4Network Security May 2008

Developing world, developing problems

On the internet, everything is connected to everything else. Distance does not separate a business in London from a virus-compromised home computer in Beijing or Bangalore. The problem for businesses in London, New York or any-where in the developed world is that the more compromised computers there are on the nternet, the greater the torrent of malware and spam.

The expression ‘there’s one born every minute’ may come to mind for some when they hear about the victims of cyber crime, but with a global population soar-ing well above six billion, there are in fact well over 250 of us being born every minute. With each new generation, the need for internet connectivity is taking on ever greater significance. It is upon these vast numbers that a criminal element will always continue to prey upon a minority percentage, cyber or otherwise.

Ultimately, whether we are dealing with spam, viruses, phishing or bot nets, the real purpose behind cybercrime is in fact economic. It works because it is lucrative for perpetrators who thrive upon exploiting unprotected connections to the internet. So where are we seeing the greatest activity when it comes to the new net?

A new frontierIndia and China are in the news because of their tremendous economic growth. This economic power is matched by a growing number of internet-connected computers and a growing middle class with broadband access at home. For Indian and Chinese businesses interested in an overseas market the internet pro-vides an efficient medium for commu-nications – a factor that has retarded a

great deal of trade in the past. India had 60m internet users in 2005 (and many more today) while China had 162m in 2007. A recent article in the Economist estimated that the Chinese middle class will number between 100-500m people in ten years’ time, and correspondingly the Indian populace will exceed that of China in 2030.

What is true of China and India is also true of other developing countries, partic-ularly in the far east and south America. However, this paper concentrates on these two countries because of their growing significance in the world economy and because of their large populations.

Developing world broadband connectionsIn our experience, it is not the number of computers or internet users that cause problems for our customers, but the number of broadband connections. Why? First, when a computer is permanently connected to the internet it is easier to infect with a virus. Second, an infected computer can join a bot net and start spamming other internet users or sending out more viruses. Worse, it can do it at high speed, twenty-four hours a day.

“Where we see increased broadband rollout in a region, viruses, botnets and spam follow”

Broadband statistics show the same relentless growth as the developing economies. According to research by Point Topic, the number of broadband subscribers in China is approaching the number of broadband subscribers in

Mark Sunner, chief security analyst, MessageLabs

The rise of an internet-using middle class in developing countries such as India and China has created fertile ground for viruses and botnets. This means that these countries are a growing source of internet problems here in the west. Mark Sunner

Figure 1: Population statistics and estimates for India and China.

DEVELOPING WORLD

May 2008 Network Security5

the USA. In China, in Q4 2006, there were 51m. This represents an annual growth of 38.4%. In India, the numbers are smaller but the growth rate is much greater. There were 2m broadband users in the same period there, but this had grown by 152.8% compared to the year before. In comparison, in July 2007, the Organisation for Economic Co-opera-tion and Development (OECD) report-ed that the UK has 14m and the USA had 66m subscribers.

Where we see increased broadband rollout in a region, viruses, botnets and spam follow. Our hypothesis is that users in developing countries may be new to the internet and unaware of the risks they run when they go online and the techniques they need to apply in order to protect themselves.

Virus sources and targetsPreliminary data from Skeptic™, MessageLabs’ predictive proprietary tech-nology, shown in the table below reveals that India is already a leading source of viruses, with China not far behind.

Similarly, India is a major target for viruses. Our most recent data puts India at the top of the league, and while rank-ings fluctuate month to month, India has remained in the top ten throughout 2007 and early 2008.

What makes these figures alarm-ing, especially in the case of India, is that they come from a relatively small number of internet-connected machines.

When we publish data indicating that developing economies are the source of a lot of spam or viruses, people become concerned because they think there is hacker activity there. That is a concern, but the bigger threat is the rise of con-sumer IT and the lack of protection due to its early stage of adoption. As new green fields appear on the internet, there is an initial period when security is lax and viruses run wild. The situation is similar to that once faced by the western world five years ago when broadband adoption became mainstream.

Figure 2 chart plots the growth of broadband adoption from 2001-2006 in the UK, which bears an uncanny resemblance to growth of spam volumes during the same period. This is hardly coincidence. The spam epidemic gained a quantum leap starting in January 2003 with the advent of the Sobig-A virus.

Sobig is of particular significance because it was the first virus dedicated to the sending of spam. But there is another important factor here – Sobig’s success was totally dependant on the pervasive-ness of broadband and, as can be seen from the chart, its inception was perfectly timed. The bot net phenomenon really started at this point.

At the foot of the growth curveAsia currently stands at the very begin-ning of the same adoption of fast fixed links to the home as we saw in the west. However, the big difference is that exploits have progressed significantly in terms of sophistication and proliferation, so in today’s terms an unprotected PC is infinitely more vulnerable now than would have been the case five years ago.

Figure 2: Comparing the growth of broadband connection in the UK with increasing spam Levels.

Rank Country of origin % of viruses detected

1 USA 27.73%

2 Poland 13.11%

3 UK 5.59%

4 Uruguay 5.57%

5 Italy 4.45%

6 Japan 3.52%

7 India 3.45%

8 Spain 3.05%

9 Germany 3.04%

10 Australia 2.60%

11 Korea 2.38%

12 China 2.16%

Table 1: Sources of viruses across the world.

Rank Country of recipient

% of emails containing viruses

1 India 2.92%

2 Germany 1.95%

3 Switzerland 1.66%

4 France 1.59%

5 United Arab Emirates 1.55%

6 Ireland 1.45%

7 Hong Kong 1.41%

8 China 1.37%

9 Austria 1.32%

Table 2: Targets of viruses across the world.

DEVELOPING WORLD

6Network Security May 2008

When viewed in this light, we can expect the scale of current spam and virus vol-umes both to and from Asia to explode in the short- to mid-term.

“We can expect the scale of current spam and virus volumes both to and from Asia to explode in the short- to mid-term”

The growing attraction of infected bots geographically sourced in Asia is already visible. Figure 3 is an accurate geograph-ic representation of the Storm Worm – the worlds largest and most sophisti-cated bot net. The red patches represent

the density of infected computers per geographic region.

With closer scrutiny we can clearly see that both China and India are already beginning to feature within the Storm worm army - even though their current internet infrastructure is lagging way behind that of the west.

Payment for infected hosts within the cyber black market also demon-strates a premium on Asian locations. Single nodes are traded for an average of US$0.07 on underground sites such as InstallCash or iframedollars.biz. Both sites are essentially affiliate programs for bad guys that will actually pay botnet

owners to reinfect bots under their control with additional spyware from yet more cyber crooks.

The impact that the Asian portion of Storm worm is having can now be meas-ured. We currently estimate that approx-imately 7% of the spam emanating from the Storm worm comes from bots inside China, closely followed by India at 3%. These numbers are further broken down as follows in table 3.

So in essence 10% of Storm’s spam comes from these two Asian countries. This metric starts to take on a little more gravity when you consider that 20% of all the world’s spam comes from the Storm worm botnet. So we can conservatively infer that at least 2% of the world's spam comes from the Asian component of the Storm worm alone – and all this from a broadband infra-structure that is still in the early stages of development.

Lessons learnedAsia is now undoubtedly a target for the cyber criminals, as each fresh batch of newly rolled out broadband connections harvests more low hanging fruit. Many security lessons have been hard learned in the west to mitigate cyber threats both legislative and technical. It is the assertion of this author that Asian internet providers should apply these lessons from the start and collaborate with their western counter-parts. It’s essential that we help each other to combat what is a mutual problem.

Figure 3: Location of computers infected by the Storm worm.

Figure 4: Storm worm presence in India.

DEVELOPING WORLD

May 2008 Network Security7

So much is made of the need to develop business focus and related skills that it is all too easy to forget that information

security is a technical discipline. It is also a management priority, business develop-ment issue, and even an HR issue. And

while there is a dawning realisation that business skills are essential, people work-ing in this field should recognise that technical skills are just as essential, and feel free to forge their careers appropri-ately. For employers, there is growing recognition that the information security requirement is both comprehensive and complex, requiring a diversity of skill

Managing both careers and risksJohn Colley, managing director, EMEA, (ISC)2

It is an interesting development in the field of information security that many technically-minded people are afraid to admit that they are interested in firewalls or PKI. Technology, or the pursuit of an interest in it, has almost become taboo.

Much of the weakness associated with new broadband internet connections could be tackled head-on if traffic filtering

took place within the fabric of the internet itself. A major lesson learned in the west is the necessity to push

detection of such threats further back into the cloud. It is becoming accepted knowledge that ISPs must accept more responsibility for the traffic that they are allowing to flow to and from their customers, consumers and businesses alike. As more filtering takes place within the cloud, the tide can be turned against internet-borne threats before the end point even becomes a factor.

“Much of the weakness associated with new broadband internet connections could be tackled head-on if traffic filtering took place within the fabric of the internet itself”

As newly connected systems are the most vulnerable, Asian ISPs must start to perform this task now, before broadband adoption becomes mainstream. We have a moment in time to head this problem off before it gets started. Act now, before it’s too late.

About the author

Mark Sunner joined MessageLabs in 1999, as head of product development and innovation. The services Mark and his team initially created went on to establish ground breaking milestones within the anti-virus and Anti-spam are-nas. He has spoken on a wide variety of security related topics to audiences around the world on a range of security issues and product innovation.

Figure 5: Storm worm presence in China.

Top 10 Region

Country % GlobalSpam

Top 10 Region

Country % Global Spam

Beijing China 2.382 Bombay India 0.601

Guangzhou China 0.955 New Delhi India 0.482

Shenyang China 0.433 Chennai India 0.345

Jinan China 0.374 Bangalore India 0.256

Wuhan China 0.295 Ranjan India 0.217

Hebei China 0.285 Hyderabad India 0.138

Shanghai China 0.285 Delhi India 0.089

Chengdu China 0.226 Calcutta India 0.069

Hangzhou China 0.197 Pune India 0.049

Changchun China 0.177 Ludhiana India 0.039

Table 3: Top 10 Regions for spam within China and India.

CAREER MOVES