Feeds

Ruggedised botnets pushing out even more spam

Future rogue ISP takedowns unlikely to bring relief

Secure remote control for conventional and virtual desktops

Cybercrooks have adapted to the takedown of rogue ISPs by building more resilient botnets.

An annual security survey by MessageLabs found that the already high level of spam reached 87.7 per cent of email traffic during 2009, with highs and lows of 90.4 percent in May and 73.3 percent in February respectively. Junk volumes increased still further compared to the 81.2 per cent spam rate recorded by MessageLabs in 2008.

Compromised (zombie) machines accounted for more than four in five (83.4 per cent) of an estimated global volume of 107 billion junk mail messages sent out every day during 2009.

The shutdown of botnet-hosting ISPs - such as McColo in late 2008 and Real Host in August 2009 - has forced hackers to re-engineer botnets so that the reins of command and control system can be picked up within hours, instead of the weeks of confusion that followed the McColo shutdown.

Paul Wood, MessageLabs Intelligence senior analyst at Symantec, explained: "Hackers have re-engineered malware to make it less vulnerable to disruption. Trojans used to be hard coded with an IP address but now they use domain name rotate using fast flux to calculate next domain or P2P techniques. As a result command and control channels are now more resilient."

MessageLabs, a web and email filtering service owned by Symantec since last year, reports that 10 heavyweight botnets (including Cutwail, Rustock and Mega-D) control a combined zombie hoard of at least five million compromised computers. Cutwail was the worst of he bunch and blamed by MessageLabs for 29 percent of all spam or 8,500 billion junk mail messages between April and November 2009.

The global credit crisis, world events and news stories provided the themes of many junk mail runs and malware attacks during 2009. Malware writers were quick to seize on interest generated by the swine flu epidemic and deaths of celebrities, including singer Michael Jackson and actor Patrick Swayze, for example.

Cutwail was also used to send out spam email contaminated with infected attachments carrying the Bredolab Trojan dropper, disguised as an innocuous ZIP file. Machines infected with Bredolab were used to run botnet agents or spyware on compromised machines. Spam runs punting Bredolab-infected messages rose steadily throughout 2009 to reach an October peak of 3.6 billion Bredolab contaminated emails.

However the average virus in email level dropped to one in 286.4 emails (0.35 percent) this year, compared to one in 143.8 emails (0.70 percent) last year. MessageLabs explains the decline by suggesting that virus writers are churning out a greater number of malware variants, but using smaller virus-contaminated spam runs with each strain.

MessageLabs stopped more than 21 million different types of spam campaigns in 2009, more than twice the number recorded in 2008. It also logged a 23 per cent increase in malware variants between 2008 and 2009. MessageLabs analysts blame the wider availability of malware creation toolkits for the increase.

The infamous Conficker worm haunted the threat landscape during 2009. An estimated six million machines are infected by the malware. However this vast cybercrime resource has remained dormant throughout the year, possibly because the hackers who created it were far more successful than they originally intended and know anything they do with the uber-botnet now is likely to bring a great deal of unwelcome attention.

During 2009 the average number of new malicious websites blocked each day by MessageLabs rose to 2,465, compared to 2,290 for 2008, an increase of 7.6 per cent. However, four in five of the web threats blocked by MessageLabs came from malicious code planted on legitimate domains, rather than new domains set up purely to sling malware. The volume of phishing attacks blocked by MessageLabs was one in 325.2 (0.31 percent) emails for 2009 so far, compared to one in 244.9 (0.41) in 2008.

More details on the malware and spam landscape can be found in MessageLabs annual report here. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
How to determine if cloud backup is right for your servers
Two key factors, technical feasibility and TCO economics, that backup and IT operations managers should consider when assessing cloud backup.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.