RE: IRC DDoS bots

From: James C Slora Jr (Jim.Slora@phra.com)
Date: 03/14/03

  • Next message: Bojan Zdrnja: "RE: CodeRed Observations." 
    From: "James C Slora Jr" <Jim.Slora@phra.com>
To: "'Johannes Ullrich'" <jullrich@euclidian.com>, "'grwolf'" <grwolf@adelphia.net>
Date: Fri, 14 Mar 2003 14:17:41 -0500

    Johannes Ullrich wrote Friday, March 14, 2003 12:56
    > > It's another mIRC based DDoS trojan that scans for NT-Password and IIS
    > > unicode exploits.
    > > So the next questions is... How do we go about apprehending the culprits?
    > > Can we somehow get wxmail.net revoked?

    > IRC bots are a common plague. We do play 'whack the bot' once in a while
    > if we find out about it. So far, I have yet to see a case successfully
    > prosecuted.

    One ray of hope:

    The "TK worm" botnet was hit in a cooperation between U.S. and British
    authorities. They arrested at least some of those responsible. The botnet was
    not shut down by the arrests, but there was some forward progress. TK worm was
    responsible for the ww.tk.gov queries that were common late last year. Like
    most botnets, it did not make a lot of news but it owned at least 18K
    computers and caused millions in damages.

    TK worm is a classic botnet, but it does use a worm component for unattended
    propagation.

    Here's the news story of the bust:
    http://www.theregister.co.uk/content/56/29221.html

    ----------------------------------------------------------------------------

    <Pre>Lose another weekend managing your IDS?
    Take back your personal time.
    15-day free trial of StillSecure Border Guard.</Pre>
    <A href="http://www.securityfocus.com/stillsecure"> http://www.securityfocus.com/stillsecure </A>

  • Next message: Bojan Zdrnja: "RE: CodeRed Observations."

    Relevant Pages

    • RE: CoDeX-W0rm - what happened here?
      ... The quote is probably the sig of the crew or person running the Pubstro ... This is often the sig of a customized worm function that ran the initial ... The worm sounds like a component of a botnet - but you will have to do some ... configuration file often contains the worm component as well if you can ...
      (Bugtraq)
    • vermele
      ... Instant messaging worm builds menacing 'botnet' ... A computer worms that spreads via instant messaging is being used to ... Security experts at US company FaceTime identified the worm as ... amassed botnet between 1000 and 2000 machines. ...
      (soc.culture.romanian)
    • Re: vermele
      ... A computer worms that spreads via instant messaging is being used to ... The worm disguises a malicious executable program as a jpeg image, ... known as a "botnet". ... amassed botnet between 1000 and 2000 machines. ...
      (soc.culture.romanian)
    • Authors of Zotob/Mytob worms arrested (thought to have disabled pax screening computers)
      ... The arrests ... The first Zotob worm emerged Aug. 14, ... and ABC News -- reported widespread infections by the worm. ... Mytob to steal personal information from infected computers and to ...
      (rec.travel.air)