Ask HN: The unstoppable rise of the botnets

I consider(ed) myself an experienced sysadmin, however, yesterday I left an Asterisk server on my newly created DigitalOcean droplet open to the public. I thought, on a freshly created machine with a brand new ip, I surely can go to sleep and finish the configuration tomorrow.

Today I woke up to the server making calls to countries I didn't even know existed.

It must be the work of a botnet. The server was brand new and Asterisk had only been running a few hours. I didn't make any outgoing requests which could have tracked that the machine was live. My IP can only have been selected randomly and nmap'd mercilessly for an open port, and it was attacked on the only open port, 5060. Hell, if it were a web or SSH server, I could suppose. But a remotely non-standard service like Asterisk?

Botnets may be the business of the next decade, both for the black market and for security analysts. But what can regular sysadmins do to protect against them, besides being cautious?

This leads to the question, is there any reliable data regarding botnets? What are the most common attack vectors? Is there a known IP database of zombie machines so that we can firewall all requests from them?

I'd like some insights extracted from real data so that we can protect ourselves from this plague.