IRC Monitoring logg...
 
Notifications
Clear all

IRC Monitoring logging

8 Posts
6 Users
0 Reactions
955 Views
(@thepm)
Reputable Member
Joined: 17 years ago
Posts: 254
Topic starter  

Does anybody know of a software that could be used in a cyber investigation case to monitor some IRC channels, logging everything that is going on there and ideally piping each message in a database ?

I know that there are some bots programmed by some script kiddies that can probably do this, but I would like something from a more reliable source…

Thanks!


   
Quote
Adam10541
(@adam10541)
Honorable Member
Joined: 13 years ago
Posts: 550
 

Are you LE?

LE have access to some interesting tools for harvesting IP addresses from P2P and other things so it's possible there is something like that out there.


   
ReplyQuote
(@angrybadger)
Estimable Member
Joined: 18 years ago
Posts: 164
 

Its not that big a job to code one up yourself.
A simple Python script could do the job, the code in the link below can be hacked into something useable

http//oreilly.com/pub/h/1968

Pedantic mode on script kiddies don't write code, that's why they're called script kiddies. )


   
ReplyQuote
(@thepm)
Reputable Member
Joined: 17 years ago
Posts: 254
Topic starter  

Are you LE?

LE have access to some interesting tools for harvesting IP addresses from P2P and other things so it's possible there is something like that out there.

Yes, I'm LE. We indeed have access to some useful stuff, but we have to find who is making it available, thus this thread. I haven't found anything yet…

Its not that big a job to code one up yourself.

I agree, but since IRC has been there since the dawn of ages and a lot of bad stuff is happening on IRC, I thought there would be some turn-key solution that would exist for this type of investigation.


   
ReplyQuote
ForensicRanger
(@forensicranger)
Estimable Member
Joined: 16 years ago
Posts: 122
 

..clearly you're planning on having a client sit in those channels - most IRC clients allows for logging of conversations that occur within a channel as well as dcc chats..


   
ReplyQuote
(@thepm)
Reputable Member
Joined: 17 years ago
Posts: 254
Topic starter  

We've tried using the ususal IRC clients, but they don't seem to be designed to be running continuously for weeks. The crash after a while and we lose a bunch of info.

We would like an IRC client with "special features" such as the ability to change nickname after a while, parsing all messages and logging them in a database,etc.


   
ReplyQuote
jaclaz
(@jaclaz)
Illustrious Member
Joined: 18 years ago
Posts: 5133
 

We've tried using the ususal IRC clients, but they don't seem to be designed to be running continuously for weeks. The crash after a while and we lose a bunch of info.

That would be an "IRC LogBot", if I get it right, like (examples)
http//curtis.lassam.net/software/lumberjack/
http//www.dajobe.org/software/logger/
http//www.jibble.org/logbot/
http//moritz.faui2k3.org/en/ilbot
but AFAIK/AFAICU they run in "silent" mode.

We would like an IRC client with "special features" such as the ability to change nickname after a while, parsing all messages and logging them in a database,etc.

That would be more a "AI IRC BOT", like (examples)
http//www.computerhope.com/zero/
http//www.jibble.org/jmegahal/

jaclaz


   
ReplyQuote
(@nerdrage)
Eminent Member
Joined: 13 years ago
Posts: 21
 

Unless it is a overly large irc channel where the ops would not notice a bot lingering around due to numbers, i wouldn't put the effort into coding something yourself. The ops will quickly pick up on this and just ban the ip, they will notice the same ip jumping on random nicks if they channel is a medium to small channel. might be fun to create a eggdrop script or similar to do this though.


   
ReplyQuote
Share: