Watching a Botnet From the InsideWhen you hear about botnets such as Rustock, Mariposa or Grum being taken down, one of the tactics that's usually involved is sinkholing. The technique, which involves pointing the infected machines to a server controlled by good guys rather than attackers, often is used as one of the last steps to take the botnet offline. But some recent work done by researchers at Damballa took a slightly different tack and used the sinkhole as a way to study a recently discovered botnet in operation, and what they found in their traffic analysis was pretty interesting.
read more
Source:
Watching a Botnet From the Inside
