Baiting bot herders

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Mon Jun 23, 2008 8:40 pm

This is a bit unusual, but I thought it was funny. I took apart an IRC bot, found where it was connecting to, and logged over TOR from Pidgin. I then sent an IM to the guy running the botnet, and things took a turn for the strange. Here is the conversation:

Conversation with return at 5/25/2008 3:32:37 AM on [email protected] (irc)
(3:34:20 AM) Aladdin: Man, I need to update my anti-virus.
(3:35:11 AM) return: what?
(3:35:38 AM) return: update where?
(3:36:33 AM) Aladdin: It's no good.
(3:37:03 AM) return: go to google and serch
(3:37:49 AM) return: ware you from?
(3:38:09 AM) Aladdin: The internet.
(3:38:36 AM) return: ...
(3:39:34 AM) return: city? :))
(3:39:36 AM) return: country?
(3:39:37 AM) return: :))
(3:39:52 AM) Aladdin: My mommy says not to talk to strangers, lol.
(3:40:10 AM) return: :)))))
(3:40:11 AM) return: lol
(3:40:33 AM) return: you are boy or girls?
(3:40:34 AM) return: :))0
(3:40:43 AM) Aladdin: Some combination of the 2.
(3:40:49 AM) return: :))
(3:40:51 AM) return: nice
(3:41:39 AM) return: i like you
(3:41:41 AM) return: :))
(3:41:47 AM) Aladdin: Why?
(3:41:58 AM) return: i need you
(3:41:59 AM) return: :
(3:42:02 AM) Aladdin: Why?
(3:42:30 AM) return: i love you
(3:42:45 AM) Aladdin: I'm scared.
(3:43:21 AM) Aladdin: You are quick to offer love.
(3:43:22 AM) return: plz tell me you love me?
(3:43:42 AM) Aladdin: I hardly know you...
(3:43:55 AM) return: i am fro italy
(3:43:57 AM) return: you?
(3:44:10 AM) Aladdin: U.S.
(3:44:29 AM) return: us ware?
(3:44:34 AM) return: canada?
(3:44:58 AM) Aladdin: One of the 50 states in the U.S.
(3:45:26 AM) return: yes i now
(3:45:35 AM) Aladdin: Canada is not in the U.S.
(3:45:48 AM) return: in the America
(3:45:50 AM) return: :))
(3:45:53 AM) Aladdin: It is close to the U.S. but not in the U.S.
(3:46:08 AM) return: yes i now
(3:46:24 AM) Aladdin: U.S. is a country, not a continent. America is a continent, though it has a north and south end.
(3:46:39 AM) Aladdin: Canada and U.S. share the north continent.
(3:46:46 AM) return: yes
(3:46:48 AM) return: :)
(3:47:17 AM) Aladdin: Within /America/ I am located in the /U.S./
(3:48:18 AM) return: you have a love?
(3:48:24 AM) Aladdin: Maybe...
(3:49:09 AM) return: :)
(3:49:18 AM) return: i am a gey
(3:49:21 AM) return: you?
(3:49:22 AM) return: :))
(3:49:44 AM) Aladdin: Not sure.
(3:49:54 AM) return: whay
(3:50:28 AM) Aladdin: Not sure what I am.
(3:50:39 AM) return: :(
(3:50:57 AM) Aladdin: Just kidding. I have a strange sense of humor.
(3:51:15 AM) return: :)
(3:51:26 AM) Aladdin: You get visitors here often?
(3:51:39 AM) return: no
(3:51:43 AM) Aladdin: Ever?
(3:51:50 AM) return: ever..
(3:52:04 AM) Aladdin: Wow, I'm the first person!
(3:52:23 AM) return: yes
(3:52:26 AM) Aladdin: I'm so special...
(3:52:45 AM) return: yes me love
(3:53:03 AM) Aladdin: So, what do you do here?
(3:53:18 AM) return: i am lokin me love
(3:53:22 AM) return: loking.
(3:53:35 AM) Aladdin: loking?
(3:53:47 AM) return: yes..
(3:53:50 AM) Aladdin: What's that?
(3:54:46 AM) return: lock...
(3:55:04 AM) Aladdin: You're locking your love?
(3:55:11 AM) return: yes
(3:55:19 AM) Aladdin: Bondage?
(3:56:37 AM) return: what?
(3:57:00 AM) Aladdin: You said you're "locking" your love, but I don't know what that means.
(3:57:05 AM) Aladdin: Are you native English?
(3:58:08 AM) return: i am speek litel english
(4:00:49 AM) Aladdin: espanol?
(4:01:22 AM) return: italy
(4:01:52 AM) Aladdin: I thought Italy's native language was Italian.
(4:02:10 AM) Aladdin: You clearly know at least one language from another country.
(4:02:26 AM) Aladdin: Anyway, "locking your love" doesn't make sense in English.
(4:02:43 AM) return: yes .....
(4:04:02 AM) Aladdin: So, what do you do here all day by yourself?
(4:04:34 AM) return: wheiting for you
(4:05:06 AM) Aladdin: How long you been here?
(4:05:31 AM) return: 1 mouth
(4:05:52 AM) Aladdin: You expecting me for a month?
(4:06:02 AM) return: yes..
(4:06:19 AM) Aladdin: How do you know I'm the right one?
(4:06:25 AM) Aladdin: You don't even know me.
(4:06:55 AM) return: but i need to see
(4:07:24 AM) Aladdin: How do you tell?
(4:07:47 AM) return: tell you..
(4:08:01 AM) Aladdin: Tell me what?
(4:08:22 AM) return: i need to see you...
(4:09:49 AM) Aladdin: What's this pic for?
(4:09:53 AM) return: you have a site ?
(4:10:05 AM) return: a pikcers?
(4:10:39 AM) Aladdin: This one. What's it say?
(4:10:44 AM) Offering to send idiot.JPG to return
(4:11:12 AM) Aladdin: Anti-virus blocks pictures but doesn't block IRC.
(4:11:15 AM) Aladdin: Figures.
(4:11:22 AM) return: pf
(4:11:28 AM) Aladdin: What is pf?
(4:11:33 AM) You canceled the transfer of idiot.JPG
(4:11:36 AM) return: :(
(4:12:01 AM) Aladdin: It says "ce prost/proasta esti daca nu vrei sa ramai ultimu fraier/fraira daml mai departe"
(4:12:07 AM) Aladdin: What's that about?
(4:12:28 AM) Aladdin: It's called "idiot.jpg" and I think it's yours.
(4:12:32 AM) return: i don`t know
(4:12:41 AM) return: no
(4:14:32 AM) return: you have a site?
(4:14:44 AM) Aladdin: It's shut down.
(4:14:53 AM) return: :(
(4:15:04 AM) return: yo are a hacker?
(4:15:08 AM) return: what is it a hacker?
(4:15:37 AM) Aladdin: No. I didn't like it and threw it out.
(4:16:05 AM) return: good
(4:16:16 AM) Aladdin: Good?
(4:16:21 AM) Aladdin: You don't like hackers?
(4:16:50 AM) return: no
(4:16:53 AM) return: i dont like
(4:17:07 AM) Aladdin: Why not?
(4:17:55 AM) return: becose is beed
(4:18:22 AM) return: i have a frend of de undernet end are a need a root of scan do you have?
(4:18:47 AM) Aladdin: What are you asking?
(4:19:09 AM) Aladdin: You have a friend of the undernet, but do I need what?
(4:20:30 AM) return: a root
(4:20:41 AM) Aladdin: A root terminal?
(4:20:55 AM) return: yes
(4:21:06 AM) Aladdin: What about scanning?
(4:21:20 AM) return: scaning of the ip
(4:21:28 AM) Aladdin: You mean probing?
(4:21:29 AM) return: i dont know... what is its
(4:21:49 AM) return: ..
(4:21:51 AM) Aladdin: To find IP addresses and open ports, that is called "probing" in English.
(4:22:01 AM) Aladdin: nmap, right?
(4:22:21 AM) return: yes
(4:22:32 AM) Aladdin: Yeah, that's probing.
(4:22:53 AM) return: you don`t have?
(4:22:56 AM) Aladdin: So, you're asking if I want a root-terminal for probing?
(4:23:03 AM) Aladdin: I have nmap.
(4:23:13 AM) return: is good?
(4:23:30 AM) Aladdin: I don't know. Never tried anything else.
(4:23:39 AM) return: ..
(4:23:44 AM) return: is a linux or what?
(4:23:50 AM) Aladdin: Got in trouble for it once. They don't like probing where I'm from.
(4:24:03 AM) Aladdin: They're mean.
(4:24:13 AM) return: ok
(4:24:30 AM) Aladdin: Yes, it's Linux.
(4:25:13 AM) return: you give me a add for me frends?
(4:25:52 AM) Aladdin: I don't know. Are you asking me for a root terminal, or are you offering one?
(4:26:06 AM) Aladdin: I don't have adds right now.
(4:26:35 AM) return: me love ofering you
(4:26:37 AM) return: }{
(4:26:50 AM) Aladdin: So, you're offering me a root terminal?
(4:26:54 AM) Aladdin: Where, and what OS?
(4:27:31 AM) return: i dont have ..
(4:27:39 AM) Aladdin: You're friend has it?
(4:28:01 AM) return: i dont know
(4:28:13 AM) return: i asking new
(4:28:49 AM) return: no no have a root terminal
(4:29:51 AM) return: be ring back
(4:36:02 AM) return: ware ar you age?
(4:36:21 AM) Aladdin: Between 18 and 25.
(4:36:53 AM) return: 25 yers?
(4:37:05 AM) Aladdin: Close to it that.
(4:37:11 AM) Aladdin: *Close to 25.
(4:37:30 AM) return: 18 ?
(4:37:44 AM) Aladdin: Older than 18, younger than 25.
(4:38:11 AM) return: i have 19 yers
(4:38:46 AM) Aladdin: We're within no more than 3 years of eachother.
(4:39:17 AM) return: eachother what?
(4:39:35 AM) Aladdin: I am not more than 3 years older than you, or 3 years younger.
(4:40:01 AM) return: ok
(4:40:32 AM) return: you have a bnc?
(4:43:00 AM) Aladdin: Don't think so.
(4:43:19 AM) return: why?
(4:43:30 AM) Aladdin: Computer doesn't support it.
(4:43:44 AM) return: ok
(4:44:03 AM) Aladdin: Just VGA and USB.
(4:44:22 AM) return: ok
(4:44:28 AM) Aladdin: And networking of course.
(4:44:42 AM) return: yo have a mail?
(4:44:50 AM) Aladdin: Maybe. Why?
(4:45:11 AM) return: plz seend me yor piciors
(4:45:50 AM) return: you seend me?
(4:46:00 AM) Aladdin: You want my address?
(4:46:06 AM) return: [email protected]
(4:46:17 AM) return: this is it my adress
(4:46:30 AM) return: send me plz
(4:46:31 AM) Aladdin: <<censored>>@aol.com
(4:46:58 AM) Aladdin: I'll have to dig up the old album... wherever it is...
(4:47:23 AM) return: 1 piciors
(4:47:27 AM) return: whit you
(4:47:29 AM) return: send me
(4:49:45 AM) return: you send?
(4:49:55 AM) Aladdin: Looking for a picture...
(4:50:03 AM) return: ok
(4:50:12 AM) Aladdin: Haven't seen the album in a while.
(4:50:29 AM) return: ok
(5:03:14 AM) Aladdin: It's sent.
I send him a picture of Jack Bauer from American TV show 24.

(5:03:24 AM) return: k
(5:05:14 AM) return: you are nice
(5:05:15 AM) return: :D
(5:05:22 AM) Aladdin: Thanks.
(5:05:30 AM) return: }{
(5:05:34 AM) return: i kiss you
(5:10:53 AM) Aladdin: Ok, so what did you have in mind for root terminals?
(5:11:24 AM) return: i dont have..
(5:12:21 AM) Aladdin: Your friend?
(5:12:48 AM) return: no have this
(5:13:57 AM) Aladdin: What are you doing in the chat room?
(5:15:28 AM) return: i waiting me love
(5:15:39 AM) Aladdin: Waiting for what?
(5:15:54 AM) return: for a fuck with me
(5:17:11 AM) Aladdin: So what is the extra chat room for?
(5:17:58 AM) return: for funy
(5:19:47 AM) Aladdin: What's so funny in there?
(5:20:06 AM) return: waiting
(5:32:04 AM) Aladdin: Who are your friends?
(5:32:49 AM) return: me brther
(5:32:53 AM) return: brather.
(5:33:10 AM) Aladdin: What's he like?
(5:34:21 AM) return: what?
(5:34:50 AM) Aladdin: Your brother, or your other friends.
(5:35:36 AM) return: i dont now
(5:35:49 AM) Aladdin: How do you now know if they are your friends?
(5:36:13 AM) return: i not andrested
(5:37:05 AM) Aladdin: Do you ever talk to them?
(5:37:47 AM) return: i talk but not this problem
(5:38:08 AM) Aladdin: What problem?
(5:39:05 AM) return: a problem becouse a am a gay
(5:39:09 AM) return: this problem
(5:40:13 AM) Aladdin: Well, in whatever you talk with them about, what are they like?
(5:40:30 AM) return: yes
(5:40:45 AM) Aladdin: What are they like?
(5:41:25 AM) return: no adrestend
(5:41:27 AM) return: sory
(5:41:49 AM) Aladdin: What is adrestend?
(5:42:16 AM) return: no capisi
(5:44:24 AM) Aladdin: Are they nice?
(5:44:52 AM) return: :D
(5:44:55 AM) return: yes
(5:45:47 AM) Aladdin: Where are they from?
(5:46:29 AM) return: italy
(5:46:41 AM) Aladdin: They live with you?
(5:46:52 AM) return: yes
(5:47:08 AM) Aladdin: They watching us talk?
(5:48:28 AM) return: yes orever.
(5:49:34 AM) Aladdin: So, why do you run an IRC server, but not have anyone on it?
(5:50:04 AM) return: is frend server
(5:50:25 AM) Aladdin: Why does your friend run an IRC server without anyone on it?
(5:51:19 AM) return: i dont know
(5:51:27 AM) Aladdin: Is he there?
(5:51:28 AM) return: by i need to go
(5:51:33 AM) return: yes
(5:51:46 AM) Aladdin: Does he not want to talk?
(5:51:56 AM) return: no
(5:51:59 AM) return: is busy
(5:52:06 AM) Aladdin: You too?
(5:52:21 AM) return: i going for shop
(5:52:31 AM) Aladdin: What you shopping for?
(5:52:32 AM) return <AUTO-REPLY>: leving for shop
(5:52:52 AM) return: for me
(5:53:28 AM) Aladdin: But what are you looking for?
(5:53:29 AM) return <AUTO-REPLY>: leving for shop
(5:53:50 AM) return: a car

Posted: Mon Jun 23, 2008 11:46 pm

It's always nice to meet new techie types on here Smile

Did you consider posting a kill command for the botnet to the IRC? Could you work out any of the command protocol for the bots? That would be a service for the world Smile

I recently spent several hours unpicking a very well obfuscated bit of drive-by javascript and was amazed by the result - basically what appears to be a rootkit for unix/linux variants. My AVG freaked out on me! You can read the results in the Very Annoyed Cheque Lad thread, very near the end. Clearly the Lad didn't write it, it looked more Russian to be honest, but I feel there's value in understanding the tools we're up against.

If you want to discuss this kind of fun, PM me sometime Smile

Posted: Tue Jun 24, 2008 3:04 am

Actually, I wasn't an IRC op, so I didn't think I could do anything. I logged in picking random names from the nicks.txt in his package, and each time I entered #x, he would post a command I didn't understand. Eventually he started ignoring me and banning me each time I got a new TOR proxy, so I tried IMing him directly. That's where things took a turn for a strange, and I caught him by surprise. I somehow could not make him admit what he was doing.

Posted: Tue Jun 24, 2008 6:57 am

Yes, it's those commands we need to decipher - if nothing else they should provide a warning of what the botnet is being commanded to do, so it's worth carrying on intercepting them!

Posted: Tue Jun 24, 2008 10:10 am

I actually did this bait a while ago, but I think I may still have the original buried in an encrypted zip file somewhere. When I first logged in, I received some commands I didn't understand, and of course didn't respond appropriately, then got kicked.

I think it's best we discuss how to handle this privately for obvious reasons, but if I recall, the commands are listed in one of the packaged config files.

Posted: Tue Jun 24, 2008 10:40 am

Castle Cops would undoubtedly like to listen to what you know.

I'm a member there as well as other related places (aa419 and scamwarners) though I spend most time here as I'm not a techie nerd.