Merit Network
Can't find what you're looking for? Search the Mail Archives.
  About Merit   Services   Network   Resources & Support   Network Research   News   Events   Home

Discussion Communities: Merit Network Email List Archives

North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Reporting botnets?

  • From: Martin Hannigan
  • Date: Tue Jan 10 17:32:47 2006

> Please advise, where to can I report botnet control activities?
> I'm from overseas and interested if there are some law enforcement
> organizations in US who may handle these issues?
> I assume it is illegal business in US, and I have enough evidence
> how botnet control sites command our trojaned customer PC's to send
> spam and activate DDoS attacks.

I think your best bet is to report it first to your local authorities
and then report it to the ISP that the C&C is sitting on. There are
techniques that have been established over time and a few things
you can do to mitigate, at least temporarily, (1) identify it and any 
others (2) make sure that taking action won't cause collateral damage
or important stuff runs on it and blackhole it, (3) contact the dns
provider and ask them to (a) lock out the user, (b) extend the TTl 
to the max that their software allows, (c) change the C&C resolution
to 127.0.03. That will at least do some level of mitigation and allow
you to clean up the mess while you figure out how you want to pursue

I'm sure you'll also hear from some people on this list who can assist.

Botnets are a dime a dozen. It's good to kill the C&C's and it's
good to report them to LEA's, but from there, all bets are off. 

I believe any action would depend on exactly what they were doing
with them. For example, if it's a bunch of skiddies fighting over
who controls an iRC channel and they are DDOS'ing each other, well,
that may not get much attention.

Hope that helps.

Discussion Communities

About Merit | Services | Network | Resources & Support | Network Research
News | Events | Contact | Site Map | Merit Network Home

Merit Network, Inc.