untangling_the_web

OOClO: 4046925
UNCLA55IFIEOil'FOR OFFlChi8cL USE miLY
and often exploits normally unused ports and channels, permitting the bots to move
about on the net unnoticed and undetected . There are now thousands of these bad
bots (no one really 'knows how many) trolling the Internet connected to what is
known as a "botnet," a kind of underground network of malicious activity. A 2004
study concluded that "two years ago only 200 bot-virus variations existed; today [in
2004] there are about 4,000, according to F-Secure Corp.,,165 The security situation
is rapidly deteriorating. "David Dagon, a Georgia Institute of Technology researcher
who is a co-founder of Damballa, a start-up company focusing on controlling
botnets, said the consensus among scientists is that botnet programs are present on
about 11 percent of the more than 650 million computers attached to the Internet.,,166
None of this is new; botnets have been around for a long time. "What is new is the
vastly escalating scale of the problem-and the precision with which some of the
programs can scan computers for specific information, like corporate and personal
data, to drain money from online bank accounts and stock brokeraqes."!"
,Security experts believe most spam-in fact more than 80 percent-is now sent by
bots. 168 Spam is more than a nuisance . It is the most pervasive and pernicious
medium for spreading all sorts of malicious software (malware). To make matters
worse, simply using a preview window in an email application may be sufficient to
activate scripts sent by spammers, which means many users are unwittingly
contributing to the spread of spam and malware. "According to a study by network
management firm Sandvine ...Trojans and worms with backdoor components such
as Migmaf and SoBig have turned infected Windows PCs into drones in vast
networks of compromised zombie PCs. Sandvine reckons junk mails created and
routed by 'sparn Trojans' are clogging ISP mail servers, forcing unplanned network
upgrades and stoking antagonism between large and small ISPS.,,169 With more and
more ISPs pulling the plug on spammers as complaints flood in, spammers are
turning to these backdoor means of spreading spam because they are much more
efficient, much harder to detect, and much more difficult to stop. "Making things even
tougher for IT security administrators in 2007 is the fact that an increasing amount of
spam will be image-based, which is more difficult to detect. ..image-based spam
165 Cassell Bryan-Low, "Virus for Hire: Growing Number of Hackers Attack Web Sites for Cash," The
Wall Street Journal , pp. A1 & A8, 30 November 2004.
166 John Markoff, "Attack of the Zombie Computers Is Growing Threat ," The New York Times,
(registration required) 7 January 2007,
(16 January 2007).
167 Markoff.
168 Markoff.
169 John Leyden, "Zombie PCs Spew Out 80% of Spam," The Register, 4 June 2004,
(14 November 2006).
516 UNCLA551FIEOfiFOR OFFICIAL USE ONLY