How to control it Previous control approaches: goner (mail worm) used irc to coordinate ddos w32/sonic had a website where the worm looked for updates stacheldraht used encrypted communication for direct control All of these are central points of failure / inefficient