[Homestead] Don't let your computer become a zombie

Tvoivozhd tvoivozd at infionline.net
Tue Sep 21 12:50:38 EDT 2004



*Thousands of zombie PCs created daily*

17:19 20 September 04
NewScientist.com news service

The rate at which personal computers are being hijacked by hackers 
rocketed in the first half of 2004, reveals a new report. An average of 
30,000 computers per day were turned into enslaved “zombies”, compared 
with just 2000 per day in 2003.

US computer security company Symantec says efforts to build so-called 
"botnets" - networks of zombies used to launch attacks on corporate 
websites or as anonymous relays for sending out spam - from hacked 
computers have intensified dramatically in recent months. The company's 
latest biannual report shows that recruitment of "zombie" machines 
peaked at 75,000 computers per day.

Jeremy Ward, service development manager at Symantec, says virus writers 
can make good money by selling botnets to online extortionists and spammers.

"What we're seeing now is malware, or malicious software, that is truly 
professional," Ward told *New Scientist*. "You have the ability to set 
up botnets for a number of money-making schemes."


*Turf war*

The Symantec report is based on information gathered from 20,000 network 
sensors based in 180 countries around the world. They also collected 
information from anti-virus software installed on desktop machines and 
corporate networks.

The study shows that overall virus activity increased between January 
and June 2004. In all, 4496 Windows computer viruses were released 
during this time - a fourfold increase on the same period the previous year.

Enlistment of zombie machines reached an all-time high during a turf war 
between two virus-writing groups in the first few months of 2004. Those 
behind the worms MyDoom and Bagle fought against the creator of the 
Netsky virus for ownership of the infected computers.

During this feud, a version of Netsky was released which was designed to 
deactivate the Bagle and MyDoom viruses within infected computers.


*Draining resources*

Richard Archdeacon, director of technical services at Symantec, adds 
that virus writers have developed new programming tricks to thwart 
current anti-virus scanning technology.

Anti-virus scanners examine the contents of files for pieces of data 
that match those of a known threat. Many viruses, for example, insert 
themselves at the beginning or end of code for a legitimate programme.

But recent strains of virus have made scanning more difficult. A virus 
called Impanate, for example, buries portions of its code in an 
unexpected region of a software file.

Another virus, known as Gastropod, rewrites its own code entirely 
between replications to complicate detection. Spotting these viruses 
requires considerably more computing power, draining system resources.

"These advanced infection mechanisms may render many traditional 
antivirus scanning techniques ineffective," Archdeacon says.

But law enforcers have also made progress. On 9 September, an 
18-year-old German programmer was charged with creating Netsky and 
another worm, Sasser.

Will Knight

Return to news story 
<http://www.newscientist.com/news/news.jsp?id=ns99996420>

© Copyright Reed Business Information Ltd.





More information about the Homestead mailing list