3 ms·

Honestly, my bigger concern would be motivating a retaliatory attack. A lot of the people who run botnets have big egos and respond poorly to this kind of chall

Honestly, my bigger concern would be motivating a retaliatory attack. A lot of the people who run botnets have big egos and respond poorly to this kind of challenge, especially when it can mean serious lost money for them. I've caused a retaliatory attack against a system I was responsible for once (thankfully not an important one) and I know at least one other security professional with a similar story - and in his case it was an important network and it stayed down due to retaliatory DDoS for long enough to generate a lot of upset people. Any kind of active and specific pushback to malicious actors is poking a hornet's nest, and if done on the behalf of an employer, there should be serious discussion and acceptance of the risk of retaliation. Particularly with people running DDoS operations who, in my experience, tend to be a little immature.

fapjacks 10y ago
I have had the opposite experience. What the author did here is something I've been doing for years (I've got quite a collection of crapware and have published a couple of articles about operating honeypots and honeynets). I occasionally drop in on the people running botnets and surprise them in their C&C channels. More often than not, the person is surprised and quiet and suspicious, and then curious. I get the sense there is some respect coming back the other way for whatever reason. I do spend time cataloging the botnet and its inventory and features, though I don't always present that information to the person running it. The worst reaction I've ever had was just having people hang up on me immediately after I reveal myself to them. They must think I'm law enforcement. Perhaps it's because I don't confront these guys in public, or that I don't antagonize them. I'm not sure. But I have never had anyone retaliate against me, and I have done this quite a lot over the years.

fapjacks 10y ago

I have had the opposite experience. What the author did here is something I've been doing for years (I've got quite a collection of crapware and have published a couple of articles about operating honeypots and honeynets). I occasionally drop in on the people running botnets and surprise them in their C&C channels. More often than not, the person is surprised and quiet and suspicious, and then curious. I get the sense there is some respect coming back the other way for whatever reason. I do spend time cataloging the botnet and its inventory and features, though I don't always present that information to the person running it. The worst reaction I've ever had was just having people hang up on me immediately after I reveal myself to them. They must think I'm law enforcement. Perhaps it's because I don't confront these guys in public, or that I don't antagonize them. I'm not sure. But I have never had anyone retaliate against me, and I have done this quite a lot over the years.