What is a dead-drop resolver?¶

The practical answer¶

A dead-drop resolver is a service or location used to publish information that tells malware where to find its current control infrastructure.

The key evidential caution¶

The dangerous assumption is that the public service hosting the information is itself the command-and-control server.

It may not be.

An offender may place an address, domain or encoded instruction in:

Key points¶

• a social-media profile
• a code repository
• a paste service
• a public document
• a blockchain entry
• a cloud-storage object
• another publicly reachable location

The malware retrieves the information and then contacts a separate destination.

Evidence to preserve¶

Investigators should preserve:

Key points¶

• the public content
• account or object identifier
• publication and modification time
• access records
• the resolved destination
• the process retrieving it
• the later connection
• provider-held account data

The public content may change or be deleted quickly.

A screenshot alone may not preserve account metadata, version history or access logs.

Evidential limits¶

Do not assume the service account identifies the offender. It may be false, compromised or automated.

Likewise, retrieval of the dead-drop content does not prove the later control connection succeeded.

The public content may be accessed by many legitimate users or automated services. The important link is between the compromised process, the specific content retrieved and the later destination it revealed. Preserve version history where the platform supports it.

Retrieval may be cached by browsers, proxies or content-delivery systems. A later device request may therefore not reach the original service, so endpoint and intermediary records should be compared.

Operational takeaway¶

Preserve the published resolver content, account metadata and subsequent destination, and keep the public service separate from the actual command channel.