+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Botnets and Botting (https://hackforums.net/forumdisplay.php?fid=92)
+---- Thread: When It's Time to Shutdown Your Botnet... (/showthread.php?tid=1402152)
When It's Time to Shutdown Your Botnet... - Percy_Argyros - Jun 21, 2011
Right now, I have a rather small botnet (~100 bots) that is hosted on my computer. I know that I will have to take it down pretty soon if I don't want to be screwed by an angry victim. My question is, even if I shutdown my botnet and wipe the files from my computer, can I still be traced? This is assuming the worst case scenario (FBI/NSA examining compromised computer). Will I have to destroy all of my victim's computers as to remain untraceable?
* - Captain Crunch - Jun 21, 2011
I would really recommend you simply uninstall your botnet and leave it at that. If you destroy their computers then they will report it and your connections to them will have been logged and they will have a reason to go after you.
* - MommyBoughtMeAComputer - Jun 21, 2011
Delete it from their computer, then from yours.
Assuming nobody has had reason to believe they are infected, why would they get that tests done?
Just remove it from them and, on the human side, they will assume nothing was ever there unless you were immature with it.
* - Percy_Argyros - Jun 21, 2011
@MommyBoughtMeAComputer
This is just assuming the worst case scenario, like, if I took $ from their bank account.
@wale
When you say "connections will have been logged", this applies for the victim's computer and their ISP, right?
* - Captain Crunch - Jun 21, 2011
Indeed Percy. If you kill their computer you will find a good deal of people reporting the incident. Just remove it all and move along. If the person who was angry at you is truly going to report you to the IC3 you could be in some trouble but can easily manage to get out of it. Claim you were a part of the botnet and were infected and someone had remote control over you.
* - Positive - Jun 21, 2011
Don't do anything at all with the infections.
Leave them be.
But what you want to do, is the DNS the infections are hosted on, you might want to change that.
Remove, change, or do whatever is needed.
If it hosted on your ip, then it is really easy to trace, and that is not a good idea, that is why most of
us on this forum, use VPS, hosted else where.
A real cheap one is hosted where you want... is http://nordicvps.com
I use them, and have for almost 5 years.
-- Positive --
* - Percy_Argyros - Jun 21, 2011
@wale
This victim does not know that he/she is infected, but will as soon as he/she checks his/her bank account. I know the computer will be examined by the FBI because the money wired out of the compromised computer's bank account was untraceable so law enforcement will be looking for other means to track me down. Not good. Time to move.
* - Positive - Jun 21, 2011
(Jun 21, 2011 01:37 AM)Percy_Argyros Wrote: @wale
This slave does not know that he/she is infected, but will as soon as he/she checks his/her bank account. I know the computer will be examined by the FBI because the money wired out of the compromised computer's bank account was untraceable so law enforcement will be looking for other means to track me down. Not good. Time to move.
Even if you move, there is still always a way to get traced down.
Sorry to say bud, but you should've known the consequences.
-- Positive --
* - push eax - Jun 21, 2011
(Jun 21, 2011 01:37 AM)Percy_Argyros Wrote: @wale
This slave does not know that he/she is infected, but will as soon as he/she checks his/her bank account. I know the computer will be examined by the FBI because the money wired out of the compromised computer's bank account was untraceable so law enforcement will be looking for other means to track me down. Not good. Time to move.
@wale
This slave does not know that he/she is infected, but will as soon as he/she checks his/her bank account. I know the computer will be examined by the FBI because the money wired out of the compromised computer's bank account was untraceable so law enforcement will be looking for other means to track me down. Not good. Time to move.
FBI coming after you for 1 transaction? Very unlikely, when the vic reports the theft and files a report the the local police will put that in their archive along with all other crime reports without priority, the bank will refund the money and everyone will go on with their lifes. Unless the amounts stolen are big.
If you do banking you should have thought of this before you started.
Especially if you have a RAT that connects to your home connection, can't get more stupid than that. It's like showing your id card while robbing a bank
* - Percy_Argyros - Jun 21, 2011
@Positive
Yeah, I know it was not a good idea setting it upon my own computer, but I thought that I would be able to remain untraceable by repeatedly wiping the victim's hard drive. Guess not.
The stolen amounts are HUGE
* - push eax - Jun 21, 2011
(Jun 21, 2011 01:41 AM)Percy_Argyros Wrote: @Positive
Yeah, I know it was not a good idea setting it upon my own computer, but I thought that I would be able to remain untraceable by repeatedly wiping the slave's hard drive. Guess not.
The stolen amounts are HUGE
How huge? Are we talking in $xxyyxx range? I don't see how a transaction like that can go through without verification
* - Percy_Argyros - Jun 21, 2011
We are talking about multiple transactions adding up to a gigantic amount (6 or more digits).
* - ProfessionalCriminal - Jun 21, 2011
Just fucking leave it. The FBI won't come looking for you at the size it is. FBI/NSA only become interested in botnets when the number of infected brinks one million.
* - Percy_Argyros - Jun 21, 2011
Yeah, they won't come after me for the size of the botnet, but they will for the $, and the only way for them to trace me is through the botnet.
* - push eax - Jun 21, 2011
(Jun 21, 2011 01:47 AM)Percy_Argyros Wrote: We are talking about multiple transactions adding up to a gigantic amount (6 or more digits).
Lol in that case you should have thought about your safety before transferring, enjoy getting your shit packed.