Feeds

So who sent you that spam? HP or Oracle?

Fortune 1000s host bots in the perimeter

The Power of One eBook: Top reasons to choose HP BladeSystem

Exclusive When it comes to bot-infested PCs that spew spam, most of us assume the owners are newbie users too naive or careless to follow basic security measures. Think again. There's a good chance that the penis enlargement email that just landed in your inbox is from a network maintained by Oracle, Hewlett-Packard or some other Fortune 1000 company.

We've been poring over data collected by Support Intelligence, a firm that uses spam traps and other methods to trace the locations of infected computers. Over two weeks in mid-February, it assembled evidence that computers connected to the networks of at least 28 large organizations sent unsolicited email.

These emails ran the spam gamut, from pump-and-dump scams to come-ons for Viagra. One appearing to come from Oracle tried to phish recipients' PayPal credentials. HP was also on the list. Best Buy, the giant electronics retailer, took the prize, having sent out more than 5,000 spams. To its credit, Best Buy acknowledged the spam problem after we brought it to the company's attention.

"We are repairing it as we speak, and we we're mortified," spokeswoman Paula Baldwin told us after IT administrators confirmed the Support-Intelligence findings. "We had no idea of the severity. We owe you our deepest gratitude."

Other companies we contacted were significantly more opaque. Both HP and Oracle declined to comment, refusing even to say if the data we provided was forwarded to security personnel in the companies' IT departments. Support Intelligence counted a little under 100 spams appearing to come from HP's network and about 10 from Oracle's.

Support Intelligence isn't the only firm to implicate the business world in the malware scourge. Webroot released a study today reporting that of 600 global businesses surveyed, 43 per cent suffered disruptions because of malware infections. Sixty percent had no information security plan.

Rick Wesson, CEO of Support Intelligence, has worked tirelessly to alert companies that his data strongly suggests spam is being sent from their networks. For the most part, company representatives in the front office are of little help in referring Wesson to the CISOs (chief information security officers) responsible. (He has also brought evidence of thousands of compromised credit card accounts to the attention of bank and law enforcement officials, but frequently gets no response.)

Of course, spammers go to great lengths to cloak the identities of the computers they've worked so hard to infect. To circumvent these obfuscation measures, the Support Intelligence spam trap hosts more than 10,000 domains and monitors and records the IP address of each server that hands off the spam to the server being monitored.

Throughout this article, we say the spam "appears" to originate from these companies' networks because Wesson acknowledges some false positives are inevitable when working with the volume of data he collects. Indeed, one suspicious email we forwarded to a large software company turned out to be a legitimate email testing a new advertising system. (The company shut it down after learning the emails were unintentionally appearing in inboxes not included in the pilot program.)

But there is reason to believe the results are generally accurate. In addition to Best Buy's confession, we received a validation from one the biggest technology companies in Silicon Valley. After receiving Support Intelligence data, a spokesman for the company confirmed spam had been sent from its network, but said the network was separate from its employee system and was reserved for use by partners and customers who wanted internet access during visits.

We also turned to Randal Vaughn, a professor of information systems at Baylor University and a specialist in tracking and shutting down sources of spam. He said the data "implies the mail does indeed correspond to internal generation [from the companies] and indicates bot infections inside the perimeter. This is not at all a warm fuzzy feeling about the state of internet security."

Wesson concurs. "If all these Fortune 1000 companies can have bots running on their systems," he says, "what do you think is happening to government [systems] in Kansas and Mississippi?" ®

Designing a Defense for Mobile Applications

More from The Register

next story
DARPA-derived secure microkernel goes open source tomorrow
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.