80 % of current botnets ditributed and reliable clear text, most command known ----------- IRC Botnets are the predominant version IRC mainly designed for one to many conversations but can also handle one to one Most corporate networks due not allow any IRC traffic so any IRC requests can determine and external or internal bot Outbound IRC requests means an already infected computer on the network Inbound IRC requests mean that a network computer is being recruited ---------------

\n

\n

les -

\n

dependant de l\'architecture DNS

\n

-necessite une connexion TCP permnante entre le bot et le serveur et ne passant pas par un proxy (serveur mandataire) d\'entreprise.

\n

\n

Types of Bots:

\n

- Uses Windows IRC program mIRC (Bot code within mIRC scripts packeged with mIRC setup + HideWindow program to hide itself) -> GT bot

\n

- Perl-based bots

\n

Written in Perl, very small, provide typical bot functionality

\n

Usually seen on linux/unix servers

\n

- QBOts, kaiten bots :

\n

linux bots, small, easy to compile

\n

tupical feature set

\n

Malwares Demystified and Simplified