Re: Botnets and tracking and busting scriptkiddies

[Michael Holstein <michael.holstein () csuohio edu>]

> Detection 
> The second you notice network traffic that is over irc ranges of ports 
> 6000-7000 or suspect a bot  .A sniffer is your friend Ethereal is a good
> choice to use to obtain the address of the destination hacked server as
> well as channel passes ,While normaly I would recommend dissaembly of
> the infected file /bot More and more bot authors are using things like
> morphine and custom cooked up encryption schemes /packers to keep their
> bots from being taken apart thus keeping you from the juicy hardcoded
> passwords and channel keys within .

The best approach for this that I've discovered is :

1) use the snort sigs that detect "RogueIRC" traffic
2) fire up tcpdump
3) use tcpkill (from dsniff) to knock down the connection
4) wait 5 minutes
5) open the tcpdump file in Ethereal to get password/channel

If the 'tag' directive worked correctly in snort, this would be a lot 
easier...

FWIW, I've seen ircd on ports shared by things like AOL im (5190) and a 
bunch of other strange places one wouldn't expect to find an ircd. 
Fortunately, the snort sig looks for it on any port except 80 and 443 
(which you should modify to include 25, lest you email somebody about a 
problem and include a capture).

Note that many times these bots use dyndns (et.al) for the ircd .. and 
I've seen the IPs associated with a name change as often as once a minute.

Thus, sniffing the infected system on startup (and getting the dns 
requests) is the *most* effective tactic .. then you just bitbucket that 
domain in your dns zonefile.

It's still a never-ending game of electronic whack-a-mole, IMHO.

Michael Holstein CISSP GCIA
Cleveland State University
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://www.secunia.com/