The botnet-type system is called HiveMind and was built by Sean T. Malone, a principal security consultant at penetration testing firm FusionX.
HiveMind uses technologies like HTML5 WebSockets and Web Storage that are also used by legitimate Web applications.
A gray area
“This was a research project, not production software” he said. “I’m not a lawyer, so I don’t intend to give anyone legal advice with this,” he said, adding that everyone is responsible for what they decide do with the software he plans to release later this week.
According to the researcher, his proxy server was getting connections from 20,000 unique Internet Protocol (IP) addresses every ten minutes, which then became nodes in the botnet.
When a file is uploaded to the server, it is encrypted using the Advanced Encryption Standard (AES) with a password provided by the uploader. The encrypted file then gets split into multiple blocks and those blocks are distributed across different nodes.
Every file can have a different password, Malone said.
Because the botnet is highly dynamic, with nodes constantly disappearing when users close their browsers, every file block is distributed across multiple nodes to achieve redundancy.
The nodes constantly announce their presence and the list of blocks they have back to the server, so that a particular block can be redistributed to new nodes if the number of nodes storing it drops under a certain threshold.
After a file is uploaded, encrypted and distributed to the nodes, it is no longer kept on the server. Only a record of the nodes that contain its different blocks is stored, because this is necessary to rebuild the file, Malone said.
A sprawling bubbling system
If a government agency were to seize the server and take it away, the block replication process would fail because the nodes would start going offline, which would make the file unrecoverable, Malone said. There are a few ways to recover the data, but it is very difficult and it involves seizing a large number of nodes or compromising the server while it’s still online and coercing the owner to provide the passwords necessary to decrypt the files.
There is a way to provide “plausible deniability” for the owner and it involves initially seeding the server with a large number of dummy files that contain random data, but this functionality is not yet built into the system, Malone said.
The user can say that he created the system, but did not put any real data in it, even though he did also upload some real files along with the dummy ones.
Because the random data in the dummy files looks the same as the random data in encrypted files, when trying to recover a file there is no way to tell if the password supplied by the user was correct and a dummy was decrypted, or if the password was wrong, the researcher said.
In this way, the user can supply the wrong password for the files he knows are real and the other party would have no way to prove that the password was correct or incorrect.
While the legality of building such a botnet is questionable, this system could also be set up as a collaborative effort, where users volunteer their browsers themselves and are able to upload files to the system, Malone said.