I know of a couple hundred computers that were infected with Blaster or some variant, that were not cleaned through Windows update, but I'm not aware of a single infected computer that used Windows update for cleaning. This would indicate that the number of Blaster-infected computers was likely to be significantly higher than 8 million. Maybe ten times as much (just guessing here).
Over the past month, Windows update detected another 1.5 million infected computers. How many were new infections? How many were the first time the user went to Windows update? How many other new infections were there that didn't visit Windows update? Don't know, but it is possible that Blaster is still infecting 100,000 or more new victims every day. Close to half a million new computers are put into service every day, so there's an ample supply of new victims.
The total number of Blaster victims to date is probably more like 50-100 million than one million.
One AV company said that by Sunday night Sasser had infected 3 million computers. I don't know how they came up with that number, but it seems reasonable, if not low. With the start of business Monday (and today, as Monday was a holiday in much of the world), the number of systems that have been infected with Sasser so far might easily exceed 10 million.
---------
Javier Fernandez-Sanguino wrote:
You're right. I forgot about witty, I read CAIDA's analysis of the worm just yesterday.
Still, the infected population of witty was pretty small (I believe ~12,000 machines in a day?) compared to SQLexp (~200,000 [1]), Slammer (~75,000-100,000 [2]), CodeRed (~360,000 in 12 hours [3]), Nimda (around 1.6 times CodeRed, maybe over 500,000 systems? [4]). I don't find data for Blaster, but I presume it infected many more systems than Nimda. So I believe we might be facing a worm that will infect over 1,000,000 systems.
Probably anti-virus vendors will have more accurate data. But I haven't seen it, not even in Symantec's (excellent) Threat Report V (December 2003) [5]. In any case, this worm was "predicted" by that same report. I would like to suggest everyone to read it thouroughly (Disclaimer: I don't work at Symantec).
Regards
Javier
[1] http://securityresponse.symantec.com/avcenter/Analysis-SQLExp.pdf [2] http://www.caida.org/analysis/security/sapphire/ [3] http://www.caida.org/analysis/security/code-red/ [4] http://www.first.org/events/progconf/2002/d5-02-song-slides.pdf [5] http://enterprisesecurity.symantec.com/content.cfm?articleid=1539&EID= 0
-----BEGIN PGP SIGNATURE----- Version: PGP 8.0.3
iQA/AwUBQJdUO6O1I0N5hzVfEQI+agCg3bZ9mm3JdKZpb2EL/z7rqRtlYs8AoKT3 10ew7+BsihlP//bdpD06yTzJ =FCNK -----END PGP SIGNATURE-----
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
