Vulnerabilities / Threats
10/14/2010
01:55 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Microsoft Finds U.S. Leads In Botnets

The continued prevalence of infected computers has Microsoft arguing for computer quarantines.

At the RSA Conference 2010 in London on Wednesday, Microsoft said that it had cured 6.5 million botnet-infected computers during the second quarter of 2010, twice the number identified and removed during the same period in 2009.

The United States has the dubious honor of being the country with the most botnet infections. Microsoft identified 2.2 million computers compromised by botnet malware in the U.S. during the second quarter of the year, four times more than Brazil, where 550,000 botnet infections were identified.

South Korea, fourth in overall infection count, had the highest density of botnet infections, with 14.6 per thousand machines scanned by Microsoft.

"Botnets are the launch pad for much of today's criminal activity on the Internet," said Adrienne Hall, general manager of Microsoft' trustworthy computing group, in a blog post. "In many ways, they are the perfect base of operations for computer criminals."

In a blog post about Microsoft's report, Graham Cluley, senior technology consultant at Sophos, observed that one of the primary reasons that cyber criminals hijack computers and turn them into bots is to send spam.

"It's still a surprise to many people who don't work in the field of computer security, but the vast majority of the spam you receive in your inbox is not sent from the spammers' own computers but relayed through infected PCs belonging to regular members of the public," he wrote.

Graham Titterington, principal analyst at Ovum, characterized botnets as one of the most prevalent cyber threats at the moment. "It's clear that the evolution of the botnet is a major concern and something Microsoft is taking extremely seriously," he said in a statement.

So seriously in fact that Microsoft is calling for a new approach because current cyber security efforts aren't sufficient. Earlier this month, Scott Charney, Microsoft's corporate vice president for trustworthy computing, proposed applying the public health model to computer security. Under such a regime, computers would have to prove that they're sufficiently free of infection to connect to networks.

Despite some notable security successes recently -- the takedowns of the Waledac and Mariposa botnets earlier this year and a 8% decline in vulnerabilities disclosed by tech vendors in the second quarter of the year -- Hall argues that treating security like a health policy issue would provide protection that computer users fail to provide. "[W]e must accept that information technology is complex and many people are unwilling or unaware as to how they can protect their data and their machines," she said in her blog post.

Under the public health model for computers that Microsoft is proposing, it would be much harder to be unaware of a computer infection. Compromised machines would have limited or no Internet access.

Microsoft's findings are presented in its Security Intelligence Report volume 9 (SIRv9).

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-0543
Published: 2015-07-05
EMC Secure Remote Services Virtual Edition (ESRS VE) 3.x before 3.06 does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVE-2015-0544
Published: 2015-07-05
EMC Secure Remote Services Virtual Edition (ESRS VE) 3.x before 3.06 does not properly generate random values for session cookies, which makes it easier for remote attackers to hijack sessions by predicting a value.

CVE-2015-4129
Published: 2015-07-05
SQL injection vulnerability in Subrion CMS before 3.3.3 allows remote authenticated users to execute arbitrary SQL commands via modified serialized data in a salt cookie.

CVE-2015-0547
Published: 2015-07-04
The D2CenterstageService.getComments service method in EMC Documentum D2 4.1 and 4.2 before 4.2 P16 and 4.5 before P03 allows remote authenticated users to conduct Documentum Query Language (DQL) injection attacks and bypass intended read-access restrictions via unspecified vectors.

CVE-2015-0548
Published: 2015-07-04
The D2DownloadService.getDownloadUrls service method in EMC Documentum D2 4.1 and 4.2 before 4.2 P16 and 4.5 before P03 allows remote authenticated users to conduct Documentum Query Language (DQL) injection attacks and bypass intended read-access restrictions via unspecified vectors.

Dark Reading Radio
Archived Dark Reading Radio
Marc Spitler, co-author of the Verizon DBIR will share some of the lesser-known but most intriguing tidbits from the massive report