Vulnerabilities / Threats
10/14/2010
01:55 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Microsoft Finds U.S. Leads In Botnets

The continued prevalence of infected computers has Microsoft arguing for computer quarantines.

At the RSA Conference 2010 in London on Wednesday, Microsoft said that it had cured 6.5 million botnet-infected computers during the second quarter of 2010, twice the number identified and removed during the same period in 2009.

The United States has the dubious honor of being the country with the most botnet infections. Microsoft identified 2.2 million computers compromised by botnet malware in the U.S. during the second quarter of the year, four times more than Brazil, where 550,000 botnet infections were identified.

South Korea, fourth in overall infection count, had the highest density of botnet infections, with 14.6 per thousand machines scanned by Microsoft.

"Botnets are the launch pad for much of today's criminal activity on the Internet," said Adrienne Hall, general manager of Microsoft' trustworthy computing group, in a blog post. "In many ways, they are the perfect base of operations for computer criminals."

In a blog post about Microsoft's report, Graham Cluley, senior technology consultant at Sophos, observed that one of the primary reasons that cyber criminals hijack computers and turn them into bots is to send spam.

"It's still a surprise to many people who don't work in the field of computer security, but the vast majority of the spam you receive in your inbox is not sent from the spammers' own computers but relayed through infected PCs belonging to regular members of the public," he wrote.

Graham Titterington, principal analyst at Ovum, characterized botnets as one of the most prevalent cyber threats at the moment. "It's clear that the evolution of the botnet is a major concern and something Microsoft is taking extremely seriously," he said in a statement.

So seriously in fact that Microsoft is calling for a new approach because current cyber security efforts aren't sufficient. Earlier this month, Scott Charney, Microsoft's corporate vice president for trustworthy computing, proposed applying the public health model to computer security. Under such a regime, computers would have to prove that they're sufficiently free of infection to connect to networks.

Despite some notable security successes recently -- the takedowns of the Waledac and Mariposa botnets earlier this year and a 8% decline in vulnerabilities disclosed by tech vendors in the second quarter of the year -- Hall argues that treating security like a health policy issue would provide protection that computer users fail to provide. "[W]e must accept that information technology is complex and many people are unwilling or unaware as to how they can protect their data and their machines," she said in her blog post.

Under the public health model for computers that Microsoft is proposing, it would be much harder to be unaware of a computer infection. Compromised machines would have limited or no Internet access.

Microsoft's findings are presented in its Security Intelligence Report volume 9 (SIRv9).

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0607
Published: 2014-07-24
Unrestricted file upload vulnerability in Attachmate Verastream Process Designer (VPD) before R6 SP1 Hotfix 1 allows remote attackers to execute arbitrary code by uploading and launching an executable file.

CVE-2014-1419
Published: 2014-07-24
Race condition in the power policy functions in policy-funcs in acpi-support before 0.142 allows local users to gain privileges via unspecified vectors.

CVE-2014-2360
Published: 2014-07-24
OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules allow remote attackers to execute arbitrary code via packets that report a high battery voltage.

CVE-2014-2361
Published: 2014-07-24
OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules, when BreeZ is used, do not require authentication for reading the site security key, which allows physically proximate attackers to spoof communication by obtaining this key after use of direct hardware access or manual-setup mode.

CVE-2014-2362
Published: 2014-07-24
OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules rely exclusively on a time value for entropy in key generation, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by predicting the time of project creation.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Sara Peters hosts a conversation on Botnets and those who fight them.