsers to load a piece of JavaScript code and storing data on their computers falls into a legally gray area, he said.

"This was a research project, not production software" he said. "I'm not a lawyer, so I don't intend to give anyone legal advice with this," he said, adding that everyone is responsible for what they decide do with the software he plans to release later this week.

The HiveMind JavaScript code can be distributed to browsers in several ways, including hosting the JavaScript code on legitimate or compromised websites or by distributing the code through an advertising network, which would place it on multiple websites.

For his research, Malone set up an anonymous Web proxy server that later got added to proxy lists and started being used by people. Every time someone used the proxy server to browse to a Web page, the server would inject the HiveMind JavaScript code into that page.

According to the researcher, his proxy server was getting connections from 20,000 unique Internet Protocol (IP) addresses every ten minutes, which then became nodes in the botnet.

HiveMind has a command and control (C&C) server that uses a SQL database to keep a record of all files and the nodes -- browsers running the JavaScript code -- they're distributed on.

When a file is uploaded to the server, it is encrypted using the Advanced Encryption Standard (AES) with a password provided by the uploader. The encrypted file then gets split into multiple blocks and those blocks are distributed across different nodes.

Every file can have a different password, Malone said.

Because the botnet is highly dynamic, with nodes constantly disappearing when users close their browsers, every file block is distributed across multiple nodes to achieve redundancy.

The nodes constantly announce their presence and the list of blocks they have back to the server, so that a particular block can be redistributed to new nodes if the number of nodes storing it drops under a certain threshold.

After a file is uploaded, encrypted and distributed to the nodes, it is no longer kept on the server. Only a record of the nodes that contain its different blocks is stored, because this is necessary to rebuild the file, Malone said.

If a government agency were to seize the server and take it away, the block replication process would fail because the nodes would start going offline, which would make the file unrecoverable, Malone said. There are a few ways to recover the data, but it is very difficult and it involves seizing a large number of nodes or compromising the server while it's still online and coercing the owner to provide the passwords necessary to decrypt the files.

There is a way to provide "plausible deniability" for the owner and it involves initially seeding the server with a large number of dummy files that contain random data, but this functionality is not yet built into the system, Malone said.

The user can say that he created the system, but did not put any real data in it, even though he did also upload some real files along with the dummy ones.

Because the random data in the dummy files looks the same as the random data in encrypted files, when trying to recover a file there is no way to tell if the password supplied by the user was correct and a dummy was decrypted, or if the password was wrong, the researcher said.

In this way, the user can supply the wrong password for the files he knows are real and the other party would have no way to prove that the password was correct or incorrect.

While the legality of building such a botnet is questionable, this system could also be set up as a collaborative effort, where users volunteer their browsers themselves and are able to upload files to the system, Malone said.

Join the CSO newsletter!

Error: Please check your email address.

Tags securityencryptiondata protectioninternetFusionX

More about Advanced Encryption StandardAES Environmental

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Lucian Constantin

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts