Feeds

So who sent you that spam? HP or Oracle?

Fortune 1000s host bots in the perimeter

Top 5 reasons to deploy VMware with Tegile

Exclusive When it comes to bot-infested PCs that spew spam, most of us assume the owners are newbie users too naive or careless to follow basic security measures. Think again. There's a good chance that the penis enlargement email that just landed in your inbox is from a network maintained by Oracle, Hewlett-Packard or some other Fortune 1000 company.

We've been poring over data collected by Support Intelligence, a firm that uses spam traps and other methods to trace the locations of infected computers. Over two weeks in mid-February, it assembled evidence that computers connected to the networks of at least 28 large organizations sent unsolicited email.

These emails ran the spam gamut, from pump-and-dump scams to come-ons for Viagra. One appearing to come from Oracle tried to phish recipients' PayPal credentials. HP was also on the list. Best Buy, the giant electronics retailer, took the prize, having sent out more than 5,000 spams. To its credit, Best Buy acknowledged the spam problem after we brought it to the company's attention.

"We are repairing it as we speak, and we we're mortified," spokeswoman Paula Baldwin told us after IT administrators confirmed the Support-Intelligence findings. "We had no idea of the severity. We owe you our deepest gratitude."

Other companies we contacted were significantly more opaque. Both HP and Oracle declined to comment, refusing even to say if the data we provided was forwarded to security personnel in the companies' IT departments. Support Intelligence counted a little under 100 spams appearing to come from HP's network and about 10 from Oracle's.

Support Intelligence isn't the only firm to implicate the business world in the malware scourge. Webroot released a study today reporting that of 600 global businesses surveyed, 43 per cent suffered disruptions because of malware infections. Sixty percent had no information security plan.

Rick Wesson, CEO of Support Intelligence, has worked tirelessly to alert companies that his data strongly suggests spam is being sent from their networks. For the most part, company representatives in the front office are of little help in referring Wesson to the CISOs (chief information security officers) responsible. (He has also brought evidence of thousands of compromised credit card accounts to the attention of bank and law enforcement officials, but frequently gets no response.)

Of course, spammers go to great lengths to cloak the identities of the computers they've worked so hard to infect. To circumvent these obfuscation measures, the Support Intelligence spam trap hosts more than 10,000 domains and monitors and records the IP address of each server that hands off the spam to the server being monitored.

Throughout this article, we say the spam "appears" to originate from these companies' networks because Wesson acknowledges some false positives are inevitable when working with the volume of data he collects. Indeed, one suspicious email we forwarded to a large software company turned out to be a legitimate email testing a new advertising system. (The company shut it down after learning the emails were unintentionally appearing in inboxes not included in the pilot program.)

But there is reason to believe the results are generally accurate. In addition to Best Buy's confession, we received a validation from one the biggest technology companies in Silicon Valley. After receiving Support Intelligence data, a spokesman for the company confirmed spam had been sent from its network, but said the network was separate from its employee system and was reserved for use by partners and customers who wanted internet access during visits.

We also turned to Randal Vaughn, a professor of information systems at Baylor University and a specialist in tracking and shutting down sources of spam. He said the data "implies the mail does indeed correspond to internal generation [from the companies] and indicates bot infections inside the perimeter. This is not at all a warm fuzzy feeling about the state of internet security."

Wesson concurs. "If all these Fortune 1000 companies can have bots running on their systems," he says, "what do you think is happening to government [systems] in Kansas and Mississippi?" ®

Internet Security Threat Report 2014

More from The Register

next story
'Kim Kardashian snaps naked selfies with a BLACKBERRY'. *Twitterati gasps*
More alleged private, nude celeb pics appear online
Home Depot ignored staff warnings of security fail laundry list
'Just use cash', former security staffer warns friends
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
Freenode IRC users told to change passwords after securo-breach
Miscreants probably got in, you guys know the drill by now
THREE QUARTERS of Android mobes open to web page spy bug
Metasploit module gobbles KitKat SOP slop
BitTorrent's peer-to-peer chat app Bleep goes live as public alpha
A good day for privacy as invisble.im also reveals its approach to untraceable chats
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.