My IPS has been blocking IRC rogue sessions on port 80. These blocks have been occurring in multiple offices; Chicago, New York, San Francisco, and Shanghai. I’ve found that the users on all affected machines are Chinese. A recent observation is that the blocks always occur during business ours, local office time.

Host intrusion prevention software indicates that the software making the connections is none other than the web browser (IE and Firefox both observed).

I allowed the traffic from one office for a period of time so I could run a capture of the traffic to see what is going on.

My capture caught the following conversations. Based on the ‘Sina Network’ and ’sina_test’ I’m wondering if this is associated with Sina.com…

The machines haven’t displayed any other malicious behavior; no SMTP traffic, no DDOS traffic, no file downloads, etc. So if this is malicious, the bot network might be in a building phase or might be waiting for balkanization (I love that word). I have seen encrypted conversations between the bot and server.

So, to recap;

1. I only observe IRC traffic during business hours, local office time. This to me indicates the traffic is driven by user activity, which lends to it being legit
2. The web browser is the IRC client, which leads me to believe it’s probably a java-based IRC client or something like that.
3. Nothing is being downloaded and installed. Typically, when IE is compromised, it will download the malicious payload (usually using FTP) and steps are taken to ensure continued access (registry edits). I have not observed any of that yet, which makes me wonder if this would be classified as a ‘compromise’.
4. I’ve seen no SMTP traffic outbound

My next step is to talk to one of the users.

Any comments or suggestions are certainly welcome, especially if you’ve seen this in your network as well.