427 Botnet fm qxd

www.syngress.com
Botnets: A Call to Action • Chapter 1
25
427_Bot_01.qxd 1/8/07 11:53 AM Page 25

---

■
In March of 2006, McAfee was called in to, in essence, reclaim a
Central American country’s telecommunications infrastructure from a
massive botnet.
The Industry Responds
■
At the TechEd 2006 conference in Boston, Microsoft confirmed that
“well-organized mobsters have established control [of] a global
billion-dollar crime network using keystroke loggers, IRC bots, and
rootkits,” according to “Microsoft:Trojans,Bots Are ‘Significant and
Tangible Threat,’” an article by Ryan Naraine in the June 12, 2006,
edition of eWEEK.com.
■
Some bots now have multiple C&C servers, and, like a Hydra, if you
cut off one C&C server, two more pop up.
Q: 
Have we lost the war of the botnets?
A: 
No. Until 2006, security and network professionals had not truly engaged
the enemy. For the most part we saw victim response. When the victim
was big, the response was big. 2005-2006 marks the beginning of efforts
to coordinate larger responses to the threat. Up to this point, many secu-
rity professionals had not made the connection that these attacks were
being fueled by money from organized crime. Now that the connection
to organized crime has been made, the playing field is forever altered. Law
enforcement and other government agencies are now joining the fight.
Several consortiums have emerged to gather, aggregate, and distribute
information as well as to coordinate responses.The battle has only begun.
www.syngress.com
26
Chapter 1 • Botnets: A Call to Action
Frequently Asked Questions
The following Frequently Asked Questions, answered by the authors of this
book, are designed to both measure your understanding of the concepts pre-
sented in this chapter and to assist you with real-life implementation of these
concepts. To have your questions about this chapter answered by the author,
browse to