[At-Large] Fwd: [ NNSquad ] Botnets buying up IPv4 address space

Joly MacFie joly at punkcast.com
Sat Oct 8 04:26:29 UTC 2011


Hi Siva,

I posted this to nanog for comment. There seemed to be consensus that this
is scaremongering.  this was probably the best response:

Joly,
> The author has drawn a relationship between a lot of unrelated things.
> Hackers and spammers "rent" IP addresses all the time, and have done
> so for two decades. It's called, "Here's my money for colo hosting
> service and I need some IP addresses to go along with it." Nothing has
> changed as a result of IPv4 depletion.
> Botnets are hacked machines. They come with their own IP addresses
> scattered about the globe and don't require any particular source. No
> relation to IPv4 depletion and only tangentially related to the
> "bulletproof hosting" that supplies IP addresses for the C&C servers.
> As for auctioning IP blocks, my experience is that hackers don't
> bother. If they want IP addresses beyond what the colo provider
> offers, they steal them: find a block of addresses not routed on the
> public Internet and forge LoAs they present to their ISP. They're
> going to lose them anyway, so why bother paying money?
> Regards,
> Bill Herrin


On Fri, Oct 7, 2011 at 1:48 PM, Sivasubramanian M <isolatedn at gmail.com>wrote:

> For discussion
>
> Sivasubramanian M
>
>
>
> ---------- Forwarded message ----------
> From: Lauren Weinstein <lauren at vortex.com>
> Date: Fri, Oct 7, 2011 at 11:01 PM
> Subject: [ NNSquad ] Botnets buying up IPv4 address space
> To: nnsquad at nnsquad.org
>
>
>
> Botnets buying up IPv4 address space
>
> http://j.mp/nMJ5Lr  (Threat Post)
>
>   "Now, in one effort to get around these systems, some attackers are
>    taking advantage of the lack of IPV4 space by either purchasing or
>    renting blocks of IP space with good reputations that have been built
>    up over the course of several years. A number of legitimate trading
>    and auction sites have appeared as the IPV4 space became scarcer, and
>    the attackers have gotten involved as well, getting their hands on
>    known good IP blocks and using them for C&C or hosting malware."
>
>  - - -
>
> --Lauren--
> NNSquad Moderator
> _______________________________________________
> At-Large mailing list
> At-Large at atlarge-lists.icann.org
> https://atlarge-lists.icann.org/mailman/listinfo/at-large
>
> At-Large Official Site: http://atlarge.icann.org
>



-- 
---------------------------------------------------------------
Joly MacFie  218 565 9365 Skype:punkcast
WWWhatsup NYC - http://wwwhatsup.com
 http://pinstand.com - http://punkcast.com
 VP (Admin) - ISOC-NY - http://isoc-ny.org
--------------------------------------------------------------
-



More information about the At-Large mailing list