Watching a Botnet From the Inside

Watching a Botnet From the Inside (threatpost.com) by

ademar (17), (0.01) on Thursday, July 19, 2012, 10:20:53 AM

malware

When you hear about botnets such as Rustock, Mariposa or Grum being taken down, one of the tactics that's usually involved is sinkholing. The technique, which involves pointing the infected machines to a server controlled by good guys rather than attackers, often is used as one of the last steps to take the botnet offline. But some recent work done by researchers at Damballa took a slightly different tack and used the sinkhole as a way to study a recently discovered botnet in operation, and what they found in their traffic analysis was pretty interesting.