Big ISP = Big zombie army

Analysis of zombie networks by DDoS security company Prolexic showed high profile ISPs are the most likely to harbour compromised machines.

"It isn't surprising, it is these networks that are continually exploited to support large-scale DDoS attacks," said Barrett Lyon, CTO at Prolexic. "Just because a home user subscribes to a reputable brand doesn't mean they're safe from the online criminal fraternity."

Along with AOL, Bellsouth and Verizon, Comcast were criticized. Significantly, Earthlink, another sizeable ISP was not on the list of main offenders.

The report also highlighted major changes in the way that DDoS attacks have been coordinated over the last year, focussing less on layer-3 TCP and hitting weak DDoS mitigation devices.

"We have seen a 100 percent failure rate in several DDoS mitigation devices. Hardware does a poor job in identifying attacks that emulate legitimate traffic. Therefore, enterprises that rely on these devices are particularly vulnerable to this attack vector. Essentially, extortionists are becoming more intelligent and circumnavigating the security put in place to stop them," said Lyon.

The report also revealed that Hong Kong is the most infected country per capita. Which may explain the country's spam problem, due to be addressed by upcoming anti-spam legislation.

www.prolexic.com