Some reasons why I think this would be a good idea (as a BACKUP comms channel), though I admit I am no experts in botnets:
1) It only requires a handful of outgoing TCP connections. This is fine if you are targeting windows consumer boxes
2) It is near-impossible to take down this communications channel. If your regular C&C server gets raided/taken down then you can broadcast the new connection details using this
3) You only have to spend anything to make a new broadcast. If this were to be used as a backup C&C channel that would rarely happen, and it's fine if that were to be slow too.
4) Regarding complexity, the client will already be complex if you're going to be implementing crypto to verify commands which you should do anyway. I don't really see why complexity is a bad thing here either if it works fine.
You're right that the evidence is not really ideal, but many other comms channels used in the past have had that property, such as twitter accounts.
> There are far better ways to get this sort of reliability without shooting yourself in the foot by accepting all the handicaps I mentioned.
1) It only requires a handful of outgoing TCP connections. This is fine if you are targeting windows consumer boxes
2) It is near-impossible to take down this communications channel. If your regular C&C server gets raided/taken down then you can broadcast the new connection details using this
3) You only have to spend anything to make a new broadcast. If this were to be used as a backup C&C channel that would rarely happen, and it's fine if that were to be slow too.
4) Regarding complexity, the client will already be complex if you're going to be implementing crypto to verify commands which you should do anyway. I don't really see why complexity is a bad thing here either if it works fine.
You're right that the evidence is not really ideal, but many other comms channels used in the past have had that property, such as twitter accounts.
> There are far better ways to get this sort of reliability without shooting yourself in the foot by accepting all the handicaps I mentioned.
Do elaborate?