Essentially the exact approach you propose has been attempted in far cleverer ways, it did not work very well.

For a very small botnet that doesn't attract attention, you could really use any social media site for C&C if your goal was to avoid network-level detection.

For a slightly bigger botnet that might get abuse reports, you could just get a bunch of domains on different ccTLDs from various bulletproof registrars. There are some huge botnets doing this without much trouble.

It's really only the really big botnets where you want to worry about things like P2P C&Cs for censorship resistance, they're the ones that will face co-ordinated efforts to shut them don.

I feel like the block explorers aren't a really good solution, for small botnets there are less conspicuous options. Here's a (real) botnet C&C that uses Steam, and has been doing so for a long time https://steamcommunity.com/profiles/76561199621451974 It's a rather silly implementation though, not sure why the developer decided to do it this way.

It's also worth noting that most botnets aren't targeting networks where they'd really have to worry about network-level detection, so in almost all cases using your own domain names is by far the easiest and most reliable option.

I'd also guess the most common malware these days is of the often short-lived "stealer" type, where the operator doesn't necessarily really care about keeping their bots alive as the malware just immediately grabs all the interesting data from your computer and uploads it.

I mean, even just shipping a Tor client embedded in your malware seems like a much better idea.

>just rely on explorers to query your own wallet

This kind of defeats the point, you get exactly 0 censorship resistance like this.

you would have to extract the keys from the malware, you would then have to implement the logic and announce it - then rely on blockchain exploreres actually using that data to block addresses in real time.

> you would have to extract the keys from the malware

Yeah? That happens all the time. If you're designing mechanisms like this, it's presumably specifically against adversaries which are doing exactly that.

> you would then have to implement the logic and announce it - then rely on blockchain exploreres actually using that data to block addresses in real time.

Someone would only have to do this once and all your bots would be gone.

Usually the whole point of these mechanisms is C&C resilience, and usually that only matters for really big botnets which face co-ordinated attacks.

Any good C&C system for a bigger botnet would seek to eliminate all meaningful external points of failure for C&C. Using a block explorer, or HN comments, does not achieve that.

but explorers are the easiest since there's so many of them and so many of them that do not give two shits about blacklisting addresses.

You could've just used DHT, or even bundled Tor.

There are lots of ways to disguise p2p traffic to make it indistinguishable from common, legitimate software.

Not unique to a person

> email address, phone number

Also often not unique to a person, although email addresses probably tend to have much longer lifespans as identifiers than phone numbers.

If the idea is to have a true opt-out system, it's really really difficult to implement given how these systems work.

If you look at the data provided by services like accurint, you'll frequently see the same SSNs used for decades by multiple different individuals, often with IDs from different states with the same name and DoB despite obviously being different people. With how the system works in the US, it can often be impossible for anyone to determine which physical person the SSN was actually originally assigned to.

Same obviously applies to other identifiers you suggested, but even the seemingly good ones are not very good at uniquely identifying people.

Given that most ccTLDs live in different jurisdictions, that's not really a huge problem.

The copyright-industrial complex is internationally very well-connected.

Why would you want to use blockchains for this? DHT has been used for distributed c&c for ages and is generally a much lighter option.

But no, P2P C&C is still not really typical. In practice, there's mostly not that much need for it. Also, FWIW, for practically all use-cases P2P C&C discovery is a vastly better option.

Every single financial institution relies on these data-brokers. U-haul needs data brokers to be able to verify your driver's license, the TSA needs data brokers to let you on a flight without an ID. There are simply countless of reasons for why you wouldn't want to break this system for people who haven't opted in for breakage.

Based on the pictures of the car, I can't even imagine how you'd get the car stuck there, much less get stuck inside the car.

This was a rural area, but he was a few hundred meters from a big road. Surely he could have just exited the car and walked there.

Removing network connectivity from basically any new car is trivial, often as simple as pulling an easily accessible fuse.

I'm guessing that you haven't actually done this on "basically any new car".

If you had tried, you would know that there is no fuse dedicated to "network connectivity". It is typically tied in with other, often essential functions like the engine control computer --- specifically in order to thwart a simple disconnect.

What I have seen done is to tear into the right roof pillar and cut the wires going to the antenna on the roof. But this is usually not without consequences as well such as a perpetual error code display and/or the radio, navigation or entertainment functions stop working.

I've never seen an antenna that was difficult to disconnect, on the super simple end you have something like the W222 where you can literally just pop out the antenna cover on the roof and just remove the antenna module inside.

>But this is usually not without consequences as well such as a perpetual error code display or the radio, navigation or entertainment functions stop working.

Well sure, I do have cars without GPS because I was lazy. Carplay still works fine, so can't really bother to do anything about it.

Even if you can't pull the modem or the sim card (less common now) directly, you can certainly always find and disable the antenna connection.

Any decent shop will be able to do this for a reasonable price.

That largely depends on the specific vehicle. I’m surprised that there wer no negative effects in pulling the telematics fuse on a W223, less surprised on a W222.

Depends on the car. On modern Fords, it’s the TCU fuse.

> What I have seen done is to tear into the right roof pillar and cut the wires going to the antenna on the roof

Nonsense. Only a fool would do this, rather than simply disconnecting the antennas from the back of the module.

Manufacturers almost universally use FAKRA connectors for quick and error-free assembly on the production line.

Depends on the car. It some cases, this is not simple. Accessing the connections means disassembling the dash.