Home page logo

fulldisclosure logo Full Disclosure mailing list archives

What to do with bot networks
From: Conor Sibley <csibley () gmail com>
Date: Fri, 3 Dec 2004 12:27:20 -0500

It all started yesterday when one of my servers got hacked.  An ssh
phisher got lucky and found an account with a weak password open on my
server.  Two shellcode attempts later they had full access via root. 
They ran a super scanner and started an Energy Mech variant which
connected back to their bot network.  This is where my dilemma
started… so I logged onto the bot network and lo-and-behold hundreds
start responding.  I'm reasonably sure that this network will be used
"4-3v1l && !G00D" so, the question I am asking myself is: "What next".

-Do I disable the network
This is a huge network that is likely used for DDOSing.  If you've
ever been DOSed... it sux.

-Do I report to ISP or authorities
The ISP is in an eastern European country and I don't know if the
local authorities would do anything let alone care.

-Do I do nothing
This option sucks but it sure is the easiest

Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]