3 ms·
Is it possible to monitor bot nets to figure out what they are doing?
by falsestprophet 17y ago
Is it possible to monitor bot nets to figure out what they are doing?
- zitterbewegung 17y agoI remember steve gibson reverse engineered the protocol for a bot and figured out what it did.
- rabidsnail 17y agoI don't know how often this is still true, but it used to be that they would lurk in an irc channel and the botherder would post commands in the channel. Anybody could figure out what was going on by lurking there as well.
- hedgehog 17y agoYep, but it's a lot of work. There at least a few researchers that keep track of bot activity, reverse samples, monitor via wire-compatible clients, etc. From what I gather it's getting harder, some newer worms use decentralized control channels, signed updates, etc. One way to observe worm behavior: http://www.honeynet.org/ http://www.honeynet.org/ SRI writeup on their dissection of Storm: http://www.cyber-ta.org/pubs/StormWorm/report/ http://www.cyber-ta.org/pubs/StormWorm/report/