Comment by Groxx
1 day ago
Yes, you generally see this kind of thing start from the pain-feelers and move up the chain to the pain-causers.
So why hasn't that happened? These are clearly damaging to many, and ISPs are apparently doing next to nothing to prevent it, and it has been extremely clear for a while now that it's going to just become a bigger and bigger problem.
How are you going to get an end customer to track down whatever device of theirs was hacked?
As a power user I don't know any way of even checking if I'm involved in a botnet.
Is there something like that out there? Something that routers could install to monitor and report?
Maybe Pi-hole and look for weird lookups? Home routers wont have anything useful, I can see bandwidth and log NAT etc on my Ubiquiti though.
As the ISP you don't care, you just cut off their connection to fix it. Said user will have to contact a local service to come out and find it.
Made even easier by almost everyone running their local network off the ISP's hardware. Before they get cut off, have the router take a snapshot of what's using what ports, then go hunting.