[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Re[4]: [Full-disclosure] Re: Know Your Enemy: Tracking Botnets (ThorstenHolz)



On Mon, 14 Mar 2005 22:01:39 +0300, Egoist said:

> Lot of systems? Where you get that statistic ? How do u analyze that?
> Antivirus software catched agobot on some computer and you just increment 
> counters?

Right. I find an agobot, I increment a counter.

If the counter ends up at '3', agobot hasn't hit many systems.

If the counter ends up at '3,000,000', agobot has hit a lot of systems.

Are you seriously trying to convince us that agobot *didn't* infect a lot of
systems?  I suppose that next, you're going to try to convince us that the lame
code in Nimda and Nachi didn't hit many systems either, because of its 
lameness....

I never claimed there weren't bots that weren't being detected - what I said was
that the lamely-coded bots have still managed to nail a lot of systems.

And just because my car has a slow oil leak that I haven't been able to track 
down
the exact cause is no reason to not change the brake pads when they start 
squealing.

Attachment: pgp00053.pgp
Description: PGP signature

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://www.secunia.com/