427 Botnet fm qxd

Malware in the Wild
The WildList Organization International (www.wildlist.org) is a long-
standing cooperative venture to track “in the wild” (ItW) malware, as
reported by 80 or so antivirus professionals, most of them working for
AV vendors. The WildList itself is a notionally monthly list of malicious
programs known to be currently ItW. Because the organization is essen-
tially staffed by volunteers, a month slips occasionally, and the list for a
given month can come out quite a while later. This isn’t just a matter of
not having time to write the list; the process involves exhaustive testing
and comparing of samples, and that’s what takes time.
However, the WildList is a unique resource that is the basis for much
research and is extensively drawn on by the better AV testing organiza-
tions (Virus Bulletin, AV-Test.org, ICSAlabs). The published WildList actu-
ally comprises two main lists: the shorter “real” WildList, where each
malware entry has been reported by two or more reporters, and a
(nowadays) longer list that has only been reported by one person. A
quick scan of the latest available lists at the time of writing (the
September 2006 list is at www.wildlist.org/WildList/200609.htm) demon-
strates dramatically what AV is really catching these days:
■
First, it illustrates to what extent the threatscape is domi-
nated by bots and bot-related malware: The secondary list
shows around 400 variants of W32/Sdbot alone.
■
It also demonstrates the change, described earlier, in how
malware is distributed. Historically, the WildList is published in
two parts because when a virus or variant makes the primary
list, the fact that it’s been reported by two or more WildList
reporters validates the fact that it’s definitely (and technically)
ItW. It doesn’t mean that there’s something untrustworthy
www.syngress.com