Security Incidents mailing list archives

IRC-bots: what are they for ?

From: hektor () RZ RWTH-AACHEN DE (Jens Hektor)
Date: Wed, 12 Jan 2000 16:04:41 -0000


Hi,

is anybody out there who could explain to me why on nearly
every cracked machine I get in touch with the crackers
have installed IRC-bots, most of the time "eggdrop" ?

What practical use can taken by installing a bot on a cracked machine ?

Does it give any backdoors to the system (file access,
interactive access, monitoring, etc) ?

Is such a bot possibly part of a larger communication 
infrastructure, maybe like the tfn/trinoo/stacheldraht
thingie  ?

In hope for clarification, irc-ignorant Jens Hektor

Current thread:

Ports 12345, 5742 and 20034, (continued)
- Ports 12345, 5742 and 20034 Artur Nowak (Jan 08)
  - Re: Ports 12345, 5742 and 20034 Michal Rok (Jan 10)
    - Re: Ports 12345, 5742 and 20034 Artur Nowak (Jan 11)
- Re: Distributed Scanning? Richard Bejtlich (Jan 08)
- Port 4 Arne Vidar Sjønøs (Jan 09)
  - Re: Port 4 Keith Owens (Jan 10)
  - Re: Port 4 Sean Sosik-Hamor (Jan 11)
    - Re: Port 4 Philipp Buehler (Jan 11)
    - Re: Port 4 Sean Sosik-Hamor (Jan 11)
    - Re: Port 4 Boris Badenov (Jan 11)
    - IRC-bots: what are they for ? Jens Hektor (Jan 12)
    - Re: IRC-bots: what are they for ? Jon Paul, Nollmann (Jan 12)
    - Re: IRC-bots: what are they for ? SecOrg (Jan 12)
    - Re: IRC-bots: what are they for ? Ninja Information Systems. (Jan 12)
    - Re: IRC-bots: what are they for ? Jens Hjalmarsson (Jan 12)
    - Re: IRC-bots: what are they for ? tyler (Jan 12)
    - Re: IRC-bots: what are they for ? David Brumley (Jan 12)
    - Re: IRC-bots: what are they for ? The Undernet Bonk (Jan 12)
    - Re: IRC-bots: what are they for ? Filip M. Gieszczykiewicz (Jan 12)
    - Strange behaviour Belgarion of Riva (Jan 13)
    - Re: Strange behaviour Richard Bejtlich (Jan 15)

(Thread continues...)