427 Botnet fm qxd

www.syngress.com
Intelligence Resources • Chapter 11
397
427_Botnet_11.qxd 1/9/07 9:56 AM Page 397

---

Using such tools to view the code is a task a number of organizations on
the Internet use to gather intelligence on botnets.This type of reverse engi-
neering can provide information on the botherder, provide understanding of
how it works, and may be used in designing methods to remove botnets from
systems. If you’re uncomfortable with disassembling and viewing the botnet’s
code, a number of these organizations allow you to upload the botnet to
them, where they will analyze the botnet and be better able to monitor sim-
ilar botnets on the Internet.
Places/Organizations Where 
Public Information Can Be Found
Numerous organizations and Web sites on the Internet provide up-to-date
information, forums, and mailing lists dealing with botnets. Some organiza-
tions are highly involved in the capture, analysis, monitoring and/or reporting
of malicious software, while others focus on warning users of particular bot-
nets and provide information on their removal.The level of detail provided
such sites varies from basic to advanced, and may also provide the means to
interact with other security professionals, which is useful in allowing users to
advance from novices to experts.
W
ARNING
The Internet is a resource for information, and a source of disinforma-
tion. Try to only use reputable sources for information. If you’re
unsure, try to verify the information by using secondary sources. It’s a
simple thing to create a Web page suggesting you install a tool to
improve security, and embed a botnet within the installation of that
tool. You don’t want to use bad information to accidentally lower
security or install Trojans and viruses that will impact your network.
Antivirus, Antispyware, 
and Antimalware Sites
The obvious sources of information are often overlooked when dealing with
a relatively new problem like botnets. Because bots have been around for