427 Botnet fm qxd

www.syngress.com
IRC and Botnets • Chapter 8
307
427_Botnet_08.qxd 1/8/07 4:10 PM Page 307

---

portuples[10]: [445, 1447344][139, 324577][80, 38816][554,
36170][5000, 13191][36922, 6506][4460, 5326][1028, 2365][1027, 2351][1037,
2068]
192.168.2.3
OR
H
(
0:
0:
5:)
98: (802/208) (8:1:0) (671:565)
:2796: Fri_Nov_25_00:00:37_PST_2005: Fri_Nov_25_23:20:33_PST_2005:
portuples[10]: [1026, 3404][1128, 3147][1030, 2936][1034, 2880][2738,
2822][1060, 2214][10005, 1992][1033, 1772][52673,
www.syngress.com
308
Chapter 8 • IRC and Botnets
427_Botnet_08.qxd 1/8/07 4:10 PM Page 308

---

www.syngress.com
IRC and Botnets • Chapter 8
309
Summary
In this chapter we have looked at the IRC protocol, and ourmon’s statistical
IRC reports based on four kinds of basic messages, including JOIN, PING,
PONG, and PRIVMSG.These messages allow ourmon to extract the chan-
nels from IRC and determine which hosts belong to which channels.
Ourmon also uses a variation of the TCP work weight used for anomaly
detection.The work weight is associated with hosts in a channel, and as a
result ourmon can tell you in its evil channel report if a given IRC channel
seems to be full of scanning hosts. If so, that channel could be a botnet client
mesh. We have also learned to pay attention to channel names so that if new
channels pop up, an analyst can investigate them to learn if they are genuine
chat channels. We can also use the global RRDTOOL IRC message count
strip charts and statistics found primarily in the IRC max message sort to
learn if a given local host has become a bot server. From a strict IRC point of
view, bot servers stand out compared to ordinary IRC hosts. Hopefully these
tools taken together can help an analyst find and cure botnets.