Rise of Botwebs
Botnets have been a fixture of the internet for many years. Their command and control structures have evolved greatly but their methods of propagation have largely gone unchanged. The recent advent of drive-by downloads have been part of a new transformation in badware, the botweb. This web-only cycle is a result of the profliferation of cheap turn key web hosting which led to massive adoption among novice computer users. The huge population of consumer web masters, untrained in security matters, had the same effect as broadband adoption in the 1990s. Attackers are presented with a target rich environment with minimal security protection or monitoring.
As Maxim noted last week, recent threads on badwarebusters.org and various reports on the web show that Gumblar and similar attacks are perfecting a new propagation method that steals the FTP credentials from the webmasters themselves and spreads infections via the websites they control. The infections often reside in more complex parts of the web server like an error code folder or an htaccess file. As seen in the badwarebuster's thread even educated computer literate academics can be stumped for months due to their unfamiliarity with the minutiae of web server administration.
Administering a web server is a complex job that requires skills and training that need constant updating. Consumer webmasters generally lack these skills and may decline to acquire them if offered. This emerging threat will likely continue to grow as web hosts continue to sell turnkey web hosting to less and less sophisticated clientele providing an ever growing list of targets for attackers to exploit. No single entity can solve this issue. Various parties from security vendors to government agencies to hosting providers must work together to break ground in this problem.