What to do with bot networks

[Conor Sibley <csibley () gmail com>]

It all started yesterday when one of my servers got hacked.  An ssh
phisher got lucky and found an account with a weak password open on my
server.  Two shellcode attempts later they had full access via root. 
They ran a super scanner and started an Energy Mech variant which
connected back to their bot network.  This is where my dilemma
started… so I logged onto the bot network and lo-and-behold hundreds
start responding.  I'm reasonably sure that this network will be used
"4-3v1l && !G00D" so, the question I am asking myself is: "What next".

-Do I disable the network
This is a huge network that is likely used for DDOSing.  If you've
ever been DOSed... it sux.

-Do I report to ISP or authorities
The ISP is in an eastern European country and I don't know if the
local authorities would do anything let alone care.

-Do I do nothing
This option sucks but it sure is the easiest

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html