427 Botnet fm qxd

www.syngress.com
IRC and Botnets • Chapter 8
287
427_Botnet_08.qxd 1/8/07 4:10 PM Page 287

---

important thing to note here is that the logic that glues IRC together is the
IRC 
channel
name.The channel is a logical chat room.
Figure 8.1 shows two IRC networks, both organized around channels.
Network 1 is organized around the 
linux
chat channel and consists of two
servers and a number of client hosts. Network 2 has one server (which hap-
pens to be a botnet C&C) and a couple of clients. With Network 2, the
channel name is 
lsass445
. Using the IRC protocol, a client sends a data
(PRIVMSG) message to an IRC channel, which is an abstraction for a set of
users on possibly different client computers and one or more servers. Channel
names are basically ASCII strings with a little bit of “syntax sugar” possible.
The server that the client is directly connected to takes the message (typically
just an ASCII string like “hi there”) and forwards it to other directly con-
nected clients as long as the client has logged into the channel.The first
server may also forward it to other servers if other servers are connected to
the first server. In turn those servers may forward the message to other clients
or servers interested in the channel, and so on. IRC is said to be a logical
mesh network and the data is flooded to other potential recipients in the
mesh.This means data goes one way to all the logical clients through all the
servers. Put another way, the servers make sure the message doesn’t get sent
twice to any client interested in the channel.
Figure 8.1
Two IRC Networks
www.syngress.com
288
Chapter 8 • IRC and Botnets
Workstation
Workstation
Workstation
Workstation
Workstation
lsass445
lsass445
IRC servers
Linux
Linux
IRC clients
Bot client
IRC server
More IRC clients
Linux
427_Botnet_08.qxd 1/8/07 4:10 PM Page 288

---