Daily cyber threats and internet security news: network security, online safety and latest security alerts
September 2nd, 2008

The Number Of Infected Machines In Botnets Quadrupled In Last 3 Months

According to Shadowserver Foundation, the number of compromised zombie PCs in botnet networks has quadrupled over the last three months. Shadowserver tracks botnet activity and the number of command and control servers. It uses a variety of metrics to slice and dice its figures based in part on the entropy of botnet infections. The clear trend within these figures is upwards, with a rise in botnet numbers of 100,000 to 400,000 (if 30 day entropy is factored into equations) or from 20,000 to 60,000 (for five day entropy). Entropy of botnets is calculated on the basis that if no activity is seen from a specific IP for a number of days – either 30, 10 or five – then it is removed from the botnet count.

Shadowserver figures suggest the number of command and control servers has actually decreased over the last month, following a spike in activity back in July.

According to Internet Storm Center, there is a number of explanations for the rise in the zombie population. It could be that experienced botnet herders have got better at keeping control of compromised machines, or that more machines have been infected. Not much by way of email malware activity has been monitored, so if the latter explanation is true, then drive-by download attacks are playing a bigger role in spreading botnet client infestation.

The recent rise in SQL injection attacks that plant malicious scripts on vulnerable servers could be to blame, but there’s no hard data to support this plausible theory. Improved detection of web-based attacks may be needed to gauge the extent of the problem.

According to John Bambenek from Internet Storm Center, security professionals are very good at tracking email-based malware (including lead-the-user-to-the-bad-website variety) and certainly network based attacks. Short of spidering the web on a consistent basis, it gets difficult to find infected sites for that malware.

Share this item with others:

More on CyberInsecure:
  • Malware-infected Computer Botnets Click Fraud At Record High
  • MySpace And Facebook Users Targeted By New Worms
  • McColo Hosting Provider Goes Offline With Around 500,000 Bots But Resurrects Few Days Later To Allow Miscreants To Reorganize
  • Computer Worm Infects International Space Station Laptops
  • Whirlpool’s Remains Malware Infected For 5 Months

  • If you found this information useful, consider linking to it from your own website.
    Just copy and paste the code below into your website (Ctrl+C to copy)
    It will look like this: The Number Of Infected Machines In Botnets Quadrupled In Last 3 Months

    Leave a Reply

    Comments with unsolicited links to other resources will be marked as spam. DO NOT leave links in comments. Please leave your real email, it wont be published.

    To prove you’re a person (not a spam script), type the security word shown in the picture. Click on the picture to hear an audio file of the word.