Re: Re[4]: Re: Know Your Enemy: Tracking Botnets (ThorstenHolz)

[Valdis.Kletnieks () vt edu]

On Mon, 14 Mar 2005 22:01:39 +0300, Egoist said:

> Lot of systems? Where you get that statistic ? How do u analyze that?
> Antivirus software catched agobot on some computer and you just increment counters?

Right. I find an agobot, I increment a counter.

If the counter ends up at '3', agobot hasn't hit many systems.

If the counter ends up at '3,000,000', agobot has hit a lot of systems.

Are you seriously trying to convince us that agobot *didn't* infect a lot of
systems?  I suppose that next, you're going to try to convince us that the lame
code in Nimda and Nachi didn't hit many systems either, because of its lameness....

I never claimed there weren't bots that weren't being detected - what I said was
that the lamely-coded bots have still managed to nail a lot of systems.

And just because my car has a slow oil leak that I haven't been able to track down
the exact cause is no reason to not change the brake pads when they start squealing.

Attachment: _bin
Description:

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://www.secunia.com/