The botnet-type system is called HiveMind and was built by Sean T. Malone, a principal security consultant at penetration testing firm FusionX.
HiveMind uses technologies like HTML5 WebSockets and Web Storage that are also used by legitimate Web applications.
"This was a research project, not production software" he said. "I'm not a lawyer, so I don't intend to give anyone legal advice with this," he said, adding that everyone is responsible for what they decide do with the software he plans to release later this week.
According to the researcher, his proxy server was getting connections from 20,000 unique Internet Protocol (IP) addresses every ten minutes, which then became nodes in the botnet.
When a file is uploaded to the server, it is encrypted using the Advanced Encryption Standard (AES) with a password provided by the uploader. The encrypted file then gets split into multiple blocks and those blocks are distributed across different nodes.
Every file can have a different password, Malone said.
Because the botnet is highly dynamic, with nodes constantly disappearing when users close their browsers, every file block is distributed across multiple nodes to achieve redundancy.
The nodes constantly announce their presence and the list of blocks they have back to the server, so that a particular block can be redistributed to new nodes if the number of nodes storing it drops under a certain threshold.