Sophos warns against rising zombies

10.11.2005
U.K.-based antivirus firm Sophos warns against rising number of zombies or infected PCs used to send spam or launch denial-of-service attacks. Most of these "hijacked" computers are located in Asia Pacific, according to a Sophos official.

According to Sophos, more than 50 percent of spam today is being sent out by zombies, also referred to as "bots" (short for robot). These "bots" are controlled remotely by hackers allowing them to send spam through infected PCs or launch email-based DOS attacks.

Sophos recently announced a "zombie alert" service, wherein a client is notified if there are infected IP addresses within its network. This service advises subscribers when any computer on their network is found to have sent spam to Sophos' global network of spam traps.

"What will happen is when we see spam anywhere, we will know where it's coming from. The service will inform the network administrator about infected IP address," said Charles Cousins, Sophos managing director for Asia Pacific.

"For a lot of network administrators, it is relatively easy to spot PCs sending out high-volume emails. But what won't look unusual would be PCs sending spam in low volume every five to ten minutes," Cousins added during a recent interview with Computerworld Philippines.

The service was launched almost two months ago in the U.S. and Sophos is now promoting it in Asia Pacific. This service suits large enterprise users using fixed IP addresses, rather than dynamic IP addresses usually assigned by ISPs, and with a network of remote users.

Cousins said Sophos is in a "unique" position to offer this kind of service because it operates integrated spam and anti-virus labs that are rivaled by Symantec. Sophos has detected spam masquerading as viruses and vice-versa, he added.

Sophos has done trials in some universities in Asia Pacific and the results reveal high incidence of hijacked PCs. "What we found out in some of our trials in some universities is there are PCs within their network hijacked by U.S. spammers sending out spam," Cousins said.

A recent study by Symantec revealed that the number of bot-infected computers in the first half of this year increased by more than 14 percent from the same period last year. Seoul, Beijing, and Taipei are ranked among the top 10 cities worldwide with the most number of zombie computers.