AplusWebMaster
Topic Starter
FYI…
- http://isc.sans.org/diary.php?storyid=1043
Last Updated: 2006-01-14 20:19:36 UTC
"Malware has become a business like any other over the last few years. Individual bot herds will grow, innovate, merge and well, sometimes even fold. Visiting an IRC server used to control bots, the following message made perfect sense in that respect:
*** Topic for #-sd-bot: $xscan asn139 200 5 0 217.x.x.x -r -s
*** #-sd-bot burt0n 1137203776
*** #-sd-bot 1136645024
The channel used to control the bots, '#-sd-bot', is using a standard command to instruct its members to scan an IP range for a particular vulnerability. On the other hand, if a human should connect to the host and issue a '/list' command to find out about channels on that server, the following message is displayed:
/list
*** Channel Users Topic
*** #help 1 IF YOU ARE HERE ITS BECAUSE I MIGHT HAVE INFECTED ONE OF YOUR MACHINES, DONT WORRY NOTHING IS GONNA BE HARMED WITH THE DRONES, FOR FURTHER INFORMATION ON REMOVALS PLS VISIT - WWW . NORTONANTIVIRUSES . COM - OR LEAVE A MSG KTHX.
We do not know if the owner of 'Nortonantiviruses.com' is actually associated with the bot channel. But the site is not a legit Symantec/Norton site. Instead, its a "placeholder" site collecting referral fees. Its whois registration is anonymous. The referral site does not appear to be malicious.
This is just a logical evolution of the current bot business. Like any business, the operators try to maximize the revenue they receive from a customer. If a customer found out that they are infected, and is visiting the bot server to find out more, they may as well try to get a cut on the cleanup revenue which would otherwise be lost."
- http://isc.sans.org/diary.php?storyid=1043
Last Updated: 2006-01-14 20:19:36 UTC
"Malware has become a business like any other over the last few years. Individual bot herds will grow, innovate, merge and well, sometimes even fold. Visiting an IRC server used to control bots, the following message made perfect sense in that respect:
*** Topic for #-sd-bot: $xscan asn139 200 5 0 217.x.x.x -r -s
*** #-sd-bot burt0n 1137203776
*** #-sd-bot 1136645024
The channel used to control the bots, '#-sd-bot', is using a standard command to instruct its members to scan an IP range for a particular vulnerability. On the other hand, if a human should connect to the host and issue a '/list' command to find out about channels on that server, the following message is displayed:
/list
*** Channel Users Topic
*** #help 1 IF YOU ARE HERE ITS BECAUSE I MIGHT HAVE INFECTED ONE OF YOUR MACHINES, DONT WORRY NOTHING IS GONNA BE HARMED WITH THE DRONES, FOR FURTHER INFORMATION ON REMOVALS PLS VISIT - WWW . NORTONANTIVIRUSES . COM - OR LEAVE A MSG KTHX.
We do not know if the owner of 'Nortonantiviruses.com' is actually associated with the bot channel. But the site is not a legit Symantec/Norton site. Instead, its a "placeholder" site collecting referral fees. Its whois registration is anonymous. The referral site does not appear to be malicious.
This is just a logical evolution of the current bot business. Like any business, the operators try to maximize the revenue they receive from a customer. If a customer found out that they are infected, and is visiting the bot server to find out more, they may as well try to get a cut on the cleanup revenue which would otherwise be lost."
