Feeds

So who sent you that spam? HP or Oracle?

Fortune 1000s host bots in the perimeter

Boost IT visibility and business value

Exclusive When it comes to bot-infested PCs that spew spam, most of us assume the owners are newbie users too naive or careless to follow basic security measures. Think again. There's a good chance that the penis enlargement email that just landed in your inbox is from a network maintained by Oracle, Hewlett-Packard or some other Fortune 1000 company.

We've been poring over data collected by Support Intelligence, a firm that uses spam traps and other methods to trace the locations of infected computers. Over two weeks in mid-February, it assembled evidence that computers connected to the networks of at least 28 large organizations sent unsolicited email.

These emails ran the spam gamut, from pump-and-dump scams to come-ons for Viagra. One appearing to come from Oracle tried to phish recipients' PayPal credentials. HP was also on the list. Best Buy, the giant electronics retailer, took the prize, having sent out more than 5,000 spams. To its credit, Best Buy acknowledged the spam problem after we brought it to the company's attention.

"We are repairing it as we speak, and we we're mortified," spokeswoman Paula Baldwin told us after IT administrators confirmed the Support-Intelligence findings. "We had no idea of the severity. We owe you our deepest gratitude."

Other companies we contacted were significantly more opaque. Both HP and Oracle declined to comment, refusing even to say if the data we provided was forwarded to security personnel in the companies' IT departments. Support Intelligence counted a little under 100 spams appearing to come from HP's network and about 10 from Oracle's.

Support Intelligence isn't the only firm to implicate the business world in the malware scourge. Webroot released a study today reporting that of 600 global businesses surveyed, 43 per cent suffered disruptions because of malware infections. Sixty percent had no information security plan.

Rick Wesson, CEO of Support Intelligence, has worked tirelessly to alert companies that his data strongly suggests spam is being sent from their networks. For the most part, company representatives in the front office are of little help in referring Wesson to the CISOs (chief information security officers) responsible. (He has also brought evidence of thousands of compromised credit card accounts to the attention of bank and law enforcement officials, but frequently gets no response.)

Of course, spammers go to great lengths to cloak the identities of the computers they've worked so hard to infect. To circumvent these obfuscation measures, the Support Intelligence spam trap hosts more than 10,000 domains and monitors and records the IP address of each server that hands off the spam to the server being monitored.

Throughout this article, we say the spam "appears" to originate from these companies' networks because Wesson acknowledges some false positives are inevitable when working with the volume of data he collects. Indeed, one suspicious email we forwarded to a large software company turned out to be a legitimate email testing a new advertising system. (The company shut it down after learning the emails were unintentionally appearing in inboxes not included in the pilot program.)

But there is reason to believe the results are generally accurate. In addition to Best Buy's confession, we received a validation from one the biggest technology companies in Silicon Valley. After receiving Support Intelligence data, a spokesman for the company confirmed spam had been sent from its network, but said the network was separate from its employee system and was reserved for use by partners and customers who wanted internet access during visits.

We also turned to Randal Vaughn, a professor of information systems at Baylor University and a specialist in tracking and shutting down sources of spam. He said the data "implies the mail does indeed correspond to internal generation [from the companies] and indicates bot infections inside the perimeter. This is not at all a warm fuzzy feeling about the state of internet security."

Wesson concurs. "If all these Fortune 1000 companies can have bots running on their systems," he says, "what do you think is happening to government [systems] in Kansas and Mississippi?" ®

Gartner critical capabilities for enterprise endpoint backup

More from The Register

next story
Microsoft: We plan to CLEAN UP this here Windows Store town
Paid-for apps that provide free downloads? Really
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
Who needs hackers? 'Password1' opens a third of all biz doors
GPU-powered pen test yields more bad news about defences and passwords
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Hear ye, young cyber warriors of the realm: GCHQ wants you
Get involved, get a job and then never discuss work ever again
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
7 Elements of Radically Simple OS Migration
Avoid the typical headaches of OS migration during your next project by learning about 7 elements of radically simple OS migration.
BYOD's dark side: Data protection
An endpoint data protection solution that adds value to the user and the organization so it can protect itself from data loss as well as leverage corporate data.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?