427 Botnet fm qxd

www.syngress.com
222
Chapter 6 • Ourmon: Overview and Installation
427_Botnet_06.qxd 1/8/07 3:14 PM Page 222

---

show scanners with a red color for outside to inside (them) and green for
inside to outside (us). In this case we had a rather alarming scan with over
2,000 hosts from the outside to the inside. Again, this had to be a botnet. It
was used to perform a parallel scan of PSU’s /16 address space.This graph
sometimes shows parallel scans and sometimes shows DDoS attacks. In this
case, data elsewhere showed that a hacker was looking for e-mail systems at
port 25.This particular tool is related to the 
TCP port report,
which we will
discuss in the next chapter at length.
Figure 6.3
The Worm Graph—Parallel Scan
Notes from the Underground
Hackers Fingering Hackers
A graph like the one presented above once occurred because appar-
ently hacker party A got mad at hacker party B and staged a botnet-
based DoS attack on party B’s box and IRC server. However, party B’s
box happened to be a very important but badly administered Windows
server. The hackers didn’t know that the box had important adminis-
trative software on it. The administrators didn’t know that the box had
hackers on it. The upshot of the massive DoS attack was that the
administrators finally discovered that box B was hacked and fixed it.
www.syngress.com
Ourmon: Overview and Installation • Chapter 6
223
427_Botnet_06.qxd 1/8/07 3:14 PM Page 223

---

Case Study #3: Bot Client
For our discussion of ourmon in this section, we are using two tables taken
from an ourmon report called the 
IRC report
(see Tables 6.1 and 6.2).This
report is produced hourly and is a statistical analysis of various IRC channels
seen in the packet stream. We have simplified the report and left out all kinds
of details and numbers and reduced it to two tables for our discussion here.
From a thousand miles up, the IRC report consists of a set of 
IRC channels
(chat room names) and the 
IRC hosts
that belong to those channels (IP
addresses). Various statistics and sorts are presented for both channels and IRC
hosts. Channels and hosts may be sorted in various ways including most mes-
sages in a channel.