Government computers caught up in monster botnet

By Davey Winder
Thursday, 23 April 2009 02:13

Technology

One botnet, two months, six crooks, 77 government domains, 1.9 million computers. Now that's what you call a malware infection.

The BBC recently managed to build a botnet of some 22,000 of its viewers while researching the danger of malware. Meanwhile the Conficker worm continues to prompt  speculation that it might carry a payload that creates the world's biggest botnet.

However, putting unwise TV stunts and vapourware security threats to one side for the moment, we now have one security vendor informing us that it has discovered a botnet of such massive proportions that it truly beggars belief.

The Finjan Malicious Code Research Center has announced that there exists a 1.9 million malware-infected computer strong network hosted out of the Ukraine and incorporating corporate, consumer and worryingly many Government computers from around the world.

We understand that the United Kingdom and United States top the list of countries with the most computers infected. The US has 45 percent of infected computers, followed by the UK on 6 percent, Canada and Germany on 4 percent each and France with 3 percent. The remaining 38 percent spread across the planet.

Looking at the Finjan report it would appear that the botnet is under the control of a 'cybergang' comprising a total of just six crooks in all. But what a botnet they have managed to create, with the command and control servers being active since February this year.

By establishing a wide-ranging affiliation network over the Web, the crooks managed to distribute their malware-install base very successfully indeed. So successful, in fact, that computers in some 77 government-owned domains around the world have been compromised.

The nature of the malware is such that it can be instructed to execute almost any command on the remote computer such as reading email or copying keystrokes or sending spam to name but a few.

Yuval Ben-Itzhak, CTO of Finjan, warns "the sophistication of the malware and the staggering amount of infected computers proves that cybergangs are raising the bar."

Computers running Windows XP are being infected, it would appear, and unsurprisingly users of Internet Explorer are at the greatest risk (78 percent of those infected) followed by Firefox (15 percent) and Opera (3 percent)