Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
The Thr34t: Day 3, Night
While I could go on about the power of this mIRC script, it is beyond the scope of this article. If any readers are interested in the power of IRC scripting, please comment and I may produce an article related to that subject.
During the time I was testing and probing the power of the TK script, I had remained logged into the #tkworld channel. My intent was to simply log any activity or people that logged in or out. While I was connected, I noticed that after a few hours the number of Tkbots started decreasing. In the middle of the disconnects I noticed that one person named DiCise had connected and then disconnected. Ironically, this person had a disconnect message set up in his IRC program that posted the following message:
"Can j00 f33l tha THR34T? I g0t th3 p0w3r 0f r3wt"
The first thing I noticed in this message was the very familiar word THR34T. Taking a stab in the dark, I opened http://www.google.com and did a quick search for that uncommon word. After I scanned the results, I clicked one promising link and was presented with the following screen (see Figure 6).
)
Figure 6 THR34T security crew's Web page (no longer online).
At this point, I fell out of my chair and about threw up from laughter. Not one to dismiss coincidences, I am pretty sure that the THR34T security crew knows quite a bit about this IRC Trojan. As if the previously mentioned discussion with DOOM, the IRC client he was using, and the good-bye message from DiCise weren't enough, I learned as I was looking through the setup files of the TK Disto FTP server that one of the accounts was named DOOM. At what point can you ignore the obvious?