The World's Biggest Botnets

ancientribe writes "There's a new peer-to-peer based botnet emerging that could blow the notorious Storm away in size and sophistication, according to researchers, and it's a direct result of how Storm has changed the botnet game, with more powerful and wily botnets on the horizon. This article provides a peek at the 'new Storm' and reveals the three biggest botnets in the world (including Storm) — and what makes them tick and what they are after."

Re:Microsoft isn't the only irresponsible company

[Torvaun]

DD-WRT. Problem solved.

Re:Does it run on Windows?

[cheater512]

It was made by the NSA. What did you expect? :P

Re:Yes, free software would fix the problem.

[Opportunist]

Not really. There is a very simple reason why botnets are dominated (to pretty much 100%) by MS systems. Numbers. Most machines in home user hands simply are running on some kind of MS OS.

Yes, Linux and MacOS are more secure. It's harder to slip something into the system, at best you can run with user privileges, yes, yes.

Unless you trick the user. And that's pretty much the main infection vector today. About 95% of malware comes in the form of infected spam mails, only 5% of infections rely on system insecurities, buffer overflows or other system related security holes.

And when you can trick the user into executing something, it's trivial to trick him also into giving the malware elevated privileges, provided you promise him something. Send someone a "tool" that promises 20% more speed or ram, but since it has to hook deeply into the system, it will require root privileges.

Yes, you won't fall for it. But the average clueless user? After all, this thingamajig is gonna do something with your system to make it run faster, so it's kinda logic that it will need system privs.

No system is secure from malware. Security is by definition the minimum of a system's security capabilities and its adminstrator's security capability. BOTH need to be secure to create a secure system.

Re:Relevant?

[Opportunist]

Keep up the smack talk and I'll rent part of the botnet to DDoS you, just for kicks. Hey, it's not like renting a few 1000 boxes for a few days was expensive!

That's how it affects you. Well, unless you can be blackmailed along the lines of "pay me X bucks or you go offline for Y days, let's see if your biz survives", it probably won't affect you, directly at least.

How about your employer? What would happen if his internet presence, his mailserver, his means to communicate online were rendered useless for a month? Would the company survive?

Re:Note total absence of word "Microsoft"

[Cozminsky]

Depends on the OS really. But you're right if you mean any commercially available OS today. Singularity [microsoft.com] might solve a few problems if it was adopted. There are also some promising techniques being proposed by the people responsible for E [erights.org].