Hackers hit where they live
MessageLabs dissects March email malware attack patterns
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
The countries of hackers originating malware-laced spam runs have been exposed by new research, which confirms they are often located thousands of miles away from the compromised systems they use to send out junk mail.
A third of targeted malware attacks sent so far in March came from the United States (36.6 per cent), based on mail server location. However, after the sender's actual location is analysed, more targeted attacks actually began in China (28.2 per cent) and Romania (21.1 per cent) than the US (13.8 percent), according to the March 2010 edition of the monthly MessageLabs security report.
Paul Wood, MessageLabs intelligence senior analyst, explained the discrepancy: “A large proportion of targeted attacks are sent from legitimate webmail accounts which are located in the US and therefore, the IP address of the sending mail server is not a useful indicator of the true origin of the attack.
"Analysis of the sender’s IP address, rather than the IP address of the email server, reveals the true source of these targeted attacks.”
Further analysis of targeted attacks shows people at the sharp end of targeted malware attacks are responsible for foreign trade and defence policy, especially in relation to Asian countries. Virus activity in Taiwan was one in 90.9 emails, making it the most targeted country for email-borne malware in March. By comparison, one in 552 emails sent to US mailboxes came laced with malware.
Meanwhile, one in 77.1 emails sent to public sector mailboxes were blocked as malicious by MessageLabs.
The worldwide ratio of email-borne viruses to regular email traffic was one in 358.3 emails (0.28 per cent) in March, an decrease of 0.05 percentage points since February. In March 16.8 percent of email-borne malware contained links to malicious websites, a big decrease of 13.7 percentage points since February.
Spam rates after connections to known black spots were taken out of the picture reached 90.7 per cent, an increase of 1.5 percentage points since February. The vast majority of these junk mail messages came from compromised malware-infested networks of zombie PCs (aka botnets) MessageLabs reports that 77 per cent of spam sent from the Rustock botnet this month used secure TLS connections.
The average additional inbound and outbound traffic due to TLS requires an overhead of around 1KB, smaller than the average size of spam emails, and putting an added strain on already pressured email servers. Spam sent using TLS accounted for approximately 20 per cent of all junk mail so far in March, peaking at 35 per cent on March 10.
“TLS is a popular way of sending email through an encrypted channel," Wood said. “However, it uses far more server resources and is much slower than plain-text email and requires both inbound and outbound traffic. The outbound traffic frequently outweighs the size of the spam message itself and can significantly tax the workload on corporate email servers.”
Stats fans can dive into a complete rundown of the email spam and malware landscape in the complete edition of the MessageLabs report here. ®
COMMENTS
How water discovered
"Analysis of the sender’s IP address, rather than the IP address of the email server, reveals the true source of these targeted attacks.”
No shit, Sherlock. I've known that since 1996, ever since Eudora allowed me to send email from my PC instead of directly sending it from the UNIX Workstations. That's why the headers usually stamp the originating SMTP server *and* the originating IP from which the email actually came from.
The thing is that it is mostly the zombie PC sending the e-mail, so even this source IP might end up being irrelevant. :(
Re: How to be sure?
>> If you have total control of a zombie and its supporting infrastructure, you can trace the commands coming in and the previous step in the chain.
Yes but that only gives you one step back in the chain. So that only tells you that the X% bots sending spam are downstream of bots in china/russia/US. I don't see how they can be certain if it is the original source, or just another bot - unless they have managed to successfully follow the chain and prosecute the spammer, however this would give misleading numbers as it is possibly easier to follow the chain in certain countries than others.
Sending mail server.
“A large proportion of targeted attacks are sent from legitimate webmail accounts....."
In these cases the IP address of the sending mail server is highly relevant. It tells us which webmail providers need to get off their fat, complacent arses and beef up their security to stem the tide of sewage flowing from their shite services.
Here's an idea. If the webmail providers' spam filters can pick up spam with very high accuracy inbound as they do, why the f*** can't they run outbound mail through the things? They could provide an O/B spam folder of things wot were blocked, giving the legitimate user the option to either flag individual items[1] as not spam or, far more likely, delete the lot and change their sodding password. They wouldn't even need to run the spam filters aggressively O/B, keeping false positives to a bare minimum, as just blocking the bleedin' obvious stuff would render this route unusable to spammers.
[1] One at a time - with authentication. We don't want anyone scripting that.
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
