Download

8 Chapter 1 • Botnets: A Call to ActionGMThe original IRC bot (or robot user), called GM according to Wikipedia, was developed thenext year, in 1989, by Greg Lindahl, an IRC server operator.This benevolent bot would playa game of Hunt the Wumpus with IRC users.The first bots were truly robot users thatappeared to other IRC netizens as other users. Unlike today’s bot net clients (robots), theserobots were created to help a user enjoy and manage their own IRC connections.From this simple example, other programmers realized they could create robot users toperform many tasks currently done by humans for both users and the IRC operator, such ashandling tedious 24-hour-a-day requests from many users. An important bot developmentwas the use of bots to keep a channel open and prevent malicious users from taking over thechannel when the operator was busy doing other things. In order to assist the IRC operator,bots needed to be able to operate as a channel operator.The bots had evolved from beingcode that helps a single user to code that manages and runs IRC channels as well as codethat provides services for all users. Service is the term used for functionality that is offered byserver-side bots as opposed to client-side bots. Around this time, some IRC servers and botsbegan offering the capability to make OS shell accounts available to users. The shell accountpermits users to run commands on the IRC host. Wikipedia notes that “a lot of shellproviders disappear very fast because of abusive behavior of their members.”Pretty ParkIn May 1999, Pretty Park, a bot client written in Delphi, was discovered. PrettyPark,according to “The Evolution of Malicious IRC Bots,” a Symantec white paper authored byJohn Canavan, had several functions and concepts that are common in today’s bots,including:■■■■■■■■The capability to retrieve the computer name, OS version, user information, andother basic system information.The capability to search for and retrieve e-mail addresses and ICQ login namesThe capability to retrieve usernames, passwords, and dial-up network settingsThe capability to update its own functionalityThe capability to upload/download filesThe capability to redirect (tunnel) trafficThe capability to launch a variety of DoS attacksIncorporation of its own IRC client