427 Botnet fm qxd

www.syngress.com
Responding to Botnets • Chapter 12
435
427_Botnet_12.qxd 1/9/07 3:08 PM Page 435

---

sandbox system as described in Chapter 10.You might also contact law
enforcement. Certainly, there are difficulties with the latter approach.
However, sometimes hackers do go to jail, and if they were all in jail, we
might not have such a problem.
Reporting Botnets
A public channel for reporting botnets is located at [e-mail]
e-mail address is managed by Gadi Evron, a former information security
manager for the Israel CERT, now with Beyond Security. Gadi distributes a
monthly command and control report listing the top 20 ASNs by total sus-
pect domains mapping to a host in the ASN, and the top 20 ASNs by number
of active suspect command and controls (see the sidebar,
Notes from the
Underground
).
Evron also runs a mailing list for people who are interested in discussions
about botnets, located at www.whitestar.linuxbox.org/mailman/listinfo/botnets.
If you joined or participate in one of the organizations mentioned earlier
that track botnets or other forms of intrusion detection, you should be a good
netizen and report the events from your organization to them. Dshield at
dshield.org takes firewall log data from the Internet at large and is a useful
Web site to visit for many reasons, including information about what is going
on planet-wide in malware. REN-ISAC is a security group for universities
that focuses on collecting and disseminating information about security inci-
dents including botnets, and other forms of malware. It is a closed group, but
you might consider joining it if you are the security officer for a university,
teaching hospital, or government research organization.They can be found at
www.ren-isac.net. Check out www.isaccouncil.org for ISACs that cover other
industries or interest groups.
Notes from the Underground…