Feeds

Spam net snared a quarter million bots, says conqueror

Putting the mega in Mega-D

  • alert
  • submit to reddit

Choosing a cloud hosting partner with confidence

Herders behind the Mega-D botnet may have corralled nearly a quarter million infected machines into their spam-churning enterprise before it was recently crippled by white hat hackers.

The botnet, which was once responsible for an estimated third of the world's spam output, was knocked out of commission last week by employees of security firm FireEye. After unplugging the Mega-D master control channels, the researchers set up a benign "sinkhole" channel for the bots to report to and waited to see what would happen.

Over five days, 487,340 unique IP addresses reported to the ad-hoc server. Using findings derived from last year's take-down of the separate Srizbi botnet, FireEye estimates that the figure translates to 248,590 unique machines. Unlike Mega-D, Srizbi included an accounting mechanism that identified each infected machine. They then analyzed the number of IP addresses and noted that after five days, it was about double the number of individual Srizbi victims.

"Any botnet size estimate should be taken with a grain of salt as they are notoriously hard to calculate and there is a lot of conflicting data out there," FireEye's Todd Rosenberry cautions.

Based on the IP addresses, the researchers also estimated that Brazil is most infected country, accounting for 11.5 percent of the victims, followed closely by India and Viet Nam. In all, 214 countries were represented.

FireEye said that it is continuing to monitor Mega-D but plans to turn over maintenance of the sinkhole to Shadowserver. The volunteer crew has an established infrastructure and relationships with ISPs and various Computer Emergency Response Teams, or CERTS, around the world. ®

Choosing a cloud hosting partner with confidence

Whitepapers

Go beyond APM with real-time IT operations analytics
How IT operations teams can harness the wealth of wire data already flowing through their environment for real-time operational intelligence.
Why CIOs should rethink endpoint data protection in the age of mobility
Assessing trends in data protection, specifically with respect to mobile devices, BYOD, and remote employees.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Protecting against web application threats using SSL
SSL encryption can protect server‐to‐server communications, client devices, cloud resources, and other endpoints in order to help prevent the risk of data loss and losing customer trust.