PPRuNe Forums - View Single Post - Recommended security add-ons
View Single Post
Old 17th Oct 2011, 15:45
  #21 (permalink)  
mixture
 
Join Date: Aug 2002
Location: Earth
Posts: 3,663
Likes: 0
Received 0 Likes on 0 Posts
Do you have evidence that the bot nets are set up in that way?
Researchers from UC-Santa Barbara took over the Torpig Botnet for 10 days.

Their report contained a couple of interesting paragraphs on DHCP and NAT :

The DHCP effect:

As we discussed, during our ten days of monitoring, we observed 182,800 bots. In contrast, during the same time, 1,247,642 unique IP addresses contacted our server.
The NAT effect:

By looking at the IP addresses in the Torpig headers we are able to determine that 144,236 (78.9%) of the infected machines were behind a NAT, VPN, proxy, or firewall. We identified these hosts by using the non-publicly routable IP addresses listed in RFC 1918: 10/8, 192.168/16, and 172.16-172.31/16. We observed 9,336 distinct bots for 2,753 IP addresses from these infected machines on private networks. Therefore, if the IP address count was used to determine the number of hosts it would underestimate the infection count by a factor of more than 3 times.
mixture is offline