SmartFeedSmartFeed          

Porsche Hangout


WELCOME - YOU ARE CURRENTLY VIEWING 419EATER AS A GUEST

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

ScamWarners.com - Internet Anti-Fraud Center - now open!


 Baiting bot herders

View next topic
View previous topic
 
Post new topicReply to topic
Author Message
mindgames
Not quite a Newb


Joined: 20 Jun 2007
Posts: 54
Location: United States


PostPosted: Mon Jun 23, 2008 8:40 pm Reply with quoteBack to top

This is a bit unusual, but I thought it was funny. I took apart an IRC bot, found where it was connecting to, and logged over TOR from Pidgin. I then sent an IM to the guy running the botnet, and things took a turn for the strange. Here is the conversation:

Conversation with return at 5/25/2008 3:32:37 AM on [email protected] (irc)
(3:34:20 AM) Aladdin: Man, I need to update my anti-virus.
(3:35:11 AM) return: what?
(3:35:38 AM) return: update where?
(3:36:33 AM) Aladdin: It's no good.
(3:37:03 AM) return: go to google and serch
(3:37:49 AM) return: ware you from?
(3:38:09 AM) Aladdin: The internet.
(3:38:36 AM) return: ...
(3:39:34 AM) return: city? :))
(3:39:36 AM) return: country?
(3:39:37 AM) return: :))
(3:39:52 AM) Aladdin: My mommy says not to talk to strangers, lol.
(3:40:10 AM) return: :)))))
(3:40:11 AM) return: lol
(3:40:33 AM) return: you are boy or girls?
(3:40:34 AM) return: :))0
(3:40:43 AM) Aladdin: Some combination of the 2.
(3:40:49 AM) return: :))
(3:40:51 AM) return: nice
(3:41:39 AM) return: i like you
(3:41:41 AM) return: :))
(3:41:47 AM) Aladdin: Why?
(3:41:58 AM) return: i need you
(3:41:59 AM) return: :
(3:42:02 AM) Aladdin: Why?
(3:42:30 AM) return: i love you
(3:42:45 AM) Aladdin: I'm scared.
(3:43:21 AM) Aladdin: You are quick to offer love.
(3:43:22 AM) return: plz tell me you love me?
(3:43:42 AM) Aladdin: I hardly know you...
(3:43:55 AM) return: i am fro italy
(3:43:57 AM) return: you?
(3:44:10 AM) Aladdin: U.S.
(3:44:29 AM) return: us ware?
(3:44:34 AM) return: canada?
(3:44:58 AM) Aladdin: One of the 50 states in the U.S.
(3:45:26 AM) return: yes i now
(3:45:35 AM) Aladdin: Canada is not in the U.S.
(3:45:48 AM) return: in the America
(3:45:50 AM) return: :))
(3:45:53 AM) Aladdin: It is close to the U.S. but not in the U.S.
(3:46:08 AM) return: yes i now
(3:46:24 AM) Aladdin: U.S. is a country, not a continent. America is a continent, though it has a north and south end.
(3:46:39 AM) Aladdin: Canada and U.S. share the north continent.
(3:46:46 AM) return: yes
(3:46:48 AM) return: :)
(3:47:17 AM) Aladdin: Within /America/ I am located in the /U.S./
(3:48:18 AM) return: you have a love?
(3:48:24 AM) Aladdin: Maybe...
(3:49:09 AM) return: :)
(3:49:18 AM) return: i am a gey
(3:49:21 AM) return: you?
(3:49:22 AM) return: :))
(3:49:44 AM) Aladdin: Not sure.
(3:49:54 AM) return: whay
(3:50:28 AM) Aladdin: Not sure what I am.
(3:50:39 AM) return: :(
(3:50:57 AM) Aladdin: Just kidding. I have a strange sense of humor.
(3:51:15 AM) return: :)
(3:51:26 AM) Aladdin: You get visitors here often?
(3:51:39 AM) return: no
(3:51:43 AM) Aladdin: Ever?
(3:51:50 AM) return: ever..
(3:52:04 AM) Aladdin: Wow, I'm the first person!
(3:52:23 AM) return: yes
(3:52:26 AM) Aladdin: I'm so special...
(3:52:45 AM) return: yes me love
(3:53:03 AM) Aladdin: So, what do you do here?
(3:53:18 AM) return: i am lokin me love
(3:53:22 AM) return: loking.
(3:53:35 AM) Aladdin: loking?
(3:53:47 AM) return: yes..
(3:53:50 AM) Aladdin: What's that?
(3:54:46 AM) return: lock...
(3:55:04 AM) Aladdin: You're locking your love?
(3:55:11 AM) return: yes
(3:55:19 AM) Aladdin: Bondage?
(3:56:37 AM) return: what?
(3:57:00 AM) Aladdin: You said you're "locking" your love, but I don't know what that means.
(3:57:05 AM) Aladdin: Are you native English?
(3:58:08 AM) return: i am speek litel english
(4:00:49 AM) Aladdin: espanol?
(4:01:22 AM) return: italy
(4:01:52 AM) Aladdin: I thought Italy's native language was Italian.
(4:02:10 AM) Aladdin: You clearly know at least one language from another country.
(4:02:26 AM) Aladdin: Anyway, "locking your love" doesn't make sense in English.
(4:02:43 AM) return: yes .....
(4:04:02 AM) Aladdin: So, what do you do here all day by yourself?
(4:04:34 AM) return: wheiting for you
(4:05:06 AM) Aladdin: How long you been here?
(4:05:31 AM) return: 1 mouth
(4:05:52 AM) Aladdin: You expecting me for a month?
(4:06:02 AM) return: yes..
(4:06:19 AM) Aladdin: How do you know I'm the right one?
(4:06:25 AM) Aladdin: You don't even know me.
(4:06:55 AM) return: but i need to see
(4:07:24 AM) Aladdin: How do you tell?
(4:07:47 AM) return: tell you..
(4:08:01 AM) Aladdin: Tell me what?
(4:08:22 AM) return: i need to see you...
(4:09:49 AM) Aladdin: What's this pic for?
(4:09:53 AM) return: you have a site ?
(4:10:05 AM) return: a pikcers?
(4:10:39 AM) Aladdin: This one. What's it say?
(4:10:44 AM) Offering to send idiot.JPG to return
(4:11:12 AM) Aladdin: Anti-virus blocks pictures but doesn't block IRC.
(4:11:15 AM) Aladdin: Figures.
(4:11:22 AM) return: pf
(4:11:28 AM) Aladdin: What is pf?
(4:11:33 AM) You canceled the transfer of idiot.JPG
(4:11:36 AM) return: :(
(4:12:01 AM) Aladdin: It says "ce prost/proasta esti daca nu vrei sa ramai ultimu fraier/fraira daml mai departe"
(4:12:07 AM) Aladdin: What's that about?
(4:12:28 AM) Aladdin: It's called "idiot.jpg" and I think it's yours.
(4:12:32 AM) return: i don`t know
(4:12:41 AM) return: no
(4:14:32 AM) return: you have a site?
(4:14:44 AM) Aladdin: It's shut down.
(4:14:53 AM) return: :(
(4:15:04 AM) return: yo are a hacker?
(4:15:08 AM) return: what is it a hacker?
(4:15:37 AM) Aladdin: No. I didn't like it and threw it out.
(4:16:05 AM) return: good
(4:16:16 AM) Aladdin: Good?
(4:16:21 AM) Aladdin: You don't like hackers?
(4:16:50 AM) return: no
(4:16:53 AM) return: i dont like
(4:17:07 AM) Aladdin: Why not?
(4:17:55 AM) return: becose is beed
(4:18:22 AM) return: i have a frend of de undernet end are a need a root of scan do you have?
(4:18:47 AM) Aladdin: What are you asking?
(4:19:09 AM) Aladdin: You have a friend of the undernet, but do I need what?
(4:20:30 AM) return: a root
(4:20:41 AM) Aladdin: A root terminal?
(4:20:55 AM) return: yes
(4:21:06 AM) Aladdin: What about scanning?
(4:21:20 AM) return: scaning of the ip
(4:21:28 AM) Aladdin: You mean probing?
(4:21:29 AM) return: i dont know... what is its
(4:21:49 AM) return: ..
(4:21:51 AM) Aladdin: To find IP addresses and open ports, that is called "probing" in English.
(4:22:01 AM) Aladdin: nmap, right?
(4:22:21 AM) return: yes
(4:22:32 AM) Aladdin: Yeah, that's probing.
(4:22:53 AM) return: you don`t have?
(4:22:56 AM) Aladdin: So, you're asking if I want a root-terminal for probing?
(4:23:03 AM) Aladdin: I have nmap.
(4:23:13 AM) return: is good?
(4:23:30 AM) Aladdin: I don't know. Never tried anything else.
(4:23:39 AM) return: ..
(4:23:44 AM) return: is a linux or what?
(4:23:50 AM) Aladdin: Got in trouble for it once. They don't like probing where I'm from.
(4:24:03 AM) Aladdin: They're mean.
(4:24:13 AM) return: ok
(4:24:30 AM) Aladdin: Yes, it's Linux.
(4:25:13 AM) return: you give me a add for me frends?
(4:25:52 AM) Aladdin: I don't know. Are you asking me for a root terminal, or are you offering one?
(4:26:06 AM) Aladdin: I don't have adds right now.
(4:26:35 AM) return: me love ofering you
(4:26:37 AM) return: }{
(4:26:50 AM) Aladdin: So, you're offering me a root terminal?
(4:26:54 AM) Aladdin: Where, and what OS?
(4:27:31 AM) return: i dont have ..
(4:27:39 AM) Aladdin: You're friend has it?
(4:28:01 AM) return: i dont know
(4:28:13 AM) return: i asking new
(4:28:49 AM) return: no no have a root terminal
(4:29:51 AM) return: be ring back
(4:36:02 AM) return: ware ar you age?
(4:36:21 AM) Aladdin: Between 18 and 25.
(4:36:53 AM) return: 25 yers?
(4:37:05 AM) Aladdin: Close to it that.
(4:37:11 AM) Aladdin: *Close to 25.
(4:37:30 AM) return: 18 ?
(4:37:44 AM) Aladdin: Older than 18, younger than 25.
(4:38:11 AM) return: i have 19 yers
(4:38:46 AM) Aladdin: We're within no more than 3 years of eachother.
(4:39:17 AM) return: eachother what?
(4:39:35 AM) Aladdin: I am not more than 3 years older than you, or 3 years younger.
(4:40:01 AM) return: ok
(4:40:32 AM) return: you have a bnc?
(4:43:00 AM) Aladdin: Don't think so.
(4:43:19 AM) return: why?
(4:43:30 AM) Aladdin: Computer doesn't support it.
(4:43:44 AM) return: ok
(4:44:03 AM) Aladdin: Just VGA and USB.
(4:44:22 AM) return: ok
(4:44:28 AM) Aladdin: And networking of course.
(4:44:42 AM) return: yo have a mail?
(4:44:50 AM) Aladdin: Maybe. Why?
(4:45:11 AM) return: plz seend me yor piciors
(4:45:50 AM) return: you seend me?
(4:46:00 AM) Aladdin: You want my address?
(4:46:06 AM) return: [email protected]
(4:46:17 AM) return: this is it my adress
(4:46:30 AM) return: send me plz
(4:46:31 AM) Aladdin: <<censored>>@aol.com
(4:46:58 AM) Aladdin: I'll have to dig up the old album... wherever it is...
(4:47:23 AM) return: 1 piciors
(4:47:27 AM) return: whit you
(4:47:29 AM) return: send me
(4:49:45 AM) return: you send?
(4:49:55 AM) Aladdin: Looking for a picture...
(4:50:03 AM) return: ok
(4:50:12 AM) Aladdin: Haven't seen the album in a while.
(4:50:29 AM) return: ok
(5:03:14 AM) Aladdin: It's sent.
I send him a picture of Jack Bauer from American TV show 24.
Image
(5:03:24 AM) return: k
(5:05:14 AM) return: you are nice
(5:05:15 AM) return: :D
(5:05:22 AM) Aladdin: Thanks.
(5:05:30 AM) return: }{
(5:05:34 AM) return: i kiss you
(5:10:53 AM) Aladdin: Ok, so what did you have in mind for root terminals?
(5:11:24 AM) return: i dont have..
(5:12:21 AM) Aladdin: Your friend?
(5:12:48 AM) return: no have this
(5:13:57 AM) Aladdin: What are you doing in the chat room?
(5:15:28 AM) return: i waiting me love
(5:15:39 AM) Aladdin: Waiting for what?
(5:15:54 AM) return: for a fuck with me
(5:17:11 AM) Aladdin: So what is the extra chat room for?
(5:17:58 AM) return: for funy
(5:19:47 AM) Aladdin: What's so funny in there?
(5:20:06 AM) return: waiting
(5:32:04 AM) Aladdin: Who are your friends?
(5:32:49 AM) return: me brther
(5:32:53 AM) return: brather.
(5:33:10 AM) Aladdin: What's he like?
(5:34:21 AM) return: what?
(5:34:50 AM) Aladdin: Your brother, or your other friends.
(5:35:36 AM) return: i dont now
(5:35:49 AM) Aladdin: How do you now know if they are your friends?
(5:36:13 AM) return: i not andrested
(5:37:05 AM) Aladdin: Do you ever talk to them?
(5:37:47 AM) return: i talk but not this problem
(5:38:08 AM) Aladdin: What problem?
(5:39:05 AM) return: a problem becouse a am a gay
(5:39:09 AM) return: this problem
(5:40:13 AM) Aladdin: Well, in whatever you talk with them about, what are they like?
(5:40:30 AM) return: yes
(5:40:45 AM) Aladdin: What are they like?
(5:41:25 AM) return: no adrestend
(5:41:27 AM) return: sory
(5:41:49 AM) Aladdin: What is adrestend?
(5:42:16 AM) return: no capisi
(5:44:24 AM) Aladdin: Are they nice?
(5:44:52 AM) return: :D
(5:44:55 AM) return: yes
(5:45:47 AM) Aladdin: Where are they from?
(5:46:29 AM) return: italy
(5:46:41 AM) Aladdin: They live with you?
(5:46:52 AM) return: yes
(5:47:08 AM) Aladdin: They watching us talk?
(5:48:28 AM) return: yes orever.
(5:49:34 AM) Aladdin: So, why do you run an IRC server, but not have anyone on it?
(5:50:04 AM) return: is frend server
(5:50:25 AM) Aladdin: Why does your friend run an IRC server without anyone on it?
(5:51:19 AM) return: i dont know
(5:51:27 AM) Aladdin: Is he there?
(5:51:28 AM) return: by i need to go
(5:51:33 AM) return: yes
(5:51:46 AM) Aladdin: Does he not want to talk?
(5:51:56 AM) return: no
(5:51:59 AM) return: is busy
(5:52:06 AM) Aladdin: You too?
(5:52:21 AM) return: i going for shop
(5:52:31 AM) Aladdin: What you shopping for?
(5:52:32 AM) return <AUTO-REPLY>: leving for shop
(5:52:52 AM) return: for me
(5:53:28 AM) Aladdin: But what are you looking for?
(5:53:29 AM) return <AUTO-REPLY>: leving for shop
(5:53:50 AM) return: a car
View user's profileSend private message
manbiteslion
never f*cking learns


Joined: 12 Dec 2007
Posts: 4816
Location: Connecting my chair and keyboard


PostPosted: Mon Jun 23, 2008 11:46 pm Reply with quoteBack to top

It's always nice to meet new techie types on here Smile

Did you consider posting a kill command for the botnet to the IRC? Could you work out any of the command protocol for the bots? That would be a service for the world Smile

I recently spent several hours unpicking a very well obfuscated bit of drive-by javascript and was amazed by the result - basically what appears to be a rootkit for unix/linux variants. My AVG freaked out on me! You can read the results in the Very Annoyed Cheque Lad thread, very near the end. Clearly the Lad didn't write it, it looked more Russian to be honest, but I feel there's value in understanding the tools we're up against.

If you want to discuss this kind of fun, PM me sometime Smile
View user's profileSend private message
mindgames
Not quite a Newb


Joined: 20 Jun 2007
Posts: 54
Location: United States


PostPosted: Tue Jun 24, 2008 3:04 am Reply with quoteBack to top

Actually, I wasn't an IRC op, so I didn't think I could do anything. I logged in picking random names from the nicks.txt in his package, and each time I entered #x, he would post a command I didn't understand. Eventually he started ignoring me and banning me each time I got a new TOR proxy, so I tried IMing him directly. That's where things took a turn for a strange, and I caught him by surprise. I somehow could not make him admit what he was doing.
View user's profileSend private message
manbiteslion
never f*cking learns


Joined: 12 Dec 2007
Posts: 4816
Location: Connecting my chair and keyboard


PostPosted: Tue Jun 24, 2008 6:57 am Reply with quoteBack to top

Yes, it's those commands we need to decipher - if nothing else they should provide a warning of what the botnet is being commanded to do, so it's worth carrying on intercepting them!
View user's profileSend private message
mindgames
Not quite a Newb


Joined: 20 Jun 2007
Posts: 54
Location: United States


PostPosted: Tue Jun 24, 2008 10:10 am Reply with quoteBack to top

I actually did this bait a while ago, but I think I may still have the original buried in an encrypted zip file somewhere. When I first logged in, I received some commands I didn't understand, and of course didn't respond appropriately, then got kicked.

I think it's best we discuss how to handle this privately for obvious reasons, but if I recall, the commands are listed in one of the packaged config files.
View user's profileSend private message
GomerPyle
Pervert Bastard


Joined: 04 Jan 2007
Posts: 8876
Location: Wherever I lay my hat


PostPosted: Tue Jun 24, 2008 10:40 am Reply with quoteBack to top

Castle Cops would undoubtedly like to listen to what you know.

I'm a member there as well as other related places (aa419 and scamwarners) though I spend most time here as I'm not a techie nerd.

_________________
Fake sites killed 1 x Australia 9 x United Kingdom 3 x 168 X Closed lad accounts Easter Egg 2011
Pith Helmet - the 'Asparagus Kid' - Accra to Lome - You Must surly Die in The Name Of Jesus Christ
Pith Helmet - Steve - Lagos to Accra
Pith Helmet - Frank - Lagos to Cotonou - co-bait with the vampire
Pith Helmet - Shorty - Lagos to Cotonou - My Agro Base farming where i rearing chicken and other animals was set ablazed overnight and we do not know who is actual behinde all these evils! -
I and my crew was locked up for 3 good days….They wanted to charge us to court but later we are fined an huge amount of money…I asked them why did they arrest the men, they started laughing and saying all sorts mockering words! -
…because now, am left with nothing and remember i told you my Guy (Joe) gave up earlier this morning
View user's profileSend private messageSkype Name
Display posts from previous:      
Post new topicReply to topic


 Jump to:   



View next topic
View previous topic
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum



** Find out information about your IP address **


All Content © 2003 - 419Eater.com
Powered by phpBB © 2001, 2002 phpBB Group :S5: FI Theme :: All times are GMT