Security Incidents: Re: Phatbox: Media Hype? Scare Tactics?

[Valdis.Kletnieks () vt edu]

On Wed, 17 Mar 2004 13:28:20 EST, Joe Stewart <jstewart () lurhq com>  said:

> I have heard reports that lead me to believe the current number of 
> infections may indeed be in the low hundreds of thousands. The question 
> I would pose is; are those hundreds of thousands infected hosts 
> actually part of the botnet at any given time? The WASTE P2P protocol 
> the botnet uses is not built for large numbers of peers. I did connect 
> to some of the clients and examine the traffic passing through the node 
> and found about 1000 unique nicknames in about an hour or so. So, even 
> though total infections may be high, the actual number of bots 
> available to the owner at any one time is still in question in my mind.
Which is worse - one black hat with 100K bots at their disposal, or
100 black hats with 1K bots each?

Attachment: _bin
Description: