{"id":128,"date":"2006-06-29T02:44:43","date_gmt":"2006-06-29T02:44:43","guid":{"rendered":"https:\/\/www.darknet.org.uk\/2006\/06\/shadowserver-battles-the-botnets\/"},"modified":"2015-09-09T19:43:50","modified_gmt":"2015-09-09T11:43:50","slug":"shadowserver-battles-the-botnets","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2006\/06\/shadowserver-battles-the-botnets\/","title":{"rendered":"Shadowserver Battles the Botnets"},"content":{"rendered":"
[ad]<\/p>\n
Botnets are indeed a growing problem, we’ve seen serious cases of DDoS extortion, the most recent example would be the attacks against the ‘million dollar homepage’ and the problems it caused the owner.<\/p>\n
Botnets have been used for quite some time as spam networks and mostly for script kiddies to have DoS wars on IRC networks, but now they have released they can go back to the old mafia tactics of protection money and make a few bucks from it.<\/p>\n
Botnets are the workhorses of most online criminal enterprises today, allowing hackers to ply their trade anonymously — sending spam, sowing infected PCs with adware from companies that pay for each installation, or hosting fraudulent e-commerce and banking Web sites.<\/p>\n
As the profit motive for creating botnets has grown, so has the number of bot-infected PCs. David Dagon, a Ph.D. student at Georgia Tech who has spent several years charting the global spread of botnets, estimates that in the 13-month period ending in January, more than 13 million PCs around the world were infected with malicious code that turned them into bots.<\/p><\/blockquote>\n
Shadowserver is an effort to take out these botnets, they are made up of volunteers with some experience in computer security and have the thankless job of informing ISPs of infected machines and getting them to deny access.<\/p>\n
Even after the Shadowserver crew has convinced an ISP to shut down a botmaster’s command-and-control channel, most of the bots will remain infected. Like lost sheep without a shepherd, the drones will continually try to reconnect to the hacker’s control server, unaware that it no longer exists. In some cases, Albright said, a botmaster who has been cut off from his command-and-control center will simply wait a few days or weeks, then re-register the domain and reclaim stranded bots.<\/p><\/blockquote>\n
That’s the problem, even after they have shut them down, they can spring up again in a few days. There are so many unprotected Windows machines, it’s an uphill battle..<\/p>\n