Regcast training : Hyper-V 3.0, VM high availability and disaster recovery

Cybercrooks have adapted to the takedown of rogue ISPs by building more resilient botnets.

An annual security survey by MessageLabs found that the already high level of spam reached 87.7 per cent of email traffic during 2009, with highs and lows of 90.4 percent in May and 73.3 percent in February respectively. Junk volumes increased still further compared to the 81.2 per cent spam rate recorded by MessageLabs in 2008.

The shutdown of botnet-hosting ISPs - such as McColo in late 2008 and Real Host in August 2009 - has forced hackers to re-engineer botnets so that the reins of command and control system can be picked up within hours, instead of the weeks of confusion that followed the McColo shutdown.

Paul Wood, MessageLabs Intelligence senior analyst at Symantec, explained: "Hackers have re-engineered malware to make it less vulnerable to disruption. Trojans used to be hard coded with an IP address but now they use domain name rotate using fast flux to calculate next domain or P2P techniques. As a result command and control channels are now more resilient."

MessageLabs, a web and email filtering service owned by Symantec since last year, reports that 10 heavyweight botnets (including Cutwail, Rustock and Mega-D) control a combined zombie hoard of at least five million compromised computers. Cutwail was the worst of he bunch and blamed by MessageLabs for 29 percent of all spam or 8,500 billion junk mail messages between April and November 2009.

The global credit crisis, world events and news stories provided the themes of many junk mail runs and malware attacks during 2009. Malware writers were quick to seize on interest generated by the swine flu epidemic and deaths of celebrities, including singer Michael Jackson and actor Patrick Swayze, for example.

Cutwail was also used to send out spam email contaminated with infected attachments carrying the Bredolab Trojan dropper, disguised as an innocuous ZIP file. Machines infected with Bredolab were used to run botnet agents or spyware on compromised machines. Spam runs punting Bredolab-infected messages rose steadily throughout 2009 to reach an October peak of 3.6 billion Bredolab contaminated emails.

However the average virus in email level dropped to one in 286.4 emails (0.35 percent) this year, compared to one in 143.8 emails (0.70 percent) last year. MessageLabs explains the decline by suggesting that virus writers are churning out a greater number of malware variants, but using smaller virus-contaminated spam runs with each strain.

MessageLabs stopped more than 21 million different types of spam campaigns in 2009, more than twice the number recorded in 2008. It also logged a 23 per cent increase in malware variants between 2008 and 2009. MessageLabs analysts blame the wider availability of malware creation toolkits for the increase.

The infamous Conficker worm haunted the threat landscape during 2009. An estimated six million machines are infected by the malware. However this vast cybercrime resource has remained dormant throughout the year, possibly because the hackers who created it were far more successful than they originally intended and know anything they do with the uber-botnet now is likely to bring a great deal of unwelcome attention.

During 2009 the average number of new malicious websites blocked each day by MessageLabs rose to 2,465, compared to 2,290 for 2008, an increase of 7.6 per cent. However, four in five of the web threats blocked by MessageLabs came from malicious code planted on legitimate domains, rather than new domains set up purely to sling malware. The volume of phishing attacks blocked by MessageLabs was one in 325.2 (0.31 percent) emails for 2009 so far, compared to one in 244.9 (0.41) in 2008.

More details on the malware and spam landscape can be found in MessageLabs annual report here. ®

Agentless Backup is Not a Myth