Feeds

Ruggedised botnets pushing out even more spam

Future rogue ISP takedowns unlikely to bring relief

The Power of One eBook: Top reasons to choose HP BladeSystem

Cybercrooks have adapted to the takedown of rogue ISPs by building more resilient botnets.

An annual security survey by MessageLabs found that the already high level of spam reached 87.7 per cent of email traffic during 2009, with highs and lows of 90.4 percent in May and 73.3 percent in February respectively. Junk volumes increased still further compared to the 81.2 per cent spam rate recorded by MessageLabs in 2008.

Compromised (zombie) machines accounted for more than four in five (83.4 per cent) of an estimated global volume of 107 billion junk mail messages sent out every day during 2009.

The shutdown of botnet-hosting ISPs - such as McColo in late 2008 and Real Host in August 2009 - has forced hackers to re-engineer botnets so that the reins of command and control system can be picked up within hours, instead of the weeks of confusion that followed the McColo shutdown.

Paul Wood, MessageLabs Intelligence senior analyst at Symantec, explained: "Hackers have re-engineered malware to make it less vulnerable to disruption. Trojans used to be hard coded with an IP address but now they use domain name rotate using fast flux to calculate next domain or P2P techniques. As a result command and control channels are now more resilient."

MessageLabs, a web and email filtering service owned by Symantec since last year, reports that 10 heavyweight botnets (including Cutwail, Rustock and Mega-D) control a combined zombie hoard of at least five million compromised computers. Cutwail was the worst of he bunch and blamed by MessageLabs for 29 percent of all spam or 8,500 billion junk mail messages between April and November 2009.

The global credit crisis, world events and news stories provided the themes of many junk mail runs and malware attacks during 2009. Malware writers were quick to seize on interest generated by the swine flu epidemic and deaths of celebrities, including singer Michael Jackson and actor Patrick Swayze, for example.

Cutwail was also used to send out spam email contaminated with infected attachments carrying the Bredolab Trojan dropper, disguised as an innocuous ZIP file. Machines infected with Bredolab were used to run botnet agents or spyware on compromised machines. Spam runs punting Bredolab-infected messages rose steadily throughout 2009 to reach an October peak of 3.6 billion Bredolab contaminated emails.

However the average virus in email level dropped to one in 286.4 emails (0.35 percent) this year, compared to one in 143.8 emails (0.70 percent) last year. MessageLabs explains the decline by suggesting that virus writers are churning out a greater number of malware variants, but using smaller virus-contaminated spam runs with each strain.

MessageLabs stopped more than 21 million different types of spam campaigns in 2009, more than twice the number recorded in 2008. It also logged a 23 per cent increase in malware variants between 2008 and 2009. MessageLabs analysts blame the wider availability of malware creation toolkits for the increase.

The infamous Conficker worm haunted the threat landscape during 2009. An estimated six million machines are infected by the malware. However this vast cybercrime resource has remained dormant throughout the year, possibly because the hackers who created it were far more successful than they originally intended and know anything they do with the uber-botnet now is likely to bring a great deal of unwelcome attention.

During 2009 the average number of new malicious websites blocked each day by MessageLabs rose to 2,465, compared to 2,290 for 2008, an increase of 7.6 per cent. However, four in five of the web threats blocked by MessageLabs came from malicious code planted on legitimate domains, rather than new domains set up purely to sling malware. The volume of phishing attacks blocked by MessageLabs was one in 325.2 (0.31 percent) emails for 2009 so far, compared to one in 244.9 (0.41) in 2008.

More details on the malware and spam landscape can be found in MessageLabs annual report here. ®

The Power of One eBook: Top reasons to choose HP BladeSystem

More from The Register

next story
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
BMW's ConnectedDrive falls over, bosses blame upgrade snafu
Traffic flows up 20% as motorway middle lanes miraculously unclog
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Putin: Crack Tor for me and I'll make you a MILLIONAIRE
Russian Interior Ministry offers big pile o' roubles for busting pro-privacy browser
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.