Interesting survey of the connection between website hosts and botnet ‘command and control’ servers, which are used to direct networks of malware-infected clients:
For the first half of 2010, almost a quarter of botnet CnC servers were hosted by service providers in the US, with the top three countries (US – 23.9 per cent, Germany – 17.9 per cent and France – 8.6 per cent) hosting more than half of all CnC servers.
“Half of the servers used by cyber-criminals for the purpose of controlling their botnet empires are located in commercial hosting facilities within countries not traditionally associated with this kind of crime,” writes Gunter Ollmann, VP Research at Damballa.
Internet hosting firms 1&1 Internet AG in Germany and AT&T have unwittingly become favourite control points for cybercrooks, according to Damballa. 1&1 Internet alone accounts for more than one in 10 botnet command and control servers.
