Slashdot Log In
Deconstructing a Pump-and-Dump Spam Botnet
Posted by
Zonk
on Fri Nov 17, 2006 10:12 AM
from the gaah-scary-graphics dept.
from the gaah-scary-graphics dept.
Behind the Front writes "eWeek has teamed up with Joe Stewart, a senior security researcher at SecureWorks in Atlanta, to show the inner working of a massive botnet that is responsible for the recent surge of 'pump and dump' spam. It's a detailed picture of how these sleazy operations work and why they're so hard to shut down. Sobering numbers: 70,000 infected machines capable of pumping out a billion messages a day, virtually all of them for penis enlargement and stock scams. Excellent graphics, too, including one chart that shows that Windows XP Service Pack 2 is hosting nearly half the attacked machines."
Related Stories
[+]
Is the Botnet Battle Already Lost? 374 comments
An anonymous reader writes "Researchers are finding it practically futile to keep up with evolving botnet attacks. 'We've known about [the threat from] botnets for a few years, but we're only now figuring out how they really work, and I'm afraid we might be two to three years behind in terms of response mechanisms,' said Marcus Sachs, a deputy director in the Computer Science Laboratory of SRI International, in Arlington, Va. There is a general feeling of hopelessness as botnet hunters discover that, after years of mitigating command and controls, the effort has largely gone to waste. 'We've managed to hold back the tide, but, for the most part, it's been useless,' said Gadi Evron, a security evangelist at Beyond Security, in Netanya, Israel, and a leader in the botnet-hunting community. 'When we disable a command-and-control server, the botnet is immediately re-created on another host. We're not hurting them anymore.' There is an interesting image gallery of a botnet in action as discovered by security researcher Sunbelt Software."
[+]
25 Percent of All Computers in a Botnet? 408 comments
Beckham's_Ponytail writes to mention an Ars Technica article, with some disturbing news out of the World Economic Forum in Davos, Switzerland. Vint Cerf, one of the 'fathers of the internet', has stated that the number of botnets online is larger than believed. So large, in fact, that he estimates that at this point one in four computers is infected with botnet software. We've discussed the rise of botnets numerous times here on Slashot, but the image of 150 million infected computers is more than a little bit sobering. With the extremely lucrative activities that can be done with botnets (such as password ripping, spamming, DDoSing), as well as reports of organized crime adopting 'cyber-terrorism' as a new line of income, is it likely that law enforcement will ever be able to curb this particular bane?
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Filter (Score:4, Insightful)
you are missing the point (Score:3, Insightful)
Re:Filter (Score:5, Insightful)
As Heinlein said, the answer to any question beginning with "Why don't they..." is "money". Presumably the ISPs figure you'll just take your business and your bot-infested computer elsewhere. But maybe if a few major ISPs got together and agreed to all do it, they'd cut off enough spam to make their customer bases happier, and attract back those customers who gave up in frustration.
Parent
Re: (Score:3, Interesting)
Re: (Score:3, Interesting)
You're better off trying to force rate limit outgoing email, keep state on your clients, and trying to cut off outgoing SMTP for abusive hosts. However, you would then be monitoring traffic, and that
Re:Filter (Score:4, Insightful)
Parent
outbound email only on request (Score:3, Interesting)
I'd have a web-page for my customers so they can click things such as:
Outgoing Email:
[x] web based [turn on port 80/443]
[x] through remote-login [turn on remote-login ports]
[x] through us [turn on mail ports, restrict to our servers]
[ ] through another server: ______ (specify list of outgoing mail servers
Re: (Score:3, Funny)
Hasn't worked for me (Score:3, Funny)
Fortunately, I should have significantly more money to invest shortly, as soon as I get a rather large sum from a new online friend and business associate and new friend, Mr. Emmanuel Obi from Africa, of all places.
Re: (Score:3, Interesting)
Shorting won't work... (Score:4, Informative)
Parent
Re: (Score:3, Insightful)
Re:Filter (Score:5, Insightful)
I thought I paid for IP access. Deliberate port blocking by my ISP is blocking services I pay for.
IP access means IP access, it does mean port 80 web surfing only. Any steps toward that are plain wrong.
I agree it is a wild world out there but it is a problem of weak clients. The service provider should be blind unless a client is affecting network performance beyond their paid for slice. Then the client should be totally blocked.
Parent
Re: (Score:3, Informative)
Re:Filter (Score:4, Interesting)
Something similar would work fine. Block port 25 to SMTP by default and have a web config utility to change it. If you really wanted, you could set it up to email the user if they tried accessing port 25 when it was blocked ("You might be trying to get past this firewall. Or, you might have a virus. Here's how you can find out, and here's how you can disable it if you need . . . ")
Parent
Re:Filter (Score:5, Funny)
I like that idea. Virus tries sending out 10,000 emails, user gets 10,000 emails saying "You might have a virus....".
Parent
Re:Filter (Score:4, Insightful)
Are you one of those imbeciles at Belgacom or something? Because they implemented the same cretinous strategy (without any advance warning, I may add) as you're suggesting.
Parent
Re: (Score:3, Insightful)
No, just block port 25 to all servers other than the ISPs for dynamic IP addresses.
Some ISP's do this. And this is reason I can't set up a SPF record for my domain. All my parents outgoing email would fail and their ISP (AT&T) doesn't publish any SPF records (and what if they change ISP's, something they have been talking about doing). Considering they are on dail-up, buying a static IP is out of the question. Getting AT&T to unblock them is impossible (I've tried).
Re: (Score:3, Insightful)
Infection vs Market Share (Score:4, Insightful)
Re: (Score:3, Insightful)
I think the OS X, Linux, FreeBSD "I am invulnerable because of OS I run, I don't need security updates or basic sense of security" will cause problems soon just like phishing.
That was a bad picture (Score:5, Funny)
Rebuild the email protocol (Score:5, Insightful)
Re:Rebuild the email protocol (Score:5, Funny)
(x) technical ( ) legislative ( ) market-based ( ) vigilante
approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)
( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
(x) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
( ) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business
Specifically, your plan fails to account for
( ) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
( ) Asshats
( ) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
(x) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
( ) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
( ) Extreme profitability of spam
( ) Joe jobs and/or identity theft
( ) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
( ) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook
and the following philosophical objections may also apply:
(x) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
( ) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough
Furthermore, this is what I think about you:
(x) Sorry dude, but I don't think it would work.
( ) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your
house down!
Parent
Re:Rebuild the email protocol (Score:5, Insightful)
Thank you for being a wimp.
Parent
Re:Rebuild the email protocol (Score:4, Funny)
( ) Nope, you're wrong
Parent
thats okay, but how to detect this infection? (Score:4, Insightful)
Re: (Score:3, Informative)
I'm glad I run my own mail server (Score:3, Informative)
Hit the nail right between the eyes. (Score:5, Insightful)
1. Someone comes up with a defense mechanism that works well.
2. It works so well that more people use it.
3. It becomes popular enough for the bad guys to beat, so they do.
4. The defense becomes useless, forcing someone to come up with a new defense.
5. Goto 1.
Parent
Re: (Score:3, Interesting)
eweek confirms it: Linux and Mac are dying! (Score:5, Funny)
Re: (Score:3, Funny)
Re:eweek confirms it: Linux and Mac are dying! (Score:5, Insightful)
Parent
Windows 95 (Score:4, Funny)
Parent
C'mon (Score:3, Insightful)
As a proud user of Kubuntu, I can relate to
Re:C'mon (Score:4, Insightful)
If these bots have control over 'the most secure Windows yet' [com.com], then that is worthy of note.
Mark
PS Yes, I know the link is from 2004 - but they've not released anything since, so it must still be true, right?
Parent
I'm just surprised that those spams still ... (Score:4, Insightful)
Which leads me to wonder about the folks who actually believe that those penis enlargement pills work.
And as far as the "pump and dump" spam goes, are there folks who beleive those spams? Or are they of the mindset of the "greater sucker"? Meaning, if I buy this stock now, after this spam circulates, there will be others who buy this shit stock and push up the price allowing me to make money.
Yeah, I know the guy who originates the "buy" recomendation is hoping for everyone to buy the stock, but what makes some of the recipients think they'll make out?
Re: (Score:3, Interesting)
There are plenty of idiots out there with access to both internet and credit cards. Really.
And a lot of them also think that if someone has your email, they must know you from somewhere.
When I worked at a brokerage firm, people used to call me and ask for advice (which I couldn't give, not being licensed) on how much to invest in whatever stock t
Okay, so now there are statistics..... (Score:3, Interesting)
Right now, the later is more the case. If MS had to upgrade or recall all XP products, it would cause a large harm to the economy, not just MS's bottom line. Think of what would have to be spent on the upgrades or change outs?
Too many people have invested in MS products to just shut it down, and just like England won't wake up one morning and start driving on the right side of the road, MS products will remain in service. (I'm not trying to imply that the left side is the incorrect one, just illustrating the size of the problem)
Reports like this do seem to show MS in a very bad light, but how it gets fixed will be even more interesting. When government types want to show they are doing something about spam, will they do anything to make MS responsible, or make MS fix it? Probably not, so the real answer to spam, or answers, is to implement measures that do not rely on the end user, or the end user's OS to fix it.
IMO, This means that ISP's are going to have to sandbox segments of their networks to throttle spam, and that cost will be passed on to consumers, or possibly will be borne by the ISP for bragging rights about having less spam than any other ISP, in much the same way that the Bell companies used to do advertising about what they are spending to improve services for consumers.
This also leaves me with a suspicion about the marketing team for Vista? How better to fix XP SP2 than to upgrade to Vista?
It's amazing how complex pump and dump schemes are (Score:3, Interesting)
As much as I think they are scum for doing so, you have to admit that was pretty creative....
How many of the 70,000 are elderly? (Score:3, Interesting)
I recently helped an elderly neighbor secure her computer (I was paid for this service, and I make sure I do get paid every time I get called over for help) by installing some good firewall and anti-virus programs (as well as setting up Firefox and Thunderbird for their primary browsers. When I ran a virus scan on her computer (I installed AVG, as her McAfee subscription had expired), I found several viruses and malware programs on there, all of which I removed, which came with games she downloaded (stuff like mahjong and solitaire). I regret not writing down what viruses she had gotten infected with, so I could find out what she did.
I did the same thing on my grandmother's computer as well (when she was alive), and odds are there are a lot of seniors who are online and engage in a lot of bad habits that we know are bad - including running IE with minimal protections, opening strange attachments, and so forth. This is not a new problem, and, frankly, a problem that only education (or getting 75% of seniors to switch to Mac OS or Linux) can fix.Subject (Score:4, Insightful)
Where's law enforcement on this? (Score:4, Interesting)
Those guys shouldn't be that hard to find with enough law enforcement effort. Get a credit card from a cooperating bank. Put a trace on it. Buy some Viagra from a spam. Watch where the money goes, which is probably some bank in a high-crime country. Visit the bank and talk to them. Threaten to have their abilty to process credit cards cut off. Pry the actual payee out of them. Discover that it's another intermediary and start over.
This is what we pay the FBI for. This is why the FBI has field offices outside the US. This is why the Financial Crimes Information Network [fincen.gov] exists.
The FBI's Internet-related criminal enforcement [fbi.gov] unit has gotten soft. They sit up in Baltimore and send out child pornography, then go after the people they've entrapped. The process is even mostly automated [fbi.gov] now. That's an easy way to get their stats up, and fits the Bush administration's "regulate sex, not business" mindset, but doesn't solve crimes that have victims. Something to push on after Jan. 20, when the Democrats take Congress and can start asking hard questions of the executive branch.
Re: (Score:3, Insightful)
You can point your finger all you want at the maintenance worker who didn't read the warnings in GIANT PRINT - but Boeing was still sued and paid.
Boeing was not being irresponsible. I do not think the same can be said of Microsoft because many of the security problems have been pointed out CONSTANTLY since before 1995.
Re: (Score:3, Insightful)
"Thats crazy... that's like going after P2P admins for users sharing illegal content. It would never fly."
It's not like that at all, but that's due to a distinction that's apparently too fine for some people.
Take a look at your favorite torrent tracker. Unless it's legaltorrents or something of its ilk, you know they set it up to capitalize on the huge demand for pirated material (and to make ad money off same), you know most of the traffic is pirated material, and you know that the admin knows this.
Re: (Score:3, Informative)
Just to reiterate what these scum are doing:
1. Buy some really cheap stock at a really cheap price.
2. Hype it to victims.
3. Sell it to victims at inflated prices. Pocket the profit.
4. Victims are now stuck with a worthless stock that they can only sell at a large loss.
They usually work for the pump and dumper. Everybody else gets screwed. That's why it's a scam.
The companies are real, and you can look them up on NASDAQ [nasdaq.com] or Pink Sheets [slashdot.org]. I've looked a few of them up, and they all show an enormous spi
Re: (Score:3, Informative)
Re: (Score:3, Insightful)
Re: (Score:3, Interesting)
Another factor is that most of the very cautious folks I deal with have a real simple solution - no attachments, period. ISP's cannot implement something like that. They can block executable attachments, but that isn't really effective any longer. From what I under