[91611] in North American Network Operators' Group
Re: mitigating botnet C&Cs has become useless
daemon@ATHENA.MIT.EDU (Rick Wesson)
Tue Aug 8 19:52:16 2006
Date: Tue, 08 Aug 2006 16:53:00 -0700
From: Rick Wesson <wessorh@ar.com>
To: Sean Donelan <sean@donelan.com>
Cc: nanog@merit.edu
In-Reply-To: <Pine.GSO.4.64.0608081812160.27100@clifden.donelan.com>
Errors-To: owner-nanog@merit.edu
this isn't fun, comments in line.
Sean Donelan wrote:
>
> On Tue, 8 Aug 2006, Rick Wesson wrote:
>> Last sunday at DEFCON I explained how one consumer ISP cost American
>> business $29M per month because of the existence of key-logging botnets.
>
> Why did you attribute responsibility for the cost only to the consumer
> ISP? How much of the cost should be attributed the PC OEM, or the
> software developers, or the American business, or the ....?
Because the numbers are significant. Finding any entity that could
provide a choke-point for 4% of business side id-theft is an interesting
exercise and of significant value to the community.
>
>> you want to talk economics? Its not complicated to show that
>> mitigating key-logging bots could save American business 2B or 4% of
>> =losses to identity theft -- using FTC loss estimates from 2003
>
> What are the economics of American businesses mitigating key-logging bots?
there is no detectable mitigation, the slope of the infection rate
continues to rise.
> How much security would you get for an additional $20 per year per on-line
> user? Spending more than the losses wouldn't save American business money.
depends on how it is spent
-rick
