Feeds

So who sent you that spam? HP or Oracle?

Fortune 1000s host bots in the perimeter

Beginner's guide to SSL certificates

Exclusive When it comes to bot-infested PCs that spew spam, most of us assume the owners are newbie users too naive or careless to follow basic security measures. Think again. There's a good chance that the penis enlargement email that just landed in your inbox is from a network maintained by Oracle, Hewlett-Packard or some other Fortune 1000 company.

We've been poring over data collected by Support Intelligence, a firm that uses spam traps and other methods to trace the locations of infected computers. Over two weeks in mid-February, it assembled evidence that computers connected to the networks of at least 28 large organizations sent unsolicited email.

These emails ran the spam gamut, from pump-and-dump scams to come-ons for Viagra. One appearing to come from Oracle tried to phish recipients' PayPal credentials. HP was also on the list. Best Buy, the giant electronics retailer, took the prize, having sent out more than 5,000 spams. To its credit, Best Buy acknowledged the spam problem after we brought it to the company's attention.

"We are repairing it as we speak, and we we're mortified," spokeswoman Paula Baldwin told us after IT administrators confirmed the Support-Intelligence findings. "We had no idea of the severity. We owe you our deepest gratitude."

Other companies we contacted were significantly more opaque. Both HP and Oracle declined to comment, refusing even to say if the data we provided was forwarded to security personnel in the companies' IT departments. Support Intelligence counted a little under 100 spams appearing to come from HP's network and about 10 from Oracle's.

Support Intelligence isn't the only firm to implicate the business world in the malware scourge. Webroot released a study today reporting that of 600 global businesses surveyed, 43 per cent suffered disruptions because of malware infections. Sixty percent had no information security plan.

Rick Wesson, CEO of Support Intelligence, has worked tirelessly to alert companies that his data strongly suggests spam is being sent from their networks. For the most part, company representatives in the front office are of little help in referring Wesson to the CISOs (chief information security officers) responsible. (He has also brought evidence of thousands of compromised credit card accounts to the attention of bank and law enforcement officials, but frequently gets no response.)

Of course, spammers go to great lengths to cloak the identities of the computers they've worked so hard to infect. To circumvent these obfuscation measures, the Support Intelligence spam trap hosts more than 10,000 domains and monitors and records the IP address of each server that hands off the spam to the server being monitored.

Throughout this article, we say the spam "appears" to originate from these companies' networks because Wesson acknowledges some false positives are inevitable when working with the volume of data he collects. Indeed, one suspicious email we forwarded to a large software company turned out to be a legitimate email testing a new advertising system. (The company shut it down after learning the emails were unintentionally appearing in inboxes not included in the pilot program.)

But there is reason to believe the results are generally accurate. In addition to Best Buy's confession, we received a validation from one the biggest technology companies in Silicon Valley. After receiving Support Intelligence data, a spokesman for the company confirmed spam had been sent from its network, but said the network was separate from its employee system and was reserved for use by partners and customers who wanted internet access during visits.

We also turned to Randal Vaughn, a professor of information systems at Baylor University and a specialist in tracking and shutting down sources of spam. He said the data "implies the mail does indeed correspond to internal generation [from the companies] and indicates bot infections inside the perimeter. This is not at all a warm fuzzy feeling about the state of internet security."

Wesson concurs. "If all these Fortune 1000 companies can have bots running on their systems," he says, "what do you think is happening to government [systems] in Kansas and Mississippi?" ®

Protecting users from Firesheep and other Sidejacking attacks with SSL

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Jihadi terrorists DIDN'T encrypt their comms 'cos of Snowden leaks
Intel bods' analysis concludes 'no significant change' after whistle was blown
Home Depot: 56 million bank cards pwned by malware in our tills
That's about 50 per cent bigger than the Target tills mega-hack
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
China hacked US Army transport orgs TWENTY TIMES in ONE YEAR
FBI et al knew of nine hacks - but didn't tell TRANSCOM
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Protecting users from Firesheep and other Sidejacking attacks with SSL
Discussing the vulnerabilities inherent in Wi-Fi networks, and how using TLS/SSL for your entire site will assure security.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.