Re: IRC access redux

It's actually true that there are a number of trojans/worms that report=20
in via IRC.  For example, a self-propagating botnet is often managed by=20
all infected systems connecting to the botnet owner's IRC server, and=20
being controlled by him that way.  This allows a botnet maintainer to=20
issue commands to all of his bots without having to know their=20
individual IP addresses, etc, which would be impossible with dynamic=20
addresses and computers that get turned off at night and such.  It also=20
allows a botnet member system to be controlled regardless of a NAT/PAT=20
gateway, et al.
So yes, while it is a popular method of doing so, using HTTP and=20
something like a web bulletin board is just as possible.  The right=20
answer is stateful packet inspection and a good intrusion detection and=20
prevent system which looks for tell-tale signs of a system infection -=20
this'll not only prevent the infected systems from operating over one=20
method of communication, but will allow you to identify and shut down=20
infected systems.  =EF=BC=BE=EF=BC=BE
It's like the difference between sticking some chewing gum in the dam,=20
or actually fixing the crack.

Andrew Turnbull wrote:
> As we all know, IRC access seems to be blocked at WVU.
>=20
> To try getting to the bottom of things, I decided to inquire what the=20
> official ResNet policy concerning IRC was.  The answer was thus:
>=20
> "Mr. Turnbull,
>=20
> We don't have a policy against using it, but the standard IRC ports are=
=20
> blocked because the University was the victim of many virus attacks=20
> using those ports.
>=20
> ResNet Staff
> West Virginia University Division of Student Affairs
> Ph: (304) 293-4444 x1"
>=20
> Make of that what you will.  If that's the case, are there any ports=20
> that AREN'T blocked?
>=20
> --=20
> Andrew Turnbull
>=20
>=20
> -----------------------------------------------------------------------=
-
>=20
> _______________________________________________
> Morlug mailing list
> [email protected]
> http://mailman.morlug.org/mailman/listinfo/morlug

--=20
/*
  * Matt D. Harris         <[email protected]>
  *  Solitox Networks - Lead Project Engineer
  *   [http://mdh.name/]
  */