Feeds

Ruggedised botnets pushing out even more spam

Future rogue ISP takedowns unlikely to bring relief

Secure remote control for conventional and virtual desktops

Cybercrooks have adapted to the takedown of rogue ISPs by building more resilient botnets.

An annual security survey by MessageLabs found that the already high level of spam reached 87.7 per cent of email traffic during 2009, with highs and lows of 90.4 percent in May and 73.3 percent in February respectively. Junk volumes increased still further compared to the 81.2 per cent spam rate recorded by MessageLabs in 2008.

Compromised (zombie) machines accounted for more than four in five (83.4 per cent) of an estimated global volume of 107 billion junk mail messages sent out every day during 2009.

The shutdown of botnet-hosting ISPs - such as McColo in late 2008 and Real Host in August 2009 - has forced hackers to re-engineer botnets so that the reins of command and control system can be picked up within hours, instead of the weeks of confusion that followed the McColo shutdown.

Paul Wood, MessageLabs Intelligence senior analyst at Symantec, explained: "Hackers have re-engineered malware to make it less vulnerable to disruption. Trojans used to be hard coded with an IP address but now they use domain name rotate using fast flux to calculate next domain or P2P techniques. As a result command and control channels are now more resilient."

MessageLabs, a web and email filtering service owned by Symantec since last year, reports that 10 heavyweight botnets (including Cutwail, Rustock and Mega-D) control a combined zombie hoard of at least five million compromised computers. Cutwail was the worst of he bunch and blamed by MessageLabs for 29 percent of all spam or 8,500 billion junk mail messages between April and November 2009.

The global credit crisis, world events and news stories provided the themes of many junk mail runs and malware attacks during 2009. Malware writers were quick to seize on interest generated by the swine flu epidemic and deaths of celebrities, including singer Michael Jackson and actor Patrick Swayze, for example.

Cutwail was also used to send out spam email contaminated with infected attachments carrying the Bredolab Trojan dropper, disguised as an innocuous ZIP file. Machines infected with Bredolab were used to run botnet agents or spyware on compromised machines. Spam runs punting Bredolab-infected messages rose steadily throughout 2009 to reach an October peak of 3.6 billion Bredolab contaminated emails.

However the average virus in email level dropped to one in 286.4 emails (0.35 percent) this year, compared to one in 143.8 emails (0.70 percent) last year. MessageLabs explains the decline by suggesting that virus writers are churning out a greater number of malware variants, but using smaller virus-contaminated spam runs with each strain.

MessageLabs stopped more than 21 million different types of spam campaigns in 2009, more than twice the number recorded in 2008. It also logged a 23 per cent increase in malware variants between 2008 and 2009. MessageLabs analysts blame the wider availability of malware creation toolkits for the increase.

The infamous Conficker worm haunted the threat landscape during 2009. An estimated six million machines are infected by the malware. However this vast cybercrime resource has remained dormant throughout the year, possibly because the hackers who created it were far more successful than they originally intended and know anything they do with the uber-botnet now is likely to bring a great deal of unwelcome attention.

During 2009 the average number of new malicious websites blocked each day by MessageLabs rose to 2,465, compared to 2,290 for 2008, an increase of 7.6 per cent. However, four in five of the web threats blocked by MessageLabs came from malicious code planted on legitimate domains, rather than new domains set up purely to sling malware. The volume of phishing attacks blocked by MessageLabs was one in 325.2 (0.31 percent) emails for 2009 so far, compared to one in 244.9 (0.41) in 2008.

More details on the malware and spam landscape can be found in MessageLabs annual report here. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Mozilla, EFF, Cisco back free-as-in-FREE-BEER SSL cert authority
Let’s Encrypt to give HTTPS-everywhere a boost in 2015
Meet OneRNG: a fully-open entropy generator for a paranoid age
Kiwis to seek random investors for crowd-funded randomiser
USB coding anarchy: Consider all sticks licked
Thumb drive design ruled by almighty buck
Attack reveals 81 percent of Tor users but admins call for calm
Cisco Netflow a handy tool for cheapskate attackers
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Choosing a cloud hosting partner with confidence
Download Choosing a Cloud Hosting Provider with Confidence to learn more about cloud computing - the new opportunities and new security challenges.
New hybrid storage solutions
Tackling data challenges through emerging hybrid storage solutions that enable optimum database performance whilst managing costs and increasingly large data stores.