Feeds

Net provider accused of coddling crooks yanked offline

Spam volumes plummet

  • alert
  • submit to reddit

The Essential Guide to IT Transformation

Yet another network provider has been yanked offline after being accused by security researchers of acting as the mothership that allowed a large percentage of the world's spam operators and malicious networks to thrive.

Upstream service to US-based McColo Corporation was terminated sometime Tuesday, according to researchers from Arbor Networks, which monitors internet traffic, and other firms. Hurricane Electric, one of McColo's upstream providers, told Brian Krebs's Security Fix blog it cut off service after it was presented with evidence demonstrating the magnitude of nuisance its customer represented.

Representatives of McColo didn't return a phone call seeking comment.

According to a host of independent security experts, McColo represented a key link in a notorious chain of other network providers that catered to spammers, botnet operators and malware purveyors. Some researchers claimed McColo provided the connectivity that was responsible for more than half the world's spam. McColo's dissolution was immediately followed by a marked decrease in spam and botnet activity, they said.

"In our own database we have been tracking a few dozen botnets that phoned home to McColo IPs as well as nearly 1000 distinct URLs from hundreds of different malcode samples, Arbor's Jose Nazario wrote here. "These guys ran a dirty operation.

Statistics from SpamCop showed a drop in the amount of spam being blasted out to the world. Starting Tuesday afternoon, spam volumes dropped from about 30 junk messages being sent every second to less than 15 at time of writing.

"When McColo went off the net yesterday we saw a very dramatic fall-off of botnet activity on the internet as the 'command and control' servers for many botnets were on McColo," Spamhaus chief executive Steve Linford wrote in an email.

The take-down of McColo comes two months after Intercage, another network provider with a sullied reputation, was disconnected by its last remaining transit providers. The termination created a brief decline in spam and malicious net activity, but most of the bad actors that used Intercage have since found new providers, researchers have said.

McColo's demise came as a new report (PDF) claimed the provider enables a host of bad actors on the internet. In addition to spammers and botnet operators, at least 40 websites, nameservers or payment services used for child pornography were also recently found to be hosted by McColo, according to the report.

Even with the termination by Hurricane Electric, a second provider, Global Crossing, continued to provide connectivity to McColo, according to the CyberCrime and Doing Time blog. So far, Global Crossing's public relations reps have been vague about their plans for McColo, saying only that Global Crossing cooperates with law enforcement, their peers and security researchers to weed out bad actors.

Whatever the case, it would appear that McColo has been almost completely severed from the internet. With the exception of two netblocks (one is a /21 and the other a /22) all others are missing. Domain names with suspicious sounding names including teenincestpics dot com and Canadianpharmacycorp4 dot com - which had once relied on McColo's IP space to connect - were no longer resolving. ®

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
iWallet: No BONKING PLEASE, we're Apple
BLE-ding iPhones, not NFC bonkers, will drive trend - marketeers
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
Multipath TCP speeds up the internet so much that security breaks
Black Hat research says proposed protocol will bork network probes, flummox firewalls
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Fiendishly complex password app extension ships for iOS 8
Just slip it in, won't hurt a bit, 1Password makers urge devs
Tor attack nodes RIPPED MASKS off users for 6 MONTHS
Traffic confirmation attack bared users' privates - but to whom?
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Maximize storage efficiency across the enterprise
The HP StoreOnce backup solution offers highly flexible, centrally managed, and highly efficient data protection for any enterprise.