Risk
9/16/2009
11:01 PM
George V. Hulme
George V. Hulme
Commentary
50%
50%

Systems Infected Tend To Stay Infected

Think most PC and end point infections are quick hits? Think again. Research released today shows that once infected, systems tend to stay that way for a long, long time.

Think most PC and end point infections are quick hits? Think again. Research released today shows that once infected, systems tend to stay that way for a long, long time.Quite some time ago -- the summer and fall of 2001 to be exact -- the notion of having good Internet hygiene enforced by ISPs or some other authority had gained some traction. It made sense after all, following the nasty virulent spread of the likes of Code Red and Nimda worms and a bunch of other Windows nastiness. It was poor system maintenance that made these attacks so prevalent, and as the fan of any zombie movie will tell you -- the more infected there are the more danger there is for the uninfected.

Research published by anti-virus software maker Trend Micro reminded me of those crazy worms-spreading-across-the-Internet-faster-than-you-can-say "patch" days. There are people, some maybe even in your own family, that place us all at significant risk:

Industry experts have previously estimated that, on average, a compromised machine remains infected for 6 weeks. However, our latest research indicates that this estimate is far from accurate. During the analysis of approximately 100 million compromised IP addresses, we identified that half of all IP addresses were infected for at least 300 days.

That's a fairly sobering finding. And it certainly substantiates the point that users who fail to patch and keep a their systems clean jeopardize us all. In fact, that's much more true today than it was in the summer of 2001.

Consider this, also from the research Trend Micro published today:

Once a machine becomes compromised, it is not unusual to find it has become part of a wider botnet. Botnets frequently cause damage in the form of malware attacks, fraud, information theft and other crimes. In 2009, virtually all malware tracked by Trend Micro experts are used by cybercriminals to steal information.

While I'm not a proponent of the idea of having the Internet hygiene police lock infected systems off of the Internet -- stats like these make it tougher to argue against the idea. Perhaps, at the very least, ISPs that notice suspicious traffic emanating from the systems of their customers could drop them an e-mail and introduce them to a bar of patch updates and a good anti-malware rinse.

For my mobile security and technology observations, follow @georgevhulme.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-4632
Published: 2015-01-31
VMware vSphere Data Protection (VDP) 5.1, 5.5 before 5.5.9, and 5.8 before 5.8.1 does not properly verify X.509 certificates from vCenter Server SSL servers, which allows man-in-the-middle attackers to spoof servers, and bypass intended backup and restore access restrictions, via a crafted certifica...

CVE-2014-7287
Published: 2015-01-31
The key-management component in Symantec PGP Universal Server and Encryption Management Server before 3.3.2 MP7 allows remote attackers to trigger unintended content in outbound e-mail messages via a crafted key UID value in an inbound e-mail message, as demonstrated by the outbound Subject header.

CVE-2014-7288
Published: 2015-01-31
Symantec PGP Universal Server and Encryption Management Server before 3.3.2 MP7 allow remote authenticated administrators to execute arbitrary shell commands via a crafted command line in a database-backup restore action.

CVE-2014-8266
Published: 2015-01-31
Multiple cross-site scripting (XSS) vulnerabilities in the note-creation page in QPR Portal 2014.1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) title or (2) body field.

CVE-2014-8267
Published: 2015-01-31
Cross-site scripting (XSS) vulnerability in QPR Portal 2014.1.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the RID parameter.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
If you’re a security professional, you’ve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.