It isn’t new 0-day releases or slow upgrades to Vista that are keeping Microsoft up at night, it's botnets.
Infected computers of users who never know that their PC is remotely controlled and used to spam, attack, and defraud thousands of people every day. Reported to number in the millions, remote systems can be launched and controlled by one person or groups of people.
Aaron Kornblum a senior attorney for Microsoft’s Internet Safety Enforcement team, told Robert McMillan of IDG News, “Botnets are really where it's at for serious cyber criminals, because of their concentrated power. That power can be used for all sorts of malicious conduct on the Internet.”
This isn’t the only trend Kornblum sees, his team helped crackdown on phishing scams, and also helped take down a Bulgarian gang that was caught spoofing Microsoft’s own customer service team, proving that no company or organization is safe from these schemes.
The trend researchers and Kornblum’s own analysis suggests that botnets are the new form of attack that will take shape in the coming year. No longer targeting users of large banks and merchants, they are going for the middle class, and taking aim at federal credit unions, and small companies.
Taking advantage of little to no customer training on how to avoid these schemes these targets are likely easy pickings, as the smaller banks and financial firms come on to the web to expand the base of services they offer customers.
What started as a 3-person team at Microsoft is now a 65 person department, and Kornblum is in the thick of it all. Helping track botnets and child porn to name a few tasks this team performs. The focus however, is Internet Safety and end user information.
The inherent threat of the “grid computing gone bad” as named by Daniel Druker of Postini Inc, will continue to spread. The defense users have from Botnet attacks and infection is information provided by Microsoft, CERT, and other well-known companies making sure patches for security are applied, and updating their systems as soon as the patches are released.
Will 2007 be the year of the bot? Time will tell, but knowing there are experts working to fight these bots, and the frauds they produce, might be just the move in the right direction the internet needs.