Re: Finjan botnet story - fact or fiction?

["Paul M. Moriarty" <pmm () igtc com>]

OK, poor choice of phrase.  Everybody and their kraken is looking for  
PR at RSA.

I was more interested to see if any other researchers had independent  
confirmation of the botnet that Finjan's CTO is talking about.

With the help of David Harley and a quick confirmation call to Ferg's  
hairdresser (who knew Ferg was really a blonde?), it would seem that  
Eset is detecting it.

- Paul -

On Apr 22, 2009, at 2:50 PM, Gadi Evron wrote:

> Paul M. Moriarty wrote:
> > http://www.cbsnews.com/blogs/2009/04/22/world/worldwatch/entry4960984.shtml
> > "The FBI and British law enforcement authorities are trying to  
> > hunt  down hackers responsible for the largest botnet (robot  
> > network) ever  known to the IT world, according to a California- 
> > based Internet  security company.
>
> They are misinformed as to it being the largest botnet in the world,  
> today or in the past. They are also misinformed about it being the  
> fastest forming.
>
> Back in the big worms days (when botnets were ignored and more  
> people believed me a nut case for saying they exist) having a  
> million or 4 infected machines within a day, sometime seven trying  
> to connect to one IRC C&C was not unheard of.
>
> Today though, such numbers are pointless.
>
> Regardless, their botnet may exist, but it is a publicity stunt  
> regardless. And guess what, it works, which is why everyone does it.
>
>       Gadi.
>
> > Finjan's Chief Technology Officer has told the Financial Times  
> > that  six people based in Ukraine are suspected of compromising 1.9  
> > million  computers worldwide in just two months — many of them in  
> > the U.S. "
> > [...]
> > "However, Rupert Goodwins editor of CBSNews.com's sister site   
> > ZDNet.com, says Finjan has offered no hard evidence to back up  
> > their  claim of discovering the world's largest-ever botnet. "
> > [...]
> > So, another new, big botnet or RSA publicity-seeking hype?
> > - Paul -
> > _______________________________________________
> > Fun and Misc security discussion for OT posts.
> > https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
> > Note: funsec is a public and open mailing list.


_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.