North American Network Operators Group
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: 10,352 active botnets (was Re: register.com down sev0?)

  • From: Marshall Eubanks
  • Date: Thu Oct 26 08:49:06 2006 
Dear Fergie;

Is there a similar statistic available for Mac OS X ?

Regards
Marshall

On Oct 26, 2006, at 5:43 AM, Fergie wrote:


Jose's numbers are conservative.

Given some mathematical acrobatics, I'd suggest examining some
of the (shocking) number sin Microsoft's Security Intelligence
Report (Google it) -- these are reflective:

"Of the 4 million computers cleaned by the company's MSRT
(malicious software removal tool), about 50 percent (2 million)
contained at least one backdoor Trojan. While this is a high
percentage, Microsoft notes that this is a decrease from the
second half of 2005. During that period, the MSRT data showed
that 68 percent of machines cleaned by the tool contained a
backdoor Trojan."

Ref: http://www.eweek.com/article2/0,1759,2036439,00.asp

If you're wondering why DDoS attacks are so effective, look
no further than your backyard.

- ferg


-- Sean Donelan <[email protected]> wrote:

On Thu, 26 Oct 2006, [email protected] wrote:
Well, let's talk about "worst-case ddos". Let's say, 50mpps (I have not
heard of ddos larger that that number). Let's say, you can sink/ filter
100kpps on each box (not unreasonable on higher-end box with nsd). That
means, you should be able to filter this attack with ~500 servers,
appropriately place. Say, because you don't know where the attack will
come in, you need 4 times more the estimated number of servers, that's
2000 servers. That's not entirely unreasonable number for a large enough
company.
Botnets were the topic at today's Info Security conference in New York
City.  <http://www.infosecurityevent.com>   Coincidences?  Or just
as random as your iPod shuffle?

Jose Nazario estimated that there were 10,352 botnets active on the
Internet earlier this year. You will probably always be outnumbered on
the public Internet.


--
"Fergie", a.k.a. Paul Ferguson
 Engineering Architecture for the Internet
 fergdawg(at)netzero.net
 ferg's tech blog: http://fergdawg.blogspot.com/