In a meeting room, the screen on the left shows a 3D replica of Bagle malware, along with a number of its assembly level functions. The screen in the centre shows Google Earth. The program's APIs allow an XML feed from F-Secure's "darknet" — a series of IP addresses which are not connected to a computer system. "They are just IP addresses — no-one should be calling that number," said Mika Stahlberg, F-Secure's head of security research.
On the map, every IP address shows the location of a machine infected with the Blaster worm. Worms scan the entire range of IP addresses "in a matter of minutes", according to Stahlberg. As the infected machine searches the internet, it "touches" the F-Secure darknet, enabling the company to trace the infected machine. The information is not publicised, but is forwarded to computer emergency response teams (CERTs) in Finland and Malaysia. F-Secure uses its darknet in part to forecast malware outbreaks.
