CHICAGO, June 1 (UPI) -- A computer enthusiast downloads the latest saucy Paris Hilton ad, from the Carl's Jr. chain, from the Internet and sends it to his office colleagues. Later that evening, his company finds 67 of its 92 computers have been invaded and are being controlled remotely by hackers, who have sent out a million e-mails touting Viagra, the male potency supplement.
"They did not realize that the 30 second clip had a virus attached to it," said Gregory Evans, chief executive officer of CEO LIGATT Security, an IT consulting company in Los Angeles, referring to a client.
Nor do most Americans, apparently, understand the pervasiveness of computer zombies, as they are called: PCs taken over by hackers and used for illicit advertising on the Web. So, the Federal Trade Commission and a number of other government agencies, here and abroad, have begun targeting zombies, experts told UPI's The Web.
"I see more and more innocent computers being manipulated every day," Evans said.
According to the FTC, spammers use secret software that allows them to hijack personal computers and office PCs, and route spam through them. By routing their e-mails through zombie computers, the spammers are able to hide their true origin from consumers and make it more difficult for law enforcement to arrest them.
The zombies do not destroy PC hard drives, but they do tap into bandwidth.
"Zombies don't pose a threat to computers, but rather to Internet connectivity," said Joe Cupano, technical director of Solsoft Inc., a security policy server developer in Mountain View, Calif. "To survive, zombies must keep your computer running. The the real threat is to the lost bandwidth going in and out of your computer, since zombies hijack your connection."
Without knowing the cause, some users respond by buying more bandwidth.
"This is akin to feeding a hungry bear more honey in hopes the bear will leave you alone," Cupano said. "Suddenly a self-fulfilling, self-feeding vicious loop is born."
Some users also try to combat the problem by buying more applications for their PCs, essentially bloating the system to a point where it needs more power to run. However, this only burdens connectivity, "which feeds the zombie," said Cupano.
This is a case where government intervention into desktop territory actually may help, experts said.
Recent research by MessageLabs in New York City, a leading provider of e-mail security services, indicates more than 80 percent of all spam worldwide comes from zombie PCs.
"We believe these FTC measures can help reduce the overall volume of spam, while diminishing the problem of spam specifically emanating from the United States," said Matt Sergeant, senior anti-spam technologist with MessageLabs.
FTC staffers, working with other government agencies in a project called Operation Spam Zombies, are sending letters to more than 3,000 Internet Service Providers around the world, urging them to employ protective measures to prevent their customers' computers from being hijacked by spammers.
Such measures include:
--blocking an Internet port commonly used for e-mail when possible;
--using rate-limiting controls for e-mail relays, and
--locating computers that are sending large amounts of e-mail and taking steps to discern if the computer is acting as a spam zombie.
The FTC also has issued a statement containing suggested measures -- some of them dramatic:
--When necessary, quarantine the affected computer until the source of the problem is removed;
--provide plain-language information for customers on how to keep their home computers secure, and
--provide customers or point to to easy-to-use tools to remove zombie code from infected computers.
In addition to having one's PC become a staging area for computer junk e-mail, zombie software -- sometimes known by the broader term spyware -- can undertake other nefarious tasks.
Experts said the software can retrieve files left on the computer via a backdoor and install keystroke loggers to retrieve bank passwords or other personal information.
"They can also corrupt files on the user's computer in a malicious manner," said Charles McColgan, chief technology officer at FrontBridge, an IT security company in Los Angeles. "When a zombie is installed on a user's home computer, that computer is now at the mercy of some hacker."
Consumers, however, should not only rely on the federal government's lobbying of ISPs to secure their PCs, but they also should take proactive steps themselves. These include updating PCs with the latest anti-virus software, patching the computer's operating system, browser and related programs, such as Microsoft Office, said Mike Weider, founder and chief technology officer of Watchfire, a provider of online risk management software and services.
He also provided some cautions for regular Internet users.
"Do not click on links in e-mails -- even if you think the e-mail is from someone you know," said Weider. "Recent scams have become more sophisticated, allowing phishers to exploit readily available personal information and craft e-mails that are seemingly more legitimate."
Last, he warns, "always remember to log out of online sessions."
--
Gene J. Koprowski is a 2005 Winner of a Lilly Endowment Award for his columns for United Press International. He covers telecommunications for UPI Science News. E-mail: [email protected]
