Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
Summary
At this point, the investigation was basically over for me. I had found all I was going to find. WHOIS returned nothing of value, I didn't have log files for the server, and the THR34T crew had disappeared. While the spread of this hacker IRC bot/Trojan has seemed to have all but stopped, at last glance at the hacked IRC server (November 25, 2002), #tkworld still had a few inhabitants.
In the end, this hacked server provided a great lesson on what can happen to a computer if it is not properly maintained. Whether it is a virus, a worm, a Trojan, a hacker, or all of the above, it is up to you to protect your assets. While my client's server provide me a great source of amusement, I doubt that the server's administrator was very excited at the prospect of rescuing e-mails and business data, followed by a format and reinstall.
Not to focus on the hackers, but they, too, provided a valuable lesson. Ironically, after all the efforts at maintaining anonymity, pride once again went before the fall. While I can't be sure that THR34T was actually involved in the creation and distribution of this worm, it does appear that they know something about it. Unfortunately, all emails to DOOM have bounced and their Web site is gone. So, I guess I may never know!
P.S. As I was reviewing this article for final delivery, I decided to take a quick peek back at the hackers IRC server. To my surprise, it looked like the server was in full swing. Several hundred owned computers were logged in, and more were connecting by the minute. I stuck around and noticed that a few real people were on the server with me. After starting up several conversations, being fed little bits of misleading information, and eventually getting myself booted offline for 10 hours by a DDoS attack, one of the members of the Thr34t Krew took pity on me, and we had a good conversation. He told me all about his Krew, the measures of security they go through to maintain anonymity, and the breadth and power of their network. He also told me that the IRC server was about to be deleted because of my probing and that they were moving to another server. In short, this 16-year-old guy and the other 10 members of his Krew had created a worm/Trojan that had more power and bandwidth than some governments. Welcome to the future, where ownership is a matter of perspective and power is determined by the number of computers/bandwidth that you control.
P.P.S. Thanks for stopping the DDoS attack!