Merit Network
Can't find what you're looking for? Search the Mail Archives.
  About Merit   Services   Network   Resources & Support   Network Research   News   Events   Home

Discussion Communities: Merit Network Email List Archives

North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Worms versus Bots

  • From: Rob Thomas
  • Date: Mon May 03 16:11:56 2004

Hi, NANOGers.

] Just because a machine has a bot/worm/virus that didn't come with a
] rootkit, doesn't mean that someone else hasn't had their way with it.

Agreed.

A growing trend in the "0wnage" category is the installation of
multiple bots on a single host.  This isn't intentional, but a
result of the multiple infection vectors bots employ.  Bot01
goes after open Win2K shares (TCP 445), and Bot02 comes along
and enters through Kuang2 (TCP 17300).

One of the more popular bots has at least 13 distinct scan and
sploit methods.  WebDav, NetBios, MSSQL, Beagle, Kuang2, and
the list goes on.

The record I've seen thus far was a host with 14 distinct and
active bots on it.  I'm guessing the LEDs on that cable modem
never blinked.

One bot, Coldlife, actually took advantage of this trend.  It
would hunt for certain bot configuration files on the host it
infected, and report the contents to the Coldlife botherd.
Ka-ching, another botnet stolen.  Things have evolved in a
distributed manner from this feature.

Thanks,
Rob.
-- 
Rob Thomas
http://www.cymru.com
ASSERT(coffee != empty);





Discussion Communities


About Merit | Services | Network | Resources & Support | Network Research
News | Events | Contact | Site Map | Merit Network Home


Merit Network, Inc.