[Dshield] IRC BOT opportunity

Arthur Neville ajnevman at yahoo.com
Thu Oct 13 03:11:12 GMT 2005


Recall the Titan Rain incident and the man who uncovered them ??
Even though he informed the FBI and beleived he was working within there guides.
He lost his job, was about to be brought up on charges for violating international Law ??
But what the hey, read the article......
http://www.time.com/time/magazine/printout/0,8816,1098961,00.html

"Fergie (Paul Ferguson)" <fergdawg at netzero.net> wrote:
What makes any of you think that someone from a LEA isn't
already aware/monitoring this list? ;-)

- ferg


-- Jim McCullough wrote:

Touchy subject Mike. Some might say ethical, some might say otherwise. First
thing I would do, is make sure you have logs of the conversations. Document
everything. Then contact the FBI or any other appropriate agency. Notify
them what your research has yeilded and the potential to gain more
information on who is running the botnet. I wouldnt make any plans to do
this, ethically; until I had been in touch with the appropriate authorities
and had my own butt covered. That's my $0.02 worth.


--
Jim McCullough
animall
#dshielders
irc.freenode.net 

On 10/12/05, Halsall, Mike wrote:
>
>
> Question of the day:
>
> Recently I've been playing with an IRC BOT virus (a Randex variant) that
> has come onto my college's campus. These viruses have become
> increasingly sophisticated in their capabilities and have the ability
> to, of course, receive a download command from their Op and go grab a
> file and run it silently - hence introducing (yet) another ingress path
> for more malware/viruses.
>
> Being curious, and taking the appropriate precautions (anonymous proxies
> through Tor), I hopped onto the IRC server these Bots were joining and
> made myself look like one of them. This server, in Hungary, controls
> ~17000 Bots.
>
> Over the past few days I've struck up conversations with the Ops (3 of
> them), finally talking to their leader. None of them are all too
> technical, they don't code and are just into this to make money (through
> spam (maybe some extortion?)). In my conversation last night, I let the
> leader know that I am a capable programmer (c/c++ skills) and know
> networks. He asked me to write them a new client, saying that he was
> sick of this IRC based net and having to move every so often due to
> being shut down (which does no good, because he still retains his Bots).
> He says he has a friend with a really large Botnet that uses a
> distributed P2P model.
>
> I see an opportunity here. Not a big one. Not changing the world. But
> a fun project, nonetheless. Write a new client for them that isn't IRC
> based. Get them to push this new client to their Bots. Having written
> the code, I can then break apart Botnet from the inside - not giving
> them a chance to just hop to another host and even let the victims know
> their machines are infected. Also, it gives opportunity to find out who
> these people are (they're in the States).
>
> I'd let certain organizations know what I would be doing (CERT, for
> instance) and pass them the source when it was ready to roll. However,
> before doing anything, I'd love to hear what you think. Let the ethical
> debate begin!
>
> Mike
>
>

--
"Fergie", a.k.a. Paul Ferguson
Engineering Architecture for the Internet
fergdawg at netzero.net or fergdawg at sbcglobal.net
ferg's tech blog: http://fergdawg.blogspot.com/

_________________________________________
Using .Net? Need to know more about .Net Security?
http://isc.sans.org/banner_count.php?dest=dotnet

_______________________________________________
send all posts to list at lists.dshield.org
To change your subscription options (or unsubscribe), see: http://www.dshield.org/mailman/listinfo/list

		
---------------------------------
 Yahoo! Music Unlimited - Access over 1 million songs. Try it free.


More information about the list mailing list