Undead botnets blamed for big rise in email malware
Grave concern over reanimated cyber-corpses
Malicious spam volumes increased dramatically in the back half of 2009, reaching three billion messages per day, compared to 600 million messages per day in the first half of 2009. But this is still a tiny fraction of the estimated global spam volume, thought to be about 200 billion messages per day.
A new report by net security firm M86 Security points the finger of blame for the torrent of malware, phishing and other scams (collectively defined as malicious spam) and junk mail more generally towards botnet networks of compromised machines. It reckons five botnets were responsible for 78 per cent of the malicious spam it fought in the second half of 2009.
M86 reports that the major spam botnets such as Rustock, Pushdo (or Cutwail) and Mega-D continue to dominate spam output, supported by second-tier botnets such as Grum, and Lethic. Rustock alone pushed out 34 per cent of spam in 2H09. Pushdo zombie drones puked out one in five spam messages (20 per cent), with Mega-D zombies account for 9 per cent of the global junk mail nuisance.
Just like Mega-D before it, the Lethic botnet has returned from the grave since it was decapitated by the combined efforts of security firms and ISPs in early January, a sign that criminal hackers are building more resilient systems with better "disaster recovery" features.
"The spamming botnets are constantly in flux, waxing and waning, morphing, becoming obsolete, being replaced, taken down, and upgraded," M86 explains. "It is important to identify the major contributors to the volume of spam, so the industry can take action against them, such as the botnet takedowns that have already occurred."
In related news, Symantec warned on Wednesday about a new targeted email attack designed to seed agents of the Cutwail botnet on corporate systems.
Botnet clients offer a handy tool for information stealing and launching denial of service attacks, as well as distributing spam. A recent study by net security firm Damballa ranks the ten worst botnets by number of infections within enterprise networks.
This survey rates the infamous ZeuS spyware agent as the greatest menace to corporate security, with the Koobface worm, which spreads via messages on social networks, a close second. ®
Community tools against spammers
I say we need to give the spammers a haircut--just below their chins. Key is that the number of suckers stupid enough to send money is MUCH smaller than the number of people who hate spam. Let us leverage large group B against small group A--and the spammers can't protect group A because they are humans and need to read the spam before they can act stupidly.
We need something like SpamCop on steroids. More iterations, more analysis, more confirmations--but we have a large surplus of people who hate spam enough to donate a bit of time to hurt the spammers. We don't need everyone, but if only 5% of the people sometimes feel like being good Samaritans, it will inundate the fools.
The targets? Right now, the main one should be the websites or phone numbers that the spammers use to harvest suckers. We can't get them all, but we can surely reduce their profitability, and at least some of the spammers will start looking for new rocks to crawl under.
Not that hard, surely?
User is kicked off ISP.
User gets sent letter stating why and offering services from the ISP to clean the machine (user to be charged a fee) or the user can take the PC to some kind of accredited repair engineer (if such things exist) or even clean it themselves (doubtful they'd have the skills though, seeing as they got infected in the first place). It's probably going to be a full re-install anyway.
Once cleaned and secured, user is allowed back on-line.
If the machine gets struck again the user has to get it re-cleaned. Maybe demand that they pass the "internet driving license" or whatever.
Get struck a third time and the user is black-balled. They now need a new ISP.
I've asked before...
...how hard is it for ISPs to simply block the drone PCs?
And if an ISP refuses to respond, you block the entire ISP.
Kick them off the net, it's the only way.