Top Botnets Control Some 1 Million Hijacked Computers

Puskas writes "Joe Stewart is the director of malware research at SecureWorks, and presented a dire view of the current botnet landscape at the RSA conference this week. He conducted a survey of the top spamming 'nets, extrapolating their size from the volume of emails that flow across the internet. By his calculations, the top 11 networks control just over a million machines, hitting inboxes with some 100 billion messages a day. 'The botnet at the top of the chart is Srizbi. According to Stewart, this botnet — which also goes by the names "Cbeplay" and "Exchanger" — has an estimated 315,000 bots and can blast out 60 billion messages a day. While it may not have gotten the publicity that Storm has during the last year, it's built around a much more substantial collection of hijacked computers, said Stewart. In comparison, Storm's botnet counts just 85,000 machines, only 35,000 of which are set up to send spam. Storm, in fact, is No. 5 on Stewart's list.'"

Hmmm....

[Otter]

Stewart and others at SecureWorks believe Damballa has simply rebranded the older Bobax, which has several other nicknames besides Kraken, including "Bobic," "Oderoor," "Cotmonger" and Hacktool.Spammer."

Be that as it may, "Kraken" is a superb name (as is "Damballa" itself.). "Bobic", "Oderoor" and "Bobax" sound like open-source CMSs. "Cotmonger" sounds like a word Bart Simpson would use when suddenly breaking into a unfunny Cockney accent for no reason.

Re:How do I tell...?

[spun]

You know what destroys infection? FIRE! Good old cleansing fire. Simply stuff your computer full of old newspapers, douse it with gasoline, and light it on fire, and I guarantee that it will be free from infection.

If this either seems to drastic or fails to do the trick, just squirt a syringe full of penicillin directly into the power supply while the computer is running, that should help.

I had a botnet once

[TheRealMindChild]

I had a botnet once... didn't catch very many bots, but I got a shitload of dolphins :(

Re:My wife's notebook is one of them

[megaditto]

In your hosts file, point "pc-on-internet.com" to 66.35.250.150, then each time a window pops up treat it as a helpful reminder to take an ergonomic break.

Re:How do I tell...?

[Zemplar]

I'm a smart software developer, so I'm pretty sure my computer is not affected (secured hardware firewall, etc). But how can I be sure? I don't necessarily trust that a clean-virus scan means a whole lot. What's the best way to make this determination?

Do you shutdown your computer by pressing "start"? If so, odds are good you're at risk.

Re:Take away their licenses

[JoshJ]

Using Windows is NOT a privilege, by the way. If the user paid for it, they have a right to use it.

Not according to Microsoft.

Re:Let's see some truthful tagging

[Jeremiah Cornelius]

Whoops! The cat's eaten it...

Re:Let's see some truthful tagging

[Hatta]

The article notes that the linux boxes are like the generals of the botnet army. So even when compromised linux is a more powerful OS. ;)