Researchers at TippingPoint have successfully diverted a large number of bot-infected systems to their own command and control servers. But now what do they do with them? If they shutdown the bots, are they effectively becoming a botmaster? If they do nothing, are they somehow complicit to the malicious activities the bots carry out? Dennis Fisher, executive editor of SearchSecurity takes a closer look at the dilemma faced in his article, "Botnet disruption raises ethical concerns among researchers".

One pet peeve with the article: Fisher holds the Welchi (aka Nachi) worm up as an example of a 'good' worm but fails to mention that Welchia spontanteously rebooted infected systems every few minutes, effectively launching a local denial of service attack. In that respect, Welchia was worse than the Blaster worm it was allegedly designed to remove. Indeed, Welchi serves as the poster child for the argument that there is no such thing as a 'good' worm.

Also see: "Are you in a botnet?"