mailing list archives
What to do with bot networks
From: Conor Sibley <csibley () gmail com>
Date: Fri, 3 Dec 2004 12:27:20 -0500
It all started yesterday when one of my servers got hacked. An ssh
phisher got lucky and found an account with a weak password open on my
server. Two shellcode attempts later they had full access via root.
They ran a super scanner and started an Energy Mech variant which
connected back to their bot network. This is where my dilemma
started… so I logged onto the bot network and lo-and-behold hundreds
start responding. I'm reasonably sure that this network will be used
"4-3v1l && !G00D" so, the question I am asking myself is: "What next".
-Do I disable the network
This is a huge network that is likely used for DDOSing. If you've
ever been DOSed... it sux.
-Do I report to ISP or authorities
The ISP is in an eastern European country and I don't know if the
local authorities would do anything let alone care.
-Do I do nothing
This option sucks but it sure is the easiest
Full-Disclosure - We believe in it.
- What to do with bot networks Conor Sibley (Dec 03)