Big ISP = Big zombie army

Share this article:

Swathes of virus-infected PC’s are being hosted on some of the world’s biggest ISP’s including AOL, Bellsouth and Verizon.

Analysis of zombie networks by DDoS security company Prolexic showed high profile ISPs are the most likely to harbour compromised machines.

"It isn't surprising, it is these networks that are continually exploited to support large-scale DDoS attacks," said Barrett Lyon, CTO at Prolexic. "Just because a home user subscribes to a reputable brand doesn't mean they're safe from the online criminal fraternity."

Along with AOL, Bellsouth and Verizon, Comcast were criticized. Significantly, Earthlink, another sizeable ISP was not on the list of main offenders.

The report also highlighted major changes in the way that DDoS attacks have been coordinated over the last year, focussing less on layer-3 TCP and hitting weak DDoS mitigation devices.

"We have seen a 100 percent failure rate in several DDoS mitigation devices. Hardware does a poor job in identifying attacks that emulate legitimate traffic. Therefore, enterprises that rely on these devices are particularly vulnerable to this attack vector. Essentially, extortionists are becoming more intelligent and circumnavigating the security put in place to stop them," said Lyon.

The report also revealed that Hong Kong is the most infected country per capita. Which may explain the country's spam problem, due to be addressed by upcoming anti-spam legislation.

www.prolexic.com

Share this article:

Sign up to our newsletters

More in News

Leahy bill would end bulk data collection, introduce reforms

Leahy bill would end bulk data collection, introduce ...

Sen. Patrick Leahy introduced an NSA reform bill that would update the USA Freedom Act.

House passes two cyber security bills

One bill aims to improve agencies' website security, while another works to thwart critical infrastructure attacks.

A five-month-long Tor attack attempting to 'deanonymize' users

For roughly five months beginning in January, traffic confirmation attacks were used to attempt to "deanonymize" Tor users.