I’m an IT Consultant/VAR and Calif licensed PI, and am very interested in security issues. Saw the googletechtalk in which Richard Kemmerer talked about the research project at UC Berkeley that took over a botnet. He talked about mebroot and torpig and their finding over 300 fake bank login pages for phishing.

I would very much appreciate receiving the analysis of mebroot/torpig.

A client that has PCI compliance requirements has said they’ll worry about it if anything happens. It’s a difficult situation and I’d like to make the case for why this is such risky approach.

regards,

Paul