[botnets] reviving this list, allowing sharing

2008-08-27 Thread Gadi Evron
To report a botnet PRIVATELY please email: [EMAIL PROTECTED] -- Hi. When this list was started a while back a lot of sharing and discussion was happening. This make us take a step back at the time. Today, when most of this information can do far more good than harm, it is my strong

Re: [botnets] reviving this list, allowing sharing

2008-08-27 Thread Jeremy
I propose that each and every one of us on this list configure our nepenthes boxes with the email address of this distribution list, so we can share information about new botnet clients in real time. Thoughts? -Jeremy On Wed, Aug 27, 2008 at 4:41 PM, Gadi Evron [EMAIL PROTECTED] wrote: To

Re: [botnets] reviving this list, allowing sharing

2008-08-27 Thread James Pleger
I think that is a bit too high volume for this list, maybe throwing honeypot logs to an aggregator and then sending a daily digest would be more appropriate. James Pleger e: [EMAIL PROTECTED] On Wed, Aug 27, 2008 at 6:10 PM, Jeremy [EMAIL PROTECTED] wrote: I propose that each and every one of

Re: [botnets] reviving this list, allowing sharing

2008-08-27 Thread Joel Esler
On Aug 27, 2008, at 9:10 PM, Jeremy wrote: I propose that each and every one of us on this list configure our nepenthes boxes with the email address of this distribution list, so we can share information about new botnet clients in real time. Thoughts? I like the idea. I'm all for it. J

Re: [botnets] reviving this list, allowing sharing

2008-08-27 Thread Michael Collins
This is just off the top of my head, but if traceability is a problem, why not use an anonymous remailer or mixmaster? Have the source sign the message for authenticity, and you'd get validity without traceability. On Aug 27, 2008, at 9:19 PM, Gadi Evron wrote: On Wed, 27 Aug 2008,

Re: [botnets] reviving this list, allowing sharing

2008-08-27 Thread Steven Adair
: botnets@whitestar.linuxbox.org Subject: Re: [botnets] reviving this list, allowing sharing I think that is a bit too high volume for this list, maybe throwing honeypot logs to an aggregator and then sending a daily digest would be more appropriate. James Pleger e: [EMAIL PROTECTED] On Wed, Aug 27