Comment by Hikikomori

18 hours ago

How are you going to get an end customer to track down whatever device of theirs was hacked?

As a power user I don't know any way of even checking if I'm involved in a botnet.

Is there something like that out there? Something that routers could install to monitor and report?

  • Maybe Pi-hole and look for weird lookups? Home routers wont have anything useful, I can see bandwidth and log NAT etc on my Ubiquiti though.

As the ISP you don't care, you just cut off their connection to fix it. Said user will have to contact a local service to come out and find it.

  • Made even easier by almost everyone running their local network off the ISP's hardware. Before they get cut off, have the router take a snapshot of what's using what ports, then go hunting.