Stealth virus warning sounded again

[whatthe]

Instead of trying to create viruses and worms that infect as many computers as possible, malware authors are instead trying to infect 5,000 or 10,000 computers at a time to create personalized zombie armies....

....According to Kaspersky, organized criminals are advertising networks of zombie computers for rent on underground newsgroups and Web pages. When they receive an order for a botnet of a certain size, they set about trying to infect computers using infected email attachments or socially-engineered spam with links to malicious Web pages. As soon as they infect enough computers to fulfill the order, they stop using that particular piece of malware...

..."It makes sense to have a discreet number of PCs under your control and be able to sell that on," said Biviano, who added: "With 5,000 PCs under your control--none of which are being destroyed or showing actual qualifiable damage as a result--you will fit under the radar, probably make some money and you probably won't get arrested."...

...."Before releasing the new infected code they test it using antivirus scanners and they don't release the new Trojan or worm if it is detected. I believe that if only 1,000 machines are infected, anti-virus companies will never receive the infected file. That is why antivirus companies have to collect data reactively and get samples as quickly as possible," said Kaspersky.

http://news.zdnet.com/2100-1009_22-5...=zdfd.newsfeed

[Striek]

So in other words, people are creating armies of zombie hosts. Sorry, but that's not exactly news.

Selling those armies is only a natural extension.

[whatthe]

I thought it was interesting to have the head of a major virus company come out and publicly put the onus on his sector rather than just blame the users.

[Striek]

Ah... now I see the point you were making.

I would think that this isn't enough of a threat for AV companies to worry about -- they've much bigger fish to fry. If they spend too much time on 5000 bot networks, they will end up missing things like Melissa. Perhaps more R&D on heuristics would be a better way to go rather than identifying by signature.

Either way, I would also say that it's a user's responsibility to make sure this doesn't happen, regardless of the AV software. Nobody blames McDonnall Douglas' avionics program when F14's get blown out of the sky. They blame the enemy or the pilot.