427 Botnet fm qxd

www.syngress.com
294
Chapter 8 • IRC and Botnets
427_Botnet_08.qxd 1/8/07 4:10 PM Page 294

---

is unpopular, but many hosts on a channel with no PRIVMSGS could be a
sign of a botnet channel. One reason for this is that some botnets have used
JOIN messages as their data channel and have not transmitted commands
using PRIVMSG.
T
IP
Know the names of your IRC channels so you can look for sudden
changes in those channel names. This might not be easy to do at a
university, but within a private enterprise network you might have no
IRC at all. So any IRC activity could be evidence of an infection or a
worker who is not working and is indulging in games.
The channel subreport entitled 
channels sorted by evil factor
appears at the
top of the IRC report. It is extremely important because its primary goal is to
alert you to an attacking botnet client mesh.Thus we put it at the top of the
report so you don’t have to go far to find it. It is sorted by the number of
“wormyhosts”—in other words, by the number of hosts that are scanning.
A
high number of scanning hosts in an IRC channel is likely a botnet client mesh.
For
example, if you have seven hosts in the IRC channel and six of them are local
hosts (with a remote server) and most local hosts have high work weights, you
probably have an infected channel. This subreport has the same form as the
channels sorted by max messages
subreport.
The other important subreport is 
channels with per host stats. Table 8.2 is an
example and has been simplified to show one client host and one server host.
Here
the IP hosts and statistics related to those IP hosts are given under the channel
name.The various column headings are as follows:
■