We Get Lucky

• Two .edu's had a high number of attacking IPs
• The outgoing traffic was causing them more much trouble than us, killing their firewall
• Sniffing DNS activity on compromised hosts identified a botnet
• Malware binaries isolated September 22nd by resnet staff, even though protected by rootkit
• They rock