Most spam comes from just six botnets
Diary of the Dead
Agentless Backup is Not a Myth
Six botnets are responsible for 85 per cent of all spam, according to an analysis by net security firm Marshal.
The Srizbi botnet is reckoned to be the largest single source of spam - accounting for 39 per cent of junk mail messages – followed by the Rustock botnet, responsible for 21 per cent of the spam clogging up users' inboxes.
Spam emanating from the Mega-D botnet, which Marshal reckons was the leading source of junk mail in early February, was temporarily stemmed after control servers were taken out in mid-February. The estimated 35,000 zombie clients associated with the Mega-D botnet were infected with the Ozdok Trojan.
After 10 days of inactivity, spam from compromised hosts began flowing again earlier this week, after hackers re-established control. Despite the break in transmission, Spam-D accounted for an estimated 11 per cent of junk mail hitting Marshal's spam traps during February.
Other active spam botnets include Hacktool.Spammer (AKA Spam-Mailer) and botnets associated with the Pushdo (AKA Pandex) family of malware.
The notorious Storm botnet, estimated to include about 85,000 compromised hosts, is thought to be responsible for only three per cent of spam.
"The size of a botnet, measured by how many bots it has, does not necessarily correlate with how much spam it sends. Our team has observed huge variations in the rate at which different spambots pump out spam," said Bradley Anstis, VP of products at Marshal.
In many instance, spammers have access to multiple botnets. In addition to Mega-D, other botnets - including Srizbi, Rustock, Hacktool.Spammer and Pushdo - have been simultaneously sending spam promoting Express Herbals, a line of male enhancement pills.
According to February statistics from managed security firm Network Box, the US continued to pump out the most spam and spread the most viruses. The country accounted for 13 per cent of all viruses; and was the source of 15 per cent of all spam, more than double its closest junk mail rival, Turkey. ®
COMMENTS
@stizzleswick
"Currently, bogus mail accounts are all the rage at mail providers like Google, MSN, Yahoo!... And no, those mail providers don't give a crap who their customers are; they just set up the boxes and let nature run its course until somebody threatens legal action because of the flood of spam coming from their servers."
These bogus accounts are accesses using webmail clients - you submit the email from a browser. Spammers do not submit spam this way - they use SMTP clients on a zombie. If you kill the ability to do this, as in my suggestion, spam ceases immediately.
"Malware does indeed come with an SMTP client (not server)."
"Yes, actually there are several strains out there that have their own server (not client)."
SMTP servers are used to receive email - somehow I don't think that's what spammers are in the business of doing !
@Graham Bartlett
Actually the level of potential damage is essentially irrelevant. You are legally responsible for ensuring, by taking all reasonable precautions, that your property does not cause damage to another's. Spewing spam might not constitute harm/damage, but virtually any other use to which a compromised machine might be put certainly is. I don't believe anyone has been prosecuted for owning a zombie machine, but there is no legal reason AFAIK why someone couldn't be.
re: users shooting themselves.
Theoretically, PC vendors too, could find themselves in legal hot water under fitness for purpose and merchantability laws, inasmuch that a PC out of the box is very rarely in any fit state to be safely connected to the net.
If they are selling an out of the box experience, as they essentially do, often claiming that as a selling point, then the product they are selling should come pre-configured with all appropriate services enabled/disabled, a randomly generated admin password, at least one user account, also password protected. OS patches, Basic anti-malware (I believe most motherboards come with such software and a 6/12 month "first taste is free" license on the driver disk anyway) installed, activated and within a week or so of being up to date. And as suggested in comments on an article about vulnerable routers, they too should have more robust passwords (serial number was suggested) by default.
All of this would cost very little to implement, once a week the vendor would have to spend a few minutes bringing their install image up to date, and a few minutes on final configuration before each box went out the door. A few dollars per machine at most.
And having taken all reasonable precautions, the vendor is off the hook legally.
All future responsibility then devolves as it properly does to the buyer.
Repairable ignorance alone should never be a defense or an excuse.
@Chinas part in the spam industry
It's not really so odd if you've ever worked in a Chinese office. Most Chinese are pretty clueless about malware - every home computer, 'net cafe computer and even many major organisations are riddled with it. When it comes to the internet the majority of Chinese have almost child-like trust of what they find. So most computers have download managers, password managers, cute little desktop games, funny icons and all the other standard vectors for malware.
That's fine for home users - home PCs aren't switched on as much as they are in the West. Problem is that most Chinese companies exhibit the same child-like innocence, so few have even the most basic policy in place for controlling their workforce's habits. Result is that staff happily spend large chunks of the day on QQ and other social sites, happily downloading cute little desktop games, funny icons, etc all to their work PCs.
Certainly there are spam/bot controllers there - it has to be in Chinese language after all but they're helped by universal ignorance in the rest of the country.
IT infrastructure monitoring strategies
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
Data control in the cloud
Cloud based data management
Agentless Backup is Not a Myth
