Botnets will eat the Internets

In the NYT, John Markoff covers the botnet phenomenon -- networks of compromised home PCs that are remote-controlled and used to send spam, blackmail net-casinos with denial of service shakedows, and harvest credit-card data and other valuable intel. I keep hearing that botnet numbers are swelling (which makes sense -- if Internet Explorer was insecure for 284 days last year, that's a lotta pwned PCs). If that's so, I would expect that the value of botnet time would be crashing -- I wonder when it'll become too cheap to even sell... Who needs volunteer PCs for Folding@Home when some Bulgarian hacker will sell you a month on a ten-million PC botnet for ten bucks?

ShadowServer, a voluntary organization of computer security experts that monitors botnet activity, is now tracking more than 400,000 infected machines and about 1,450 separate I.R.C. control systems, which are called Command & Control servers.

The financial danger can be seen in a technical report presented last summer by a security researcher who analyzed the information contained in a 200-megabyte file that he had intercepted. The file had been generated by a botnet that was systematically harvesting stolen information and then hiding it in a secret location where the data could be retrieved by the botnet master.

The data in the file had been collected during a 30-day period, according to Rick Wesson, chief executive of Support Intelligence, a San Francisco-based company that sells information on computer security threats to corporations and federal agencies. The data came from 793 infected computers and it generated 54,926 log-in credentials and 281 credit-card numbers. The stolen information affected 1,239 companies, he said, including 35 stock brokerages, 86 bank accounts, 174 e-commerce accounts and 245 e-mail accounts.

Link (via /.)