Vulnerabilities / Threats
10/14/2010
01:55 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Microsoft Finds U.S. Leads In Botnets

The continued prevalence of infected computers has Microsoft arguing for computer quarantines.

At the RSA Conference 2010 in London on Wednesday, Microsoft said that it had cured 6.5 million botnet-infected computers during the second quarter of 2010, twice the number identified and removed during the same period in 2009.

The United States has the dubious honor of being the country with the most botnet infections. Microsoft identified 2.2 million computers compromised by botnet malware in the U.S. during the second quarter of the year, four times more than Brazil, where 550,000 botnet infections were identified.

South Korea, fourth in overall infection count, had the highest density of botnet infections, with 14.6 per thousand machines scanned by Microsoft.

"Botnets are the launch pad for much of today's criminal activity on the Internet," said Adrienne Hall, general manager of Microsoft' trustworthy computing group, in a blog post. "In many ways, they are the perfect base of operations for computer criminals."

In a blog post about Microsoft's report, Graham Cluley, senior technology consultant at Sophos, observed that one of the primary reasons that cyber criminals hijack computers and turn them into bots is to send spam.

"It's still a surprise to many people who don't work in the field of computer security, but the vast majority of the spam you receive in your inbox is not sent from the spammers' own computers but relayed through infected PCs belonging to regular members of the public," he wrote.

Graham Titterington, principal analyst at Ovum, characterized botnets as one of the most prevalent cyber threats at the moment. "It's clear that the evolution of the botnet is a major concern and something Microsoft is taking extremely seriously," he said in a statement.

So seriously in fact that Microsoft is calling for a new approach because current cyber security efforts aren't sufficient. Earlier this month, Scott Charney, Microsoft's corporate vice president for trustworthy computing, proposed applying the public health model to computer security. Under such a regime, computers would have to prove that they're sufficiently free of infection to connect to networks.

Despite some notable security successes recently -- the takedowns of the Waledac and Mariposa botnets earlier this year and a 8% decline in vulnerabilities disclosed by tech vendors in the second quarter of the year -- Hall argues that treating security like a health policy issue would provide protection that computer users fail to provide. "[W]e must accept that information technology is complex and many people are unwilling or unaware as to how they can protect their data and their machines," she said in her blog post.

Under the public health model for computers that Microsoft is proposing, it would be much harder to be unaware of a computer infection. Compromised machines would have limited or no Internet access.

Microsoft's findings are presented in its Security Intelligence Report volume 9 (SIRv9).

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2009-5027
Published: 2014-12-26
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2010-2062. Reason: This candidate is a reservation duplicate of CVE-2010-2062. Notes: All CVE users should reference CVE-2010-2062 instead of this candidate. All references and descriptions in this candidate have been removed to pre...

CVE-2010-1441
Published: 2014-12-26
Multiple heap-based buffer overflows in VideoLAN VLC media player before 1.0.6 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted byte stream to the (1) A/52, (2) DTS, or (3) MPEG Audio decoder.

CVE-2010-1442
Published: 2014-12-26
VideoLAN VLC media player before 1.0.6 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly execute arbitrary code via a crafted byte stream to the (1) AVI, (2) ASF, or (3) Matroska (aka MKV) demuxer.

CVE-2010-1443
Published: 2014-12-26
The parse_track_node function in modules/demux/playlist/xspf.c in the XSPF playlist parser in VideoLAN VLC media player before 1.0.6 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty location element in an XML Shareable Playlist Format...

CVE-2010-1444
Published: 2014-12-26
The ZIP archive decompressor in VideoLAN VLC media player before 1.0.6 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly execute arbitrary code via a crafted archive.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.