RE: IRC Bot traffic?

Wipe anyway.  Once owned, always owned until a wipe.  I've known of
several others who saw a similar phenomenon (that removing MSN Messenger
from a compromised machine seemed to help), but a few weeks later, the
box was mis-behaving again.  And during that dormant period, who knows
what they're doing -- key-loggers would be one of the most likely (and
potentially deadly) things.  Unless you can say to yourself for 100%
certain that you know when they got in, how they got in, and exactly
everything they did while they were in (which is pretty much never) --
wipe.

Any decent custom toolkit or bot is going to be invisible to
signature-based AV scanners (though AV with strong heuristics may have
*some* chance), and the same goes for spyware detection programs, so I'm
not surprised you didn't find anything.  By the time a given toolkit or
bot becomes popular enough to show up in your signature-based file
scanners, it's already obsolete and they're using something else.
Careful forensics (both by observing it in action and by booting to a CD
and disecting it dead) may be able to find much of what they put into
place, but you can never be sure.  So wipe.

*==========================================;
*Ben Earnhart
*Computer Consultant and 
*ICPSR Representative
*Department of Sociology and 
*College of Liberal Arts
*University of Iowa
*(319) 335-2887
*[email protected]
*==========================================; 

> -----Original Message-----
> From: [email protected] 
> [mailto:[email protected]] On Behalf Of eltra1n
> Sent: Thursday, March 24, 2005 10:47 AM
> To: Intrusions List (GCIA Practicals)
> Subject: Re: [Intrusions] IRC Bot traffic?
> 
> this is interesting. We ran our AV and a few different 
> spyware catchers against it and nothing was picked up. We 
> stopped seeing the traffic once MSN Messaenger was removed 
> from the machine.
> 
> 
> On Wed, 23 Mar 2005 13:18:14 -0600, Scott Mcintyre 
> <[email protected]> wrote:
> > XDCC bots is what they are called.
> > 
> > Its a program called IRoffer.  What they do is the attacker uploads 
> > files to serve to irc users who just download using your bandwidth.
> > They are commonly use for warez, ie the latest movies,applications 
> > etc.  So check over your system.
> > 
> > -Scott Mcintyre
> > 
> > > I found some IRC traffic on port 4500 with my IDS. I grabbed some 
> > > pcaps and it looks like an IRC bot...(?) Has anyone seen 
> something 
> > > like this before?
> > >
> > > [email protected] JOIN :#101-
> > FREEDOMXDCC
> > >
> > > PING XDCC.101-Freedom
> > > :XDCC.101-Freedom PONG XDCC.101-Freedom :[101]14667
> > >
> > > :[CrooK][email protected] QUIT :Ping 
> > > timeout - Oxygen.101-Freedom
> > >
> > > PING XDCC.101-Freedom
> > > :XDCC.101-Freedom PONG XDCC.101-Freedom :[101]14667
> > >
> > > PING XDCC.101-Freedom
> > > :XDCC.101-Freedom PONG XDCC.101-Freedom :[101]14667
> > >
> > > :[email protected] JOIN :#101-FREEDOMXDCC
> > >
> > > :LastMetalWarrior!LastMetalWar@101Freedom-
> > 3A40D27A.sunsh1.vic.optusnet.com.au
> > > JOIN :#101-FREEDOMXDCC
> > >
> > > :[email protected] QUIT 
> > > :Connection reset by peer
> > >
> > > NICK [101]14667
> > > PING XDCC.101-Freedom
> > > :XDCC.101-Freedom PONG XDCC.101-Freedom :[101]14667
> > >
> > > 
> :[email protected] QUIT 
> > > :Ping timeout - Oxygen.101-Freedom
> > >
> > > :[email protected] QUIT :loek
> > >
> > > 
> :[email protected] JOIN 
> > > :#101-FREEDOMXDCC
> > >
> > > PING XDCC.101-Freedom
> > > :XDCC.101-Freedom PONG XDCC.101-Freedom :[101]14667
> > >
> > > :[email protected] 
> QUIT :Ping 
> > > timeout - Switch.Bladez.101-Freedom
> > >
> > > PING XDCC.101-Freedom
> > > :XDCC.101-Freedom PONG XDCC.101-Freedom :[101]14667
> > >
> > > PING XDCC.101-Freedom
> > > :XDCC.101-Freedom PONG XDCC.101-Freedom :[101]14667
> > >
> > > NICK [101]14667
> > > PING XDCC.101-Freedom
> > > :XDCC.101-Freedom PONG XDCC.101-Freedom :[101]14667
> > >
> > > :[email protected] QUIT :Ping timeout - 
> > > Oxygen.101-Freedom
> > >
> > > :[email protected] QUIT :Ping
> > timeout -
> > > Oxygen.101-Freedom
> > >
> > > PING XDCC.101-Freedom
> > > :XDCC.101-Freedom PONG XDCC.101-Freedom :[101]14667
> > >
> > > :[101][email protected] PRIVMSG #101-
> > FREEDOMXDCC
> > > :.**. ..15...14::: .8XDCC Bot Online .14:::.15.. .**.
> > >
> > > :[101][email protected] PRIVMSG #101-
> > FREEDOMXDCC
> > > :.**. 1 pack .**.  0 of 2 slots open, Queue: 6/30, 
> Record: 81.9KB/s
> > >
> > > :[101][email protected] PRIVMSG #101-
> > FREEDOMXDCC
> > > :.**. Bandwidth Usage .**. Current: 77.4KB/s, Record: 89.0KB/s
> > >
> > > :[101][email protected] PRIVMSG #101-
> > FREEDOMXDCC
> > > :.**. To request a file, type "/msg [101]00111 xdcc send #x" .**.
> > >
> > > :[101][email protected] PRIVMSG #101-
> > FREEDOMXDCC
> > > :.**. To request details, type "/msg [101]00111 xdcc info #x" .**.
> > >
> > > :[101][email protected] PRIVMSG #101-
> > FREEDOMXDCC
> > > :.#1 . 7x [1.1G] ..4,8 MoViE .1,1 .12,11 Hostage.TS-LRC
> > >
> > > :[101][email protected] PRIVMSG #101-
> > FREEDOMXDCC
> > > :.**. ..15...14::: .4Rooted By The Best - Leeched By The Rest 
> > > .14:::.15.. .**.
> > >
> > > PING XDCC.101-Freedom
> > > :XDCC.101-Freedom PONG XDCC.101-Freedom :[101]14667
> > >
> > > :[101][email protected] PRIVMSG #101-
> > FREEDOMXDCC
> > > :Total Offered: 1076.0 MB  Total Transferred: 12.45 GB
> > >
> > > :[email protected] JOIN :#101-
> > FREEDOMXDCC
> > >
> > > PING XDCC.101-Freedom
> > > :XDCC.101-Freedom PONG XDCC.101-Freedom :[101]14667
> > >
> > > :[email protected] JOIN 
> > > :#101-FREEDOMXDCC
> > >
> > > :[email protected] QUIT :Ping timeout - 
> > > Switch.Bladez.101-Freedom
> > >
> > > :[email protected] 
> JOIN :#101-
> > FREEDOMXDCC
> > >
> > > NICK [101]14667
> > > PING XDCC.101-Freedom
> > >
> > >
> > > --
> > > _______________________________________________
> > > Intrusions mailing list
> > > [email protected]
> > > http://www.dshield.org/mailman/listinfo/intrusions
> > >
> > >
> > 
> > _______________________________________________
> > Intrusions mailing list
> > [email protected]
> > http://www.dshield.org/mailman/listinfo/intrusions
> > 
> 
> 
> --
> Lawerence A. Wichman
> 2719 W Thomas Apt 2
> Chicago, Il 60622
> 773-807-7606
> _______________________________________________
> Intrusions mailing list
> [email protected]
> http://www.dshield.org/mailman/listinfo/intrusions
> 

_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions