427 Botnet fm qxd

www.syngress.com
IRC and Botnets • Chapter 8
297
427_Botnet_08.qxd 1/8/07 4:10 PM Page 297

---

For more details on the subreports in the IRC summarization, see
ourmon’s info.html Web page under its IRC section.
Detecting an IRC Client Botnet
In this section we take a look at some example client botnets detected in
action.This will include our Case Study #3 from Chapter 6. When you are
looking at the evil channel sort or the max message sort of channel names,
there are really four possible outcomes for botnet client mesh detection:
1. You might have an attacking botnet client mesh with 1 or some or
all hosts in the channel scanning.
2. You might have a passive botnet client mesh and need other means
to identify it.
3. You might have a false positive (it isn’t a botnet client mesh, it’s
something else entirely).
4. You might not be able to figure it out.
So let’s say you decide to look at the ourmon IRC summarization:
channels sorted by evil factor: max number of wormy hosts:
and you see something like the report shown in Table 8.3.
Table 8.3
Evil Channel Sort
Channel
Msgs
Joins
Privmsgs
Ipcount Wormyhosts
Evil?
x0#
20
20
0
9
5
E
.i-exp
1
0
1
2
1
e
alien
122
92
30
2
1
e
hobo
12
8
4
3
1
e
So there are four channels that need to be investigated. Channel 
x0#
has
no PRIVMSGs, nine hosts, and five scanners.This does not look good.The
other three channels have only one scanner in them. Odds are good at this
point that channel 
x0#
is evil.The other three could simply be false positives.