Fergie's Tech Blog

Botnets: As Storm Calms Down, Srizbi Gains Steam

Robert Vamosi writes on the C|Net "D3F3NS3 1N D3PTH" Blog:

On Thursday, MessageLabs reported in its April Intelligence report [.pdf] a marked decrease in the number of malware links connected to the Storm botnet. "It's not too often that a security company says that things are getting better," said Mark Sunner, chief security analyst.

At its peak, Sunner said, the Storm botnet resided on 1 million computers worldwide. That number has since decreased to about 85,000 Internet Protocol addresses at the end of April.

Over the last 18 months, Storm has been constant, never decreasing in prevalence, according to MessageLabs research. "Other security companies have reported decreases in the past," Sunner said, because of different methods of studying the botnet, "but this is first decrease we've seen."

Sunner credited the most recent patches from Microsoft for the decline. In the weeks following the most recent Patch Tuesday, he said, there was a sharp dropoff in Storm-related activity.

More here.

Note: Then again, a botnet of ~85,000 nodes is nothing to sneeze at. -ferg

posted by Fergie @ 5/01/2008 02:28:00 PM