New Massive Botnet Twice the Size of Storm

darkreading.com

13 points·davidw··11 comments

These articles are always frustrating. If these researchers know how to identify bot infection, how about telling the rest of us how to identify them?

It'd sure be nice to be able to take a look at our own networks and see if we have a problem we need to be aware of.

I never fail to wonder what could we do to stop them. Isn't there anything that could be done? An anti-worm, tracking down the origin, anything?

Requiring every process to have a digital signature.

Then you have the whole problem of what signatures to trust, etc. Behavioural analysis is pretty much the only effective counter-measure I'm aware of at the moment, and that's still in its infancy. (and really hard)

It would make prosecutions easier, where appropriate.

As far as I'm aware there are unscrupulous companies that will happily sell you SSL certificates without checking up on you at all.

Aside from that, I'd have a serious problem with a central authority controlling what I'm allowed to run. Aside from that, any such technology isn't infallible either.

Then we prosecute the companies. Why is that so hard to do the right thing?

What does the botnet actually do, other than hook other computers up to the network? Just send out spam? Or what?

Well, if it can update its code over the internet, it can do pretty much anything. Typical uses: spam, DDoSes, anonymising traffic for illegal activities, etc.

"Just" send out spam?

Yeah, "just" send out "500.000" spams a day. Like we hadn't enough already. The vikings will win, if the pace of the war remains the same.

Reply on news.ycombinator.com