Report: U.S. most prolific source of online attacks
U.S. networks pumped out the highest percentage of attacks during the second half of last year, with China running a distant second, according to a report released Monday by security firm Symantec. — The U.S. accounted for 31 percent …
Context & Ripple Effects
Symantec's twice-yearly threat report puts U.S. networks first among attack sources at 31 percent for the second half of 2006, with China a distant second — a ranking that lands awkwardly for a vendor still repairing its own standing after criticism of its data-theft and targeted-attack findings and, a year earlier, confirmed reports that Norton SystemWorks shipped rootkit-like cloaking code.
The publisher matters as much as the numbers: between abruptly ending the Sygate firewall line in late 2005 and joining the Anti-Spyware Coalition's effort to define 'rootkit,' Symantec has been both an arbiter of what counts as hostile software and a subject of those same debates.
First-order effects
- U.S. network operators and enterprise IT teams are directly implicated: the largest share of observed attacks originates from their own address space, making compromised domestic hosts a housekeeping problem for them rather than a border problem.
- Symantec gains a headline data point for its security-advisory business, while China-based sources carry a documented second-place ranking from a major vendor's telemetry.
Second-order effects
- Rival security vendors face pressure to publish competing telemetry to contest or corroborate Symantec's country-level framing, turning semi-annual threat reports into a marketing battleground where each vendor's installed base shapes the picture.
- Enterprises translating these rankings into policy will weigh blocking or throttling traffic by origin geography — a move whose usefulness depends on whether reported origins reflect attackers or merely hijacked machines.
Third-order effects
- If origin-of-attack statistics keep placing the U.S. on top, the political narrative shifts from defending against foreign threats toward cleaning up infected domestic infrastructure, favoring coordinated defense across ISPs, vendors, and customers over perimeter-only models.
- Vendor-published rankings harden into the de facto scoreboard for national cyber attribution despite measuring attack origination, not attacker location — a gap every later report inherits.
The trend: Security vendors' telemetry reports are becoming the default public scoreboard for national attack attribution, even as they conflate compromised hosts with attackers.