Feeds

So who sent you that spam? HP or Oracle?

Fortune 1000s host bots in the perimeter

5 things you didn’t know about cloud backup

Exclusive When it comes to bot-infested PCs that spew spam, most of us assume the owners are newbie users too naive or careless to follow basic security measures. Think again. There's a good chance that the penis enlargement email that just landed in your inbox is from a network maintained by Oracle, Hewlett-Packard or some other Fortune 1000 company.

We've been poring over data collected by Support Intelligence, a firm that uses spam traps and other methods to trace the locations of infected computers. Over two weeks in mid-February, it assembled evidence that computers connected to the networks of at least 28 large organizations sent unsolicited email.

These emails ran the spam gamut, from pump-and-dump scams to come-ons for Viagra. One appearing to come from Oracle tried to phish recipients' PayPal credentials. HP was also on the list. Best Buy, the giant electronics retailer, took the prize, having sent out more than 5,000 spams. To its credit, Best Buy acknowledged the spam problem after we brought it to the company's attention.

"We are repairing it as we speak, and we we're mortified," spokeswoman Paula Baldwin told us after IT administrators confirmed the Support-Intelligence findings. "We had no idea of the severity. We owe you our deepest gratitude."

Other companies we contacted were significantly more opaque. Both HP and Oracle declined to comment, refusing even to say if the data we provided was forwarded to security personnel in the companies' IT departments. Support Intelligence counted a little under 100 spams appearing to come from HP's network and about 10 from Oracle's.

Support Intelligence isn't the only firm to implicate the business world in the malware scourge. Webroot released a study today reporting that of 600 global businesses surveyed, 43 per cent suffered disruptions because of malware infections. Sixty percent had no information security plan.

Rick Wesson, CEO of Support Intelligence, has worked tirelessly to alert companies that his data strongly suggests spam is being sent from their networks. For the most part, company representatives in the front office are of little help in referring Wesson to the CISOs (chief information security officers) responsible. (He has also brought evidence of thousands of compromised credit card accounts to the attention of bank and law enforcement officials, but frequently gets no response.)

Of course, spammers go to great lengths to cloak the identities of the computers they've worked so hard to infect. To circumvent these obfuscation measures, the Support Intelligence spam trap hosts more than 10,000 domains and monitors and records the IP address of each server that hands off the spam to the server being monitored.

Throughout this article, we say the spam "appears" to originate from these companies' networks because Wesson acknowledges some false positives are inevitable when working with the volume of data he collects. Indeed, one suspicious email we forwarded to a large software company turned out to be a legitimate email testing a new advertising system. (The company shut it down after learning the emails were unintentionally appearing in inboxes not included in the pilot program.)

But there is reason to believe the results are generally accurate. In addition to Best Buy's confession, we received a validation from one the biggest technology companies in Silicon Valley. After receiving Support Intelligence data, a spokesman for the company confirmed spam had been sent from its network, but said the network was separate from its employee system and was reserved for use by partners and customers who wanted internet access during visits.

We also turned to Randal Vaughn, a professor of information systems at Baylor University and a specialist in tracking and shutting down sources of spam. He said the data "implies the mail does indeed correspond to internal generation [from the companies] and indicates bot infections inside the perimeter. This is not at all a warm fuzzy feeling about the state of internet security."

Wesson concurs. "If all these Fortune 1000 companies can have bots running on their systems," he says, "what do you think is happening to government [systems] in Kansas and Mississippi?" ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
One HUNDRED FAMOUS LADIES exposed NUDE online
Celebrity women victimised as Apple iCloud accounts reportedly popped
Rubbish WPS config sees WiFi router keys popped in seconds
Another day, another way in to your home router
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
NZ Justice Minister scalped as hacker leaks emails
Grab your popcorn: Subterfuge and slur disrupts election run up
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.