Written by washingtonpost.com's tech policy team, the e-mail version of this weekly feature includes an original news article and links to policy and cyber-security stories from the previous week. • Click Here for Free Sign-up • Read E-letter Archive
Still, 300,000 computers is more than enough to conduct a large-scale spam campaign or a denial-of-service attack that could knock some of the biggest Web sites offline for an indefinite period, said Ken Dunham of Reston Va.-based Internet security firm iDefense.
Phatbot's presumed firepower attracted the attention of the Department of Homeland Security, the agency in charge of the federal government's cybersecurity efforts. Department officials issued an alert to a small group of computer security experts and later put out a public notice about Phatbot through its US-CERT network.
Antivirus companies have a harder time accepting infection rates in the hundreds of thousands.
Mikko Hypponen, director of antivirus research at F-Secure, an antivirus company based in Finland, said that there are many factors that can make it seem like there are more computers infested with Phatbot-style Trojans than there really are.
"I hope it's not really that bad but it could be," Hypponen said.
Chris Kraft, senior messaging analyst at Sophos Inc., an e-mail security and antivirus company based in the United Kingdom, said the company has identified more than 200 variants of the family of Trojan programs that includes Phatbot, and estimates the total infections to be less than 10,000.
Patrick Nolan, a computer expert who monitors Internet attack trends for the SANS Internet Storm Center in Bethesda, Md., said that antivirus companies are failing to spot the Trojans.
"If infected machines aren't attacking their clients, the antivirus firms aren't going to care too much that they even exist," Nolan said. "But I believe that anything that's approaching the stealth ... of this group of Trojans deserves a lot more attention."
Carey Nachenberg, chief architect for Symantec Research Labs, said the reason that the antivirus companies are not seeing high infection rates from Phatbot is because infected computers don't run their software. "There are still millions of people out there who are completely unaware of the importance of keeping their computers up to date with the latest virus updates."
