After having introduced different types of bots, we now want to
take a closer look at what these bots normally do and how they
work. This section will in detail explain how bots spread and
how they are controlled by their masters. After successful
exploitation, a bot uses Trivial File Transfer Protocol (TFTP),
File Transfer Protocol (FTP), HyperText Transfer Protocol
(HTTP), or CSend (an IRC extension to send files to other users,
comparable to DCC) to transfer itself to the compromised host.
The binary is started, and tries to connect to the hard-coded
master IRC server. Often a dynamic DNS name is provided (for
example one from www.dyndns.org) rather than a hard coded IP
address, so the bot can be easily relocated. Some bots even
remove themselves if the given master server is localhost or in
a private subnet, since this indicates an unusual situations.
Using a special crafted nickname like USA|743634 or
[UrX]-98439854 the bot tries to join the master's channel,
sometimes using a password to keep strangers