Microsoft Finds U.S. Leads In Botnets

At the RSA Conference 2010 in London on Wednesday, Microsoft said that it had cured 6.5 million botnet-infected computers during the second quarter of 2010, twice the number identified and removed during the same period in 2009.

The United States has the dubious honor of being the country with the most botnet infections. Microsoft identified 2.2 million computers compromised by botnet malware in the U.S. during the second quarter of the year, four times more than Brazil, where 550,000 botnet infections were identified.

South Korea, fourth in overall infection count, had the highest density of botnet infections, with 14.6 per thousand machines scanned by Microsoft.

"Botnets are the launch pad for much of today's criminal activity on the Internet," said Adrienne Hall, general manager of Microsoft' trustworthy computing group, in a blog post. "In many ways, they are the perfect base of operations for computer criminals."

In a blog post about Microsoft's report, Graham Cluley, senior technology consultant at Sophos, observed that one of the primary reasons that cyber criminals hijack computers and turn them into bots is to send spam.

"It's still a surprise to many people who don't work in the field of computer security, but the vast majority of the spam you receive in your inbox is not sent from the spammers' own computers but relayed through infected PCs belonging to regular members of the public," he wrote.

Graham Titterington, principal analyst at Ovum, characterized botnets as one of the most prevalent cyber threats at the moment. "It's clear that the evolution of the botnet is a major concern and something Microsoft is taking extremely seriously," he said in a statement.

So seriously in fact that Microsoft is calling for a new approach because current cyber security efforts aren't sufficient. Earlier this month, Scott Charney, Microsoft's corporate vice president for trustworthy computing, proposed applying the public health model to computer security. Under such a regime, computers would have to prove that they're sufficiently free of infection to connect to networks.

Despite some notable security successes recently -- the takedowns of the Waledac and Mariposa botnets earlier this year and a 8% decline in vulnerabilities disclosed by tech vendors in the second quarter of the year -- Hall argues that treating security like a health policy issue would provide protection that computer users fail to provide. "[W]e must accept that information technology is complex and many people are unwilling or unaware as to how they can protect their data and their machines," she said in her blog post.

Under the public health model for computers that Microsoft is proposing, it would be much harder to be unaware of a computer infection. Compromised machines would have limited or no Internet access.

Microsoft's findings are presented in its Security Intelligence Report volume 9 (SIRv9).