Hi Siva, I posted this to nanog for comment. There seemed to be consensus that this is scaremongering. this was probably the best response: Joly,
The author has drawn a relationship between a lot of unrelated things. Hackers and spammers "rent" IP addresses all the time, and have done so for two decades. It's called, "Here's my money for colo hosting service and I need some IP addresses to go along with it." Nothing has changed as a result of IPv4 depletion. Botnets are hacked machines. They come with their own IP addresses scattered about the globe and don't require any particular source. No relation to IPv4 depletion and only tangentially related to the "bulletproof hosting" that supplies IP addresses for the C&C servers. As for auctioning IP blocks, my experience is that hackers don't bother. If they want IP addresses beyond what the colo provider offers, they steal them: find a block of addresses not routed on the public Internet and forge LoAs they present to their ISP. They're going to lose them anyway, so why bother paying money? Regards, Bill Herrin
On Fri, Oct 7, 2011 at 1:48 PM, Sivasubramanian M <isolatedn@gmail.com>wrote:
For discussion
Sivasubramanian M
---------- Forwarded message ---------- From: Lauren Weinstein <lauren@vortex.com> Date: Fri, Oct 7, 2011 at 11:01 PM Subject: [ NNSquad ] Botnets buying up IPv4 address space To: nnsquad@nnsquad.org
Botnets buying up IPv4 address space
http://j.mp/nMJ5Lr (Threat Post)
"Now, in one effort to get around these systems, some attackers are taking advantage of the lack of IPV4 space by either purchasing or renting blocks of IP space with good reputations that have been built up over the course of several years. A number of legitimate trading and auction sites have appeared as the IPV4 space became scarcer, and the attackers have gotten involved as well, getting their hands on known good IP blocks and using them for C&C or hosting malware."
- - -
--Lauren-- NNSquad Moderator _______________________________________________ At-Large mailing list At-Large@atlarge-lists.icann.org https://atlarge-lists.icann.org/mailman/listinfo/at-large
At-Large Official Site: http://atlarge.icann.org
-- --------------------------------------------------------------- Joly MacFie 218 565 9365 Skype:punkcast WWWhatsup NYC - http://wwwhatsup.com http://pinstand.com - http://punkcast.com VP (Admin) - ISOC-NY - http://isoc-ny.org -------------------------------------------------------------- -