North Australian FISH FINDER TM forums

What Bots Do and How They Work
After having introduced different types of bots, we now want to take a closer look at what these bots normally do and how they work. This section will in detail explain how bots spread and how they are controlled by their masters.

After successful exploitation, a bot uses Trivial File Transfer Protocol (TFTP), File Transfer Protocol (FTP), HyperText Transfer Protocol (HTTP), or CSend (an IRC extension to send files to other users, comparable to DCC) to transfer itself to the compromised host. The binary is started, and tries to connect to the hard-coded master IRC server. Often a dynamic DNS name is provided (for example one from www.dyndns.org) rather than a hard coded IP address, so the bot can be easily relocated. Some bots even remove themselves if the given master server is localhost or in a private subnet, since this indicates an unusual situations. Using a special crafted nickname like USA|743634 or [UrX]-98439854 the bot tries to join the master's channel, sometimes using a password to keep strangers out of the channel. A typical communication that can be observed after a successful infection looks like:

<- :irc1.XXXXXX.XXX NOTICE AUTH :*** Looking up your hostname...
<irc1> PASS secretserverpass
NAUGHTY NICK [urX]-700159
NAUGHTY USER mltfvt 0 0 :mltfvt
<- :irc1.XXXXXX.XXX NOTICE [urX]-700159 :*** If you are having problems connecting due to ping timeouts, please type /quote pong ED322722 or /raw pong ED322722 now.
<PING> PONG :ED322722
<- :irc1.XXXXXX.XXX 001 [urX]-700159 :Welcome to the irc1.XXXXXX.XXX IRC Network [urX]-700159!mltfvt@nicetry
<- :irc1.XXXXXX.XXX 002 [urX]-700159 :Your host is irc1.XXXXXX.XXX, running version Unreal3.2-beta19
<- :irc1.XXXXXX.XXX 003 [urX]-700159 :This server was created Sun Feb 8 18:58:31 2004
<- :irc1.XXXXXX.XXX 004 [urX]-700159 irc1.XXXXXX.XXX Unreal3.2-beta19 iowghraAsORTVSxNCWqBzvdHtGp lvhopsmntikrRcaqOALQbSeKVfMGCuzN

Afterwards, the server accepts the bot as a client and sends him RPL_ISUPPORT, RPL_MOTDSTART, RPL_MOTD, RPL_ENDOFMOTD or ERR_NOMOTD. Replies starting with RPL_ contain information for the client, for example RPL_ISUPPORT tells the client which features the server understands and RPL_MOTD indicates the Message Of The Day (MOTD). In contrast to this, ERR_NOMOTD is an error message if no MOTD is available. In the following listing, these replies are highlihted with colors:

<- :irc1.XXXXXX.XXX 005 [urX]-700159 MAP KNOCK SAFELIST HCN MAXCHANNELS=25 MAXBANS=60 NICKLEN=30 TOPICLEN=307 KICKLEN=307 MAXTARGETS=20 AWAYLEN=307 :are supported by this server
<- :irc1.XXXXXX.XXX 005 [urX]-700159 WALLCHOPS WATCH=128 SILENCE=5 MODES=12 CHANTYPES=# PREFIX=(qaohv)~&@%+ CHANMODES=be,kfL,l,psmntirRcOAQKVGCuzNSM NETWORK=irc1.XXXXXX.XXX CASEMAPPING=ascii :are supported by this server
<- :irc1.XXXXXX.XXX 375 [urX]-700159 :- irc1.XXXXXX.XXX Message of the Day -
<- :irc1.XXXXXX.XXX 372 [urX]-700159 :- 20/12/2004 7:45
<- :irc1.XXXXXX.XXX 372 [urX]-700159 :- - . +
<- :irc1.XXXXXX.XXX 372 [urX]-700159 :- - + .
<- :irc1.XXXXXX.XXX 372 [urX]-700159 :- - ___ .
<- :irc1.XXXXXX.XXX 372 [urX]-700159 :- - . _.--"~~ __"-.
<- :irc1.XXXXXX.XXX 372 [urX]-700159 :- - ,-" .-~ ~"-\ .
<- :irc1.XXXXXX.XXX 372 [urX]-700159 :- - . .^ / ( ) .
<- :irc1.XXXXXX.XXX 372 [urX]-700159 :- - + {_.---._ / ~
<- :irc1.XXXXXX.XXX 372 [urX]-700159 :- - / . Y .
<- :irc1.XXXXXX.XXX 372 [urX]-700159 :- - / \_j +
<- :irc1.XXXXXX.XXX 372 [urX]-700159 :- - . Y ( --l__
<- :irc1.XXXXXX.XXX 372 [urX]-700159 :- - | "-. .
<- :irc1.XXXXXX.XXX 372 [urX]-700159 :- - | (___ . | .)~-.__/
<- :irc1.XXXXXX.XXX 372 [urX]-700159 :- - . .
<- :irc1.XXXXXX.XXX 372 [urX]-700159 :- - l _)
<- :irc1.XXXXXX.XXX 372 [urX]-700159 :- - . \ "l
<- :irc1.XXXXXX.XXX 372 [urX]-700159 :- - + \ - \ ^.
<- :irc1.XXXXXX.XXX 372 [urX]-700159 :- - . ^. "-. -Row .
<- :irc1.XXXXXX.XXX 372 [urX]-700159 :- - "-._ ~-.___,
<- :irc1.XXXXXX.XXX 372 [urX]-700159 :- - . "--.._____.^
<- :irc1.XXXXXX.XXX 372 [urX]-700159 :- - . .
<irc1>Moon<-
<- :irc1.XXXXXX.XXX 376 [urX]-700159 :End of /MOTD command.
<urX> PRIVMSG #foobar :[lsass]: Exploiting IP: 200.124.175.XXX
NAUGHTY PRIVMSG #foobar :[TFTP]: File transfer started to IP: 200.124.175.XXX (C:\WINDOWS\System32\NAV.exe).

Then the IRC server (also called IRC daemon, abbreviated IRCd) will provide the channels userlist. But most botnet owners have modified the IRCd to just send the channel operators to save traffic and disguise the number of bots in the channel.

<- :irc1.XXXXXX.XXX 353 [urX]-700159 @ #foobar :@JAH
<- :irc1.XXXXXX.XXX 366 [urX]-700159 #foobar :End of /NAMES list.
<- :irc1.XXXXXX.XXX NOTICE [urX]-700159 :BOTMOTD File not found
<- :[urX]-700159 MODE [urX]-700159 :+x

The controller of a botnet has to authenticate himself to take control over the bots. This authentication is done with the help of a command prefix and the "auth" command. The command prefix is used to login the master on the bots and afterwards he has to authenticate himself. For example,

.login leet0
.la plmp -s

are commands used on different bots to approve the controller. Again, the "-s" switch in the last example tells the bots to be silent when authenticating their master. Else they reply something like

[MAIN]: Password accepted.
[r[X]-Sh0[x]]: . Password Accettata ):. .

which can be a lot of traffic if you have 10,000 bots on your network. Once an attacker is authenticated, they can do whatever they want with the bots: Searching for sensitive information on all compromised machines and DCC-sending these files to another machine, DDoS-ing individuals or organizations, or enabling a keylogger and looking for PayPal or eBay account information. These are just a few possible commands, other options have been presented in the previous section. The IRC server that is used to connect all bots is in most cases a compromised box. This is probably because an attacker would not receive operator-rights on a normal chat network and thus has to set-up their own IRC server which offers more flexibility. Furthermore, we made some other interesting observations: Only beginners start a botnet on a normal IRCd. It is just too obvious you are doing something nasty if you got 1.200 clients named as rbot-<NAUGHTY reporting scanning results in a channel. Two different IRC servers software implementation are commonly used to run a botnet: Unreal IRCd and ConferenceRoom:

Unreal IRCd (http://www.unrealircd.com/) is cross-platform and can thus be used to easily link machines running Windows and Linux. The IRC server software is stripped down and modified to fit the botnet owners needs.
Common modifications we have noticed are stripping "JOIN", "PART" and "QUIT" messages on channels to avoid unnecessary traffic. In addition, the messages "LUSERS" (information about number of connected clients) and "RPL_ISUPPORT" are removed to hide identity and botnet size. We recently got a win32 binary only copy of a heavily modified Unreal IRCd that was stripped down and optimized. The filenames suggest that this modified IRCd is able to serve 80.000 bots:

cac8629c7139b484e4a19a53caaa6be0 UNREAL.3.2-m0dded-LyR.rar
9dbaf01b5305f08bd8c22c67e4b4f729 Unreal-80k[MAX]users.rar
de4c1fbc4975b61ebeb0db78d1fba84f unreal-modded-80k-users-1.rar

As we don't run a 80,000 user botnet and lack 80,000 developers in our group we are not able to verify that information. But probably such huge botnets are used by cyber criminals for "professional" attacks. These kind of networks can cause severe damage since they offer a lot of bandwidth and many targets for identity theft.
ConferenceRoom (http://www.webmaster.com/) is a commercial IRCd solution, but people who run botnets typically use a cracked version. ConferenceRoom offers the possibility of several thousand simultaneous connections, with nickname and channel registration, buddy lists and server to server linking.
Surprisingly we already found a Microsoft Chat Server as botnet host, and it seemed to run stable.

BC..........where do you find this shite?????????

I am in Matt Flynn's computer in here. Where are you?

WHAT???????????? English please.

Are you confused? Your polite style is very nice. Do you mean you are from England or you Speak English?

i'mmmmmmmmmmmmm back baby
..................................................................................................................................................................................
...................................................................................................................................................................................
....................................................................................................................................................................................
.....................................................................................................................................................................................
.....................................................................................................................................................................................
......................................................................................................................................................................................
......................................................................................................................................................................................

Don't call me "baby". Tell me a story.

Lost

Stand still. The trees ahead and bushes beside you
Are not lost. Wherever you are is called Here,
And you must treat it as a powerful stranger,
Must ask permission to know it and be known.
The forest breathes. Listen. It answers,
I have made this place around you,
If you leave it you may come back again, saying Here.
No two trees are the same to Raven.
No two branches are the same to Wren.
If what a tree or a bush does is lost on you,
You are surely lost. Stand still. The forest knows
Where you are. You must let it find you.


David Wagoner

Where did you lose your Stand still ? You always have to meet yourself at the airport. I am all ears. Are you serious? As Bertrand Russel said, it must have taken ages for people to realize that a brace of pheasants and a couple of days are both instances of the number "two. "That is a hypothetical question. Whatever you say, back-cast. That David is a cool dude.

I Was Educated By Myself

I can't buy the lie and it don't matter
Even though I try to keep my health
It all seems the same, such a silly game
Played by silly fools who don't even follow their own rules

But oh, when the sunshine follows me around
Lifts my feet and takes me from the ground
High enough to see the shelf
And know that I was educated by myself

I have seen the streets groaning, not battered
Though amongst us all, we kept our wealth
And though the rain goes pitter-patter,
It don't change the pain that we all felt

But oh, when the sunshine follows us around
Lifts our feet and takes us from the ground,
High enough for us to tell
That we were educated by ourselves

It's a simple dream, a common pattern
A universal scheme for us to sell
And though it's a long, long way between Mars and Saturn,
But right here on Earth, we know so well
That all we need is sunshine on the ground
And smiles and smiles and smiles from frown to frown
Just enough for us to yell
That we were educated by ourselves


Words by Richie Havens

Where were you Educated By him or herself he or she can not buy the lie and it do not matter Even though he or she try to keep his or her health It all seems the same such a silly game Played by silly fools who do not even follow their own rules But oh when the sunshine follows him or her around Lifts his or her feet and takes him or her from the ground High enough to see the shelf And know that he or she was educated by him or herself he or she have seen the streets groaning not battered Though amongst us all we kept our wealth And though the rain goes pitter-patter It do not change the pain that we all felt But oh when the sunshine follows us around Lifts our feet and takes us from the ground High enough for us to tell That we were educated by ourselves it is a simple dream a common pattern A universal scheme for us to sell And though it is a long long way between Mars and Saturn But right here on Earth we know so well That all we need is sunshine on the ground And smiles and smiles and smiles from frown to frown Just enough for us to yell That we were educated by ourselves Words by Richie Havens?

Granny

Through every nook and every cranny
The wind blew in on poor old Granny
Around her knees, into each ear
(And up nose as well, I fear)

All through the night the wind grew worse
It nearly made the vicar curse
The top had fallen off the steeple
Just missing him (and other people)

It blew on man, it blew on beast
It blew on nun, it blew on priest
It blew the wig off Auntie Fanny-
But most of all, it blew on Granny!


~


Porridge

Why is there no monument
To Porridge in our land?
It it's good enough to eat,
It's good enough to stand!

On a plinth in London
A statue we should see
Of Porridge made in Scotland
Signed, "Oatmeal, O.B.E."
(By a young dog of three)

~


Contagion

Elephants are contagious!
Be careful how you tread.
An Elephant that's been trodden on
Should be confined to bed!
Leopards are contagious too.
Be careful tiny tots.
They don't give you a temperature
But lots and lots - of spots.

The Herring is a lucky fish
From all disease inured.
Should he be ill when caught at sea;
Immediately - he's cured!


- Spike Milligan

Bongaloo
"What is a Bongaloo, Daddy?"
"A Bongaloo, Son," said I,
"Is a tall bag of cheese
Plus a Chinaman's knees
And the leg of a nanny goat's eye."

"How strange is a Bongaloo, Daddy?"
"As strange as strange," I replied.
"When the sun's in the West
It appears in a vest
Sailing out with the noonday tide."

"What shape is a Bongaloo, Daddy?"
"The shape, my Son, I'll explain:
It's tall round the nose
Which continually grows
In the general direction of Spain."

'Are you sure there's a Bongaloo, Daddy?'
"Am I sure, my Son?" said I.
"Why, I've seen it, not quite
On a dark sunny night

Do you think that I'd tell you a lie?

OK I will try to be careful how you treadAre all Bongaloo Son said he or she tall bag of cheese
Plus a Chinaman's knees
And the leg of a nanny goat's eye ? Do you mean your name is strange as strange he or she replied ? And then what happened? Oval.

Hook, Line And Sinker


I have always wondered what it means
when someone using oral means
says something so colloquial
that it is understood by all
except us foreigners of course
yes language, it is such a force!

A lady fishing from the bridge
her husband though had climbed a ridge
they were in heated competition
and liked the thought of going fishing.

A tug was felt along her line
at first she felt she should recline
and pull until the fish came out
it probably would be a trout.

It did not work and hubby yelled
about the way his sweetheart held
the fishing pole, she called him 'stinker'
then she fell in, hook, line and sinker.

Herbert Nehrlich

Did it really?