427 Botnet fm qxd

www.syngress.com
10
Chapter 1 • Botnets: A Call to Action
427_Bot_01.qxd 1/8/07 11:53 AM Page 10

---

1. The initial module delivered contains the IRC bot client and the
remote access backdoor.
2. Module 2 attacks and shuts down antivirus processes.
3. Module 3 prevents the user from accessing a list of Web sites (usually
antivirus vendor sites).
Each module retrieves the next module when it completes its primary
tasks.This aspect permits the botherder to update modules 2 and 3 as new
techniques or sites are available.This modular update capability makes the list
of variants soar into the thousands. Agobot uses IRC for C&C, but is spread
using peer–to-peer (P2P) file-sharing applications (for example, Kazaa,
Grokster, and Bear Share).The bot client could be commanded through IRC,
but Agobot also opened a remote access backdoor to permit individual clients
to be accessed directly. Agobot has the following capabilities:
■
Scans for certain vulnerabilities
■
Can launch a variety of DDoS attacks
■
Searches for CD keys to games
■
Terminates antivirus and monitoring processes
■
Modifies the host files to prevent access to antivirus Web sites
■
Hunts for systems with the Bagle worm and if it infects one, shuts
down the Bagle processes
■
Hides itself using rootkit technology
■
Uses techniques to make reverse engineering difficult
Other related bots include Phatbot, Forbot, Polybot, and XtremBot
.
Phatbot added the capability to use WASTE, a P2P for C&C that uses public
key crypto.
From Code-Based Families 
to Characteristic-Based Families
From this point in the evolution of bots, bot family groups are being created
less based on the original code and based more on unique characteristics.Take