What it Takes to Shut Down a Botnet

Security firm LastLine and ISPs dealt a major blow to the Pushdo network by shutting down about two-thirds of the central command servers. That was not enough, within 2 days spam volumes had started to recover. This author is claiming international cooperation is the only way to permanently hinder botnets.

To be truly effective, however, such [ISP] alliances have to expand to other countries -- especially Eastern Europe, China and Russia -- because standard operating procedures among criminals in the botnet world call for backup servers in those countries to foil takedown efforts. Another botnet, called Koobface, uses legitimate servers that have been compromised to control operations while adding redundant servers in non-cooperative jurisdictions.

Comments