Craven BBC avoids naming botnet hosts

Sam Varghese
Saturday, 14 March 2009 06:24

Opinion and Analysis

The Honeynet Project has been carrying out research on botnets for at least the last four years; in 2005, the German chapter estimated that there were more than a million PCs being used in botnets, the vast majority running either Windows XP or Windows 2000.

This project is some kind of canonical source for information on botnets - yet the BBC did not ask either them or any other serious researcher for information on botnets.

There were a number of self-serving anti-virus and security vendors who were interviewed for the BBC programme and they mouthed the marketing spiel that is common among this breed. The BBC chose to show glimpses of certain anti-virus products - whether this was product placement or not, one never knows.

There was also one glimpse of a headline "Microsoft: we took out Storm botnet" when mention was made of this botnet, once rated as the fifth biggest in terms of spam-sending ability. That headline makes the problem look like the solution.

To put that headline in perspective, one also needed this quote from Jimmy Kuo, a principal architect with Microsoft's malware protection centre which is responsible for the Malicious Software Removal Tool: "What we did was to drive them [the Storm bot herders] elsewhere. They're probably out there still making money with some other botnet."

Twenty-three minutes, admittedly not all of it taken up by the botnet sensationalism. A little time was spent on some tech news bytes. But with that kind of time available, you can't say that one could not have organised a detailed, educated discussion of botnets with some genuine experts.

There are any number of people who fit this bill: leading the way would be Bruce Schneier, who is now part of British Telecom after it bought his firm, Counterpane. Or Lance Spitzner of the Honeynet Project. Or any one of Dave Aitel, Marc Maiffret, Neel Mehta, Richard Forno, Oded Horowitz, Chris Eng, Kevin Dunn, or Mark Dowd.

But it's doubtful if any of these people would have indulged in hyperbole. And they would have had plenty to say about the culprits, the cause in the chain of cause-and-effect. That wouldn't have sat well in a programme made along these lines.