Every month, about four million computers turn into zombies, according to researchers.
Unbeknownst to their owners, who have accidentally clicked on a malicious link or file, the infected computers get recruited to join botnets -- or global networks of remote-controlled PCs that cyber criminals use to crash websites, swipe passwords or steal consumer financial data.
Experts say botnets have become a serious threat to the digital economy. And now, Internet service providers are joining the fight to destroy them.
On Thursday, the Federal Communications Commission announced commitments from most of the nation's big Internet service providers to adhere to a voluntary "code of conduct" to fight botnets. The code calls on the providers to detect whether customers' computers have become robots -- or "bots" -- and notify and help customers whose computers are infected.
"If you own a PC, you’ll be significantly better protected against your computer being taken over by a bad actor who could destroy your private files or steal your personal information," FCC Chair Julius Genachowski said Thursday, as he announced the "code of conduct" suggested by a federal advisory group known as the Communications, Security, Reliability, and Interoperability Council (CSRIC).
Thousands of botnets have taken over millions of computers around the world. One of the largest botnets infected as many as 12.7 million computers in more than 190 countries. But innocent computer owners are often unaware that their PCs are performing automated tasks that help cyber criminals. Some may notice their computer being unusually slow or crashing frequently, but those problems might also be caused by unrelated hardware of software issues, according to the Microsoft Safety and Security Center.
Internet service providers are uniquely positioned to spot botnets and other cyber threats on their networks in the early stages, experts say.
On Thursday, the FCC said that AT&T, CenturyLink, Comcast, Cox, Sprint, Time Warner and Verizon all agreed to follow the recommendations made by CSRIC, which addressed not only fighting botnets but also two other major cybersecurity risks: domain name fraud and IP hijacking.
To help users surf the web, the Internet relies on a digital phone book known as the Domain Name System, or DNS, that turns the long string of numbers in an IP address into an easy-to-remember URL. Domain name fraud occurs when hackers scramble the identifying information of a website so users are misdirected to a nearly-identical but fraudulent website, where they are duped into providing their financial or other personal information. On Thursday, Internet providers agreed to adopt security protocols, known as Domain Name System Security Extensions, which help prevent domain name fraud by allowing Internet users to verify the authenticity of websites they visit.
The companies also agreed to adopt standards to validate Internet routing information and prevent "IP hijacking," which occurs when hackers misdirect Internet traffic to an insecure website in order to eavesdrop on Internet users' communications and steal or change data. In 2010, 15 percent of the world's Internet traffic was diverted through Chinese servers for about 18 minutes, according to a report by the U.S.-China Economic and Security Review Commission.
On Thursday, Genachowski called the recommendations "a blueprint for addressing some of the biggest threats to our digital economy."
He added, "Implementing these recommendations will reduce the risks of cyber crimes that cost U.S. businesses and consumers billions of dollars every year and will enhance the security of this platform that is increasingly integrated into every aspect of our economy and society."