When Owen Walker was arrested for masterminding a massive international network of compromised computers last year, it seemed like a major victory in the war against botnets.

The 18-year-old New Zealander, who pleaded guilty to hacking charges last week, was arrested in the second of a series of actions, called Operation Bot Roast by the U.S. Federal Bureau of Investigation that were touted as major strikes against cybercrime.

"The operation was an attempt to kind of smoke the botnet underground out," said Matthew Fine, the FBI special agent who worked on the case. "Did we make a dent? That is for you to determine," he told attendees during a panel discussion at the RSA Conference in San Francisco Tuesday.

According to one botnet hunter, not much has changed.

"I'm sorry to report this, but it did not make a dent in my workload," answered fellow panelist Joe Telafici, vice president of Avert operations with McAfee. "The problem today is many orders of magnitude worse than it was."

Telafici believes that unless it becomes more expensive to run a botnet, nothing will change. It's simply too profitable to run these networks, and when someone like Owen Walker is arrested, there's always another criminal ready to take his place.

Some botnets are fading. Helped by better detection on the part of Microsoft's Malicious Software Removal Tool, which ships as part of the Windows operating system, the infamous Storm botnet has shrunk to a fraction of its former size.

On Tuesday, security vendor SecureWorks published a list of the largest botnets that are being used to send spam e-mail messages. Storm barely made the top five.

The largest and fastest-growing network is called Srizbi. With an estimated 315,000 bots, it can send as many as 60 billion messages per day. Last fall it made headlines when it sent out unauthorized spam messages promoting presidential candidate Ron Paul.

Written in part by a contract programmer from the Ukraine, Srizbi thrives using a technique known as social engineering -- it sends out links to malicious files, claiming that they are pornographic videos of celebrities. When the user clicks on the files, they become infected with the malware.

Storm has long thrived on social engineering techniques, too, sending malicious e-mail that is often linked to events in the news or holidays. But it now has only about 85,000 infected machines, and less than half of them are being used to send spam.

The IDG News Service is a Network World affiliate.

Whitepapers

• Gene Kim's Practical Steps to Mitigate Virtualization Security Risks
• Selecting Effective Virtual Directories
• A Modern Approach to On-Demand Email and Data Security
• Best Practices for HP Servers and HP Enterprise Virtual Array in a Microsoft Exchange
• Compliance, Protection, Recovery: A Layered Approach to Laptop Security
• Endpoint Security: Data Protection for IT, Freedom for Laptop Users

View more SECURITY whitepapers

Webcasts

• Key Considerations for a Successful 802.11n Deployment
• Solutions to the Toughest IT Challenges in Remote Offices
• Lowering the Cost of Email Archives
• High Availability for SQL Server 2005 Using Array-Based Replication and Host-Based Mirroring Technologies
• Technical Overview of Exchange Server 2007 with HP Servers and Storage
• Bringing Order and Security to your Mobile Workforce: Corporate Mobility Policy and Device Management On-Demand

View more SECURITY webcasts

Special Reports

• The Evolution of Network Security
• Taking Virtualization Up a Notch
• Learn how to Keep your Mobile Workforce Connected
• The self-managed network

View more SECURITY special reports