Vulnerabilities / Threats
01:55 PM
Connect Directly

Microsoft Finds U.S. Leads In Botnets

The continued prevalence of infected computers has Microsoft arguing for computer quarantines.

At the RSA Conference 2010 in London on Wednesday, Microsoft said that it had cured 6.5 million botnet-infected computers during the second quarter of 2010, twice the number identified and removed during the same period in 2009.

The United States has the dubious honor of being the country with the most botnet infections. Microsoft identified 2.2 million computers compromised by botnet malware in the U.S. during the second quarter of the year, four times more than Brazil, where 550,000 botnet infections were identified.

South Korea, fourth in overall infection count, had the highest density of botnet infections, with 14.6 per thousand machines scanned by Microsoft.

"Botnets are the launch pad for much of today's criminal activity on the Internet," said Adrienne Hall, general manager of Microsoft' trustworthy computing group, in a blog post. "In many ways, they are the perfect base of operations for computer criminals."

In a blog post about Microsoft's report, Graham Cluley, senior technology consultant at Sophos, observed that one of the primary reasons that cyber criminals hijack computers and turn them into bots is to send spam.

"It's still a surprise to many people who don't work in the field of computer security, but the vast majority of the spam you receive in your inbox is not sent from the spammers' own computers but relayed through infected PCs belonging to regular members of the public," he wrote.

Graham Titterington, principal analyst at Ovum, characterized botnets as one of the most prevalent cyber threats at the moment. "It's clear that the evolution of the botnet is a major concern and something Microsoft is taking extremely seriously," he said in a statement.

So seriously in fact that Microsoft is calling for a new approach because current cyber security efforts aren't sufficient. Earlier this month, Scott Charney, Microsoft's corporate vice president for trustworthy computing, proposed applying the public health model to computer security. Under such a regime, computers would have to prove that they're sufficiently free of infection to connect to networks.

Despite some notable security successes recently -- the takedowns of the Waledac and Mariposa botnets earlier this year and a 8% decline in vulnerabilities disclosed by tech vendors in the second quarter of the year -- Hall argues that treating security like a health policy issue would provide protection that computer users fail to provide. "[W]e must accept that information technology is complex and many people are unwilling or unaware as to how they can protect their data and their machines," she said in her blog post.

Under the public health model for computers that Microsoft is proposing, it would be much harder to be unaware of a computer infection. Compromised machines would have limited or no Internet access.

Microsoft's findings are presented in its Security Intelligence Report volume 9 (SIRv9).

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Current Issue
Five Emerging Security Threats - And What You Can Learn From Them
At Black Hat USA, researchers unveiled some nasty vulnerabilities. Is your organization ready?
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
According to industry estimates, about a million new IT security jobs will be created in the next two years but there aren't enough skilled professionals to fill them. On top of that, there isn't necessarily a clear path to a career in security. Dark Reading Executive Editor Kelly Jackson Higgins hosts guests Carson Sweet, co-founder and CTO of CloudPassage, which published a shocking study of the security gap in top US undergrad computer science programs, and Rodney Petersen, head of NIST's new National Initiative for Cybersecurity Education.