427 Botnet fm qxd

www.syngress.com
IRC and Botnets • Chapter 8
299
427_Botnet_08.qxd 1/8/07 4:10 PM Page 299

---

searching on the Internet (www.dshield.org is a good site for intelligence
about ports) reveals that these are popular ports for exploits aimed at SQL
and VNC (see http://isc.sans.org/diary.php?storyid=1331). We don’t really
need to see any more.The timestamps in the summarization are interesting,
though.They suggest when local hosts might have been exploited and
infected. We now know five local infected hosts and a number of remote IP
addresses of botnet servers. Of course, there is much more to do and other
intelligence we might want to collect, including what exactly is the virus,
where are those hosts, how did the attack arrive? How is the botnet actually
controlled (we don’t necessarily know that as there are no PRIVMSGS in this
data set), and how might we try and clean up the infected hosts? But ourmon
has done its job.
Next let’s look at the channels that could be false positives. We look at
channel 
hobo
(our “Case Study #3: Bot Clients”) and actually discover that
channel 
i-exp
has the same remote botnet server IP address.
Hobo 
is an
example of a fringe case where it is not completely clear (at first) whether or
not this is a botnet. Once you find a botnet server, you should always search
through the entire report to look for other instances of that IP address. It is
not unusual for a botnet to use different channels for different functions,
including launching scan commands or initiating downloads.
Hobo 
(shown in
Table 8.5) is a little tricky because there is only one local host with a high
work weight. On the other hand, there are 22 PRIVMSG commands.
T
IP
When looking at ourmon data with a Web browser, use your Web
browser search function. For example, if using Firefox, use Control + F
and Control + G.