Re: Why attacker install irc after hacking?

[Philippe De Ryck <philippe.de.ryck () skynet be>]

On Thu, 2006-04-20 at 04:55 +0000, Monty Ree wrote:
> Hello, all.
>
> I have operated linux server for a long time.
> and I have found that some irc(psybnc etc) related program was installed 
> after scan or hacking.
>
> I can't understand 
> Why attackers installed and executed irc program?
> Why attackers use irc after hacking?
> Just chatting is not...I guess..

Hi,

I suppose that the set up an IRC server where clients can connect to.
Only, these clients are probably not regular clients but malware on
infected PC's. This way, the cracker can control the zombies and create
a botnet for instance. The zombies receive their commands via IRC, so a
simple line on the IRC channel can launch an attack.

Don't know if there are other reasons to setup IRC ...

Philippe De Ryck




-------------------------------------------------------------------------
This List Sponsored by: Webroot

Don't leave your confidential company and customer records un-protected. 
Try Webroot's Spy Sweeper Enterprise(TM) for 30 days for FREE with no 
obligation. See why so many companies trust Spy Sweeper Enterprise to 
eradicate spyware from their networks.
FREE 30-Day Trial of Spy Sweeper Enterprise

http://www.webroot.com/forms/enterprise_lead.php
--------------------------------------------------------------------------