full-disclosure - Re: understanding the botnet C&C..

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <54461.1316188423@turing-police.cc.vt.edu>
Date: Fri, 16 Sep 2011 11:53:43 -0400
From: Valdis.Kletnieks@...edu
To: RandallM <randallm@...mail.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: understanding the botnet C&C..

On Fri, 16 Sep 2011 10:38:16 CDT, RandallM said:
> hi
> an area that I am basically "stupid" on is botnets. Not what they are
> but "how" they work through IRC as the control center. Not just that
> but the various modern programs used. I am aware for instance LOIC can
> be used to connect to an IRC channel.. but, how then does the "herder"
> do the job from IRC..how does he issue commands that all the computers
> connected act upon, etc. ? My curiosity has just got the best of me
> and I would like some pointers to good material that can feed it.

Quick summary:

1) botherder gets on channel #my_botnet_C&C
2) Bots all joing #my_botnet_C&C
3) Botherder sends a message to channel "<secret_pw> crispy_critter nn.nn.nn.nn"
4) Bots receive the message, and contain code that says:
if (word1 == expected_pw) && (word2 == "crispy_critter") then ddos(word3);

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/