427 Botnet fm qxd

www.syngress.com
74
Chapter 2 • Botnets Overview
427_Botnet_02.qxd 1/9/07 9:49 AM Page 74

---

if there is no reason for other workstations to log in to your com-
puter.
Q: 
How do botnets use IRC for Command and Control?
A: 
When recruited, botclients are instructed to subscribe to an IRC server,
on a specific channel. Each channel has several different topics.The IRC
channel topics contain bot commands. Some versions of botnets use mul-
tiple channels for different functions.The main channel topic may direct
the botclient to go to a string of additional channels. Each channel’s topic
contains the commands that the botclient will carry out. Each botclient
has a command interpreter that understands the command strings found
in the channel topic names. It is this command interpreter that makes a
bot a bot. It’s also easy to see how other technologies could be used for
the Command and Control function.There is much more on this topic in
Chapter 8.
Q: 
Why do botherders do these terrible things?
A: 
The easy answer is for money and power. I believe that a large part of the
problem is that we, as a society, do not teach ethics and responsibility
when kids learn about computers and the power of the Internet. On the
other side of the equation, academia, business, and industry continue to
underfund security and produce products and services with inadequate
security.The Organization of Economically Cooperating Democracies
(OECD) says that the world needs to create a culture of security.
Unfortunately academia, business, and industry want to continue to
believe that it is okay to deliver functionality first and add security later, if
the market demands it. Only later never comes or when the market does
demand it, the retrofit is very expensive or is only a band-aid. Our current
culture makes it very easy for an unethical hacker to turn our security
failings to their financial advantage.