The Number Of Infected Machines In Botnets Quadrupled In Last 3 Months
According to Shadowserver Foundation, the number of compromised zombie PCs in botnet networks has quadrupled over the last three months. Shadowserver tracks botnet activity and the number of command and control servers. It uses a variety of metrics to slice and dice its figures based in part on the entropy of botnet infections. The clear trend within these figures is upwards, with a rise in botnet numbers of 100,000 to 400,000 (if 30 day entropy is factored into equations) or from 20,000 to 60,000 (for five day entropy). Entropy of botnets is calculated on the basis that if no activity is seen from a specific IP for a number of days – either 30, 10 or five – then it is removed from the botnet count.
Shadowserver figures suggest the number of command and control servers has actually decreased over the last month, following a spike in activity back in July.
According to Internet Storm Center, there is a number of explanations for the rise in the zombie population. It could be that experienced botnet herders have got better at keeping control of compromised machines, or that more machines have been infected. Not much by way of email malware activity has been monitored, so if the latter explanation is true, then drive-by download attacks are playing a bigger role in spreading botnet client infestation.
The recent rise in SQL injection attacks that plant malicious scripts on vulnerable servers could be to blame, but there’s no hard data to support this plausible theory. Improved detection of web-based attacks may be needed to gauge the extent of the problem.
According to John Bambenek from Internet Storm Center, security professionals are very good at tracking email-based malware (including lead-the-user-to-the-bad-website variety) and certainly network based attacks. Short of spidering the web on a consistent basis, it gets difficult to find infected sites for that malware.
More on CyberInsecure:
Posts
Leave a Reply
Comments with unsolicited links to other resources will be marked as spam. DO NOT leave links in comments. Please leave your real email, it wont be published.