Sophos ZombieAlert

Jul 18, 2005 14:48 GMT  ·  By

Nowadays, the world of Internet is starting to resemble more and more to a bad horror movie, with zombies (in our case, hijacked systems) lurking all over the place and brave heroes trying to fight them back (and here we're talking about the security companies).

And one of these heroes is Sophos, a global leader in network security, who has just announced the availability of Sophos ZombieAlert, a new alert service that identifies "zombie" computers on an organization's network. Zombie computers are infected machines that give control to unauthorized and remote users, allowing them to send spam from the computer or to launch email- based Denial-of-Service (DoS) attacks against websites.

SophosLabs, Sophos's global network of virus and spam analysis centers, estimates more than 50 percent of all spam today originates from zombie computers. As spammers become more aggressive, collaborating with virus writers to create armies of zombie computers, legitimate organizations with hijacked computers are being identified as a source of spam. This not only harms the organization's reputation, but can also cause the company's email to be blocked by others.

ZombieAlert advises service subscribers when any computer on their network is found to have sent spam to Sophos's extensive global network of spam traps, and provides rapid notification to customers if their Internet Protocol (IP) addresses are listed in public Domain Name Server Blackhole Lists (DNSBL). This information helps customers locate, disinfect, and protect these systems from future attacks.

"Aside from consumers, organizations such as educational institutions and government agencies are most at risk because they often have complex environments with remote and home users, which makes it far more challenging to provide effective security," said Gregg Mastoras, senior security analyst at Sophos. "Our global network of threat analysis centers provides around the clock visibility into new and emerging threats, including compromised computers. This alert service gives organizations the opportunity to remedy the situation and clean their systems."

For Internet Service Providers (ISPs), the problem is equally as critical since consumers are largely targeted. This service enables ISPs to identify and alert consumers of the threat while providing the opportunity to recommend that end-users practice safe computing habits.