Zombie war goes worldwide

Give the Federal Trade Commission some credit: It has some marketing skills. "Operation Spam Zombies" got plenty of play recently both because it is a good idea and because the name attracted a lot more attention than it would have if it were, say, "Operation Computer Spring Cleaning." Yawn.

Free IT resource TechNet: More ways to know it, share it, and keep it running. Sponsored by Microsoft Free IT resource Attend the SOA Executive Forum: Breaking SOA Bottlenecks SOAExecForum.com/may2007 Sponsored by InfoWorld

Seriously, the FTC had a program a year or so ago called Operation Secure Your Server. I'm sure you recall that.

Aside from its attention-grabbing name, Operation Spam Zombies appears to at least have some strategy behind it. The program is a worldwide effort to educate ISPs about the dangers of botnets and their role in the spread of spam.

The FTC has the lead in the U.S., but 20 other countries have also signed on to send information to more than 3,000 ISPs around the world in an effort to disable destructive botnets. The committed countries are already members of the London Action Plan, an international coalition working to prevent spam. Among those signed up are Canada, Denmark, Germany, Ireland, Japan, the Netherlands, Taiwan, the United Kingdom, and the United States. The missing piece so far is China, the new King of the Zombie PCs, according to several recent surveys. But working together, that's a start.

Botnets, or zombie networks, are groups of computers infected by malware; the malware controls the infected PC and uses it to send spam or launch DDoS attacks. You know that mail from "eBay" popping in every day asking you to "update your account" and, oh by the way, send credit card information along with it? That was probably sent courtesy of a botnet to make it more difficult to track the e-mail back to its annoying originator.

A recent survey by anti-spam company CipherTrust estimates that 350,000 PCs a month are being recruited into this zombie army. Other surveys suggest there are millions of PCs worldwide that can generate spam or create DDoS attacks. Researchers from the Honeynet Project  tracked more than 100 active botnets, including one containing 50,000 compromised zombie machines. That's quite an army of undead.

According to the FTC, the anti-zombie education program consists primarily of a letter sent to ISPs. The letter recommends that the ISP proactively identify the computers on its network sending above-average numbers of e-mail messages and then find out whether the computers are being used as zombies. The letter suggests that infected machines be quarantined until the zombie software can be purged.

OK, a letter is probably somewhat less threatening than George Romero's zombie eradication recommendation in "Night of the Living Dead." But then, if you recall, that didn't work out so well either.

If you want to keep tabs on the zombie war, check out CipherTrust's Web site and download the Zombie Meter, which tracks worldwide zombie activity in real time.

If you'd rather not wait on the FTC's letter striking fear into the hearts of the heartless zombie masters, you can look for companies such as CipherTrust, IronPort, and Symantec, which offer network appliances aimed at keeping your computers zombie-free. Other companies, such as Postini, offer mail-filtering services. And Avinti recently introduced iSolation Server 2.0, which uses virtual-machine technology to test for behavior in an e-mail and identify viruses for which there is no known pattern or signature.

Sophos offers software and services to avoid the zombie curse. It also publishes a monthly virus report, so let's check the charts: The top three computer viruses in May were the W32/Sober-N worm (43.8 percent of reports), followed by the W32/Zafi-D (14.5 percent) and the W32/Netsky-P (13.1 percent).

"In May we saw a lot of activity surrounding Sober-N as it cunningly climbed the chart by using social engineering tricks, such as offering free World Cup tickets, to lure recipients into opening the infected attachment," said Gregg Mastoras, senior security analyst at Sophos.

The bilingual Sober-N worm, which typically poses as an offer for tickets to the 2006 World Cup in Germany, was detected at the beginning of the month and rapidly spread across 40 countries. Here's the part I find stunning: It accounted for 4.5 percent of all e-mail. Four-point-five percent! That's a lot of soccer fans and a lot of potential zombies.