full-disclosure - What to do with bot networks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

From: csibley at gmail.com (Conor Sibley)
Subject: What to do with bot networks

It all started yesterday when one of my servers got hacked.  An ssh
phisher got lucky and found an account with a weak password open on my
server.  Two shellcode attempts later they had full access via root. 
They ran a super scanner and started an Energy Mech variant which
connected back to their bot network.  This is where my dilemma
started? so I logged onto the bot network and lo-and-behold hundreds
start responding.  I'm reasonably sure that this network will be used
"4-3v1l && !G00D" so, the question I am asking myself is: "What next".

-Do I disable the network
This is a huge network that is likely used for DDOSing.  If you've
ever been DOSed... it sux.

-Do I report to ISP or authorities
The ISP is in an eastern European country and I don't know if the
local authorities would do anything let alone care.

-Do I do nothing
This option sucks but it sure is the easiest