Slashdot Log In
Most Spam Comes From Just Six Botnets
Journal written by ezhenito (1254888) and posted by
CmdrTaco
on Mon Mar 17, 2008 08:00 AM
from the all-obsessed-with-your-wang dept.
from the all-obsessed-with-your-wang dept.
Ezhenito noted some research pointing out the (maybe) surprising bit of research that 6 botnets are responsible for 85 percent of the world's spam. That seems a bit high to me, but the only aspect of spam I am an expert in is *getting* it.
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Who needs 6? (Score:5, Funny)
Distributed projects (Score:5, Funny)
I believe this figure could be much larger if the Trojan.Srizbi client was ported to Mac and linux
Anyone know what licence it's distributed under?
Re: (Score:3, Funny)
Re: (Score:3, Funny)
Hmm, well that explains a lot.
Since ISPs Love Filtering So Much... (Score:5, Insightful)
Why can't they focus thier efforts and resources on shaping traffic to block this kind of nonsense, rather than Torrents?
Re: (Score:3, Insightful)
1) There are "fewer" people using torrents than using email.
2) Email users include businesses that probably include a draconian SLA on the ISPs part and they don't want to mess with that.
3) And as always, it affects Profit!!!
Re:Since ISPs Love Filtering So Much... (Score:5, Insightful)
Spam affects the little guy. Torrents affect (apparently) the big guy.
Parent
Re: (Score:3, Informative)
Most Spam Comes from just Six Bots, not Botnets (Score:5, Informative)
Srizbi: 39%
Rustock: 20%
Mega-D: 11%
Hacktool.Spammer: 7%
Pushdo: 6%
Storm: 2%
Other: 15%
This doesn't necessarily mean that most spam comes from six botnets. Some of the bots could be used by multiple bot masters; OTOH some botmasters could control multiple botnets using different bots.
Something else I just thought of:
The botmasters are going to use the best bot available, i.e. the one enabling them to send most spam at the least cost. On the other hand, the "good guys" are fighting spam (and the bots). So whenever a certain bot starts taking over (currently Srizbi) all the good guys will focus on that one and try to shut it down. So the bot decreases in value and another, better bot will take over. Evolution at its best.
The Antivirus companies which are trying to fight the malware are also trying their best. The big difference is that while the success of a spambot can be easily measured by the customer (i.e. the botmaster), the success of an AV product is much harder to estimate. Also, the typical AV customer doesn't have the ability/time to find out which AV product is best for him. Moreover, AV products are some sort of subscription service (you buy the package and get 1 year of updates) which makes it hard to switch products. Often AV products are bundled with computers, selected by business principles and not by technical superiority.
In other words, the evolution process of malware is far superior to the one of AV products.
Re: (Score:3, Insightful)
Come on. The software bundles are *always* ludicrous. They typically include:
- A crappy "Home User"-Antivirus with huge splash screens and big colorful dialog boxes pissing you off a few times a day.
- A crappy toolbar for your browser (often Yahoo or Google, sometimes worse)
- Some "software update center" which is usually far worse than even Windows Update
- A CD Recording application which is ALWAYS crap.
- A software firewall yelling "OMG PACKET" every time someone s
Re:Most Spam Comes from just Six Bots, not Botnets (Score:5, Insightful)
The reason that they can't block every threat is that they are still signature based and have not completed the move to behavior based blocking and heuristics. The other problem - the main one - that you don't even mention is users. If someone bothered to write a 'SomeFamousPersonNaked.exe' for other OS'es - stupid users would still run it. (I do note that in today's world, the average Linux user is brighter about these things than their Windows counterparts - mostly because Linux is still in that niche role where it is dominated by computer savvy folks at least for now).
But, give that same Windows user who is stupid enough to run that EXE an Ubuntu machine and send him a version that runs on Linux AND HE WILL STILL CLICK IT. Switching OS'es doesn't make a dork not a dork. Doesn't even really matter whether the user is an admin or not on Windows or Linux - just sending mail doesn't require it and now that Vista is actually usable by many people as a standard user the malware writers will adapt and not try to own the whole machine right away.
I can see how this will be a problem for Linux users in the future if the user base continues to grow into that "stupid user" segment - at which point folks will be more than happy to write bot software for those users to run.
Parent
Re:Most Spam Comes from just Six Bots, not Botnets (Score:5, Insightful)
There are no major spam bots for linux because linux just doesn't have that all important desktop install base. However infected linux servers are frequently used to admin botnets. Badly configured linux servers are like treasure to the botnet guys..
Microsoft don't have more bots and virii in windows because their stuff is closed source, they have it because the underlying security model of windows is, and always has been, pretty poor. For years, normal users have run windows boxes in admin mode by default. This is INSANE!!, and yet it persists.
Adding UAC hasn't helped. It was implemented so badly that people just click through the new dialogs without reading the warnings most of the time. This wouldn't happen if it didn't question almost everything you do.
The sony rootkit couldn't be detected because of a flaw in windows that allowed it to hide even from most AV products.
Most AV companies don't 'take bribes' to keep bots going, they just aren't very good these days. The way virii are fought on the desktop needs to change, and that change is very slow in coming.
Parent
Re: (Score:3, Informative)
Adding UAC hasn't helped. It was implemented so badly that people just click through the new dialogs without reading the warnings most of the time.
No, what most people do is turn it off completely. They do this because it annoys them while they are setting up their machine and they do not understand its value.
When I first configure a linux machine, constantly having to enter the root password anoys me too. My solution is to just log in as root, do all the setup neeeded, then log in as a regular user. I have just been informed by a colleague that vistas implemantation of UAC doesnt really allow this. If this is the case it is a bit of a design flaw.
Re:Most Spam Comes from just Six Bots, not Botnets (Score:5, Informative)
For better or for worse, I administer a bunch of desktops and my current build process consists of a number of automated installations (most software installations can have all the mindless "click next next next" automated away fairly easily). I am at an awkward point where I have enough machines to want to automate the process, but not enough that I can easily just buy 100 identical systems and ghost the lot. And before you ask, I don't run Active Directory so rollout through group policy is out of the question.
It looks like this process will require substantial redesigning for Vista, as there doesn't seem to be an easy programnatic way to say "do everything below this point without bothering me through UAC". Neither is there an easy programmatic way to disable UAC altogether, even on a temporary basis. (Yes, I know about the registry setting from the command line. But that needs to run from an elevated command line which, guess what, you can't set up without interaction).
The way UAC works is that normal users still can't do a bunch of things. This doesn't change; they probably won't ever see a UAC prompt. Administrators can do everything they're used to, but by default if they want to do anything administrative, UAC steps in and says "Cancel or allow?".
I can understand from Microsoft's perspective that it's somewhat pointless to create such a system and then create an easy method to work around it, but I can't believe that in the whole corporation there aren't a few people with the brains between their two ears to realise that it's a very inelegant solution which adds hassle without really solving the problem.
Parent
Re:Most Spam Comes from just Six Bots, not Botnets (Score:5, Informative)
Everything. People run as administrator because they have to.
It's different in that a user does not have to run as root in Linux to get useful work done.
Ever tried to debug as an unprivileged user on W2K? Ever tried to install software? Just what is the Windows equivalent of sudo that ships standard with Windows XP?
Let me correct that for you: Windows won't let you do anything of substance once you're running as non-administrator. That is the problem.
Disclaimer: this situation has changed somewhat in recent years. However, considering the number of Windows user still running W2K or Windows XP (and for good reason), it's still concerning.
Parent
Re:Most Spam Comes from just Six Bots, not Botnets (Score:5, Informative)
On my non administrator account I run the following programs (Windows XP):
- World of Warcraft.
- A few other games I play once every blue moon.
- Music player, video player, encoders, editing software.
- Office.
- VPN client for my job.
- Firefox with Flash, Java, AdBlock and NoScript.
- Azureus.
- Thunderbird.
I need administrator to run these:
- Windows update (Duh!).
- Various software updates (Duh!).
How is that different from a typical Linux usage? I still need root access (via sudo or root) to update my OS and installed programs. So where is this "Windows won't let you do anything of substance once you're running as non-administrator." problem?. I can play video games, do video editing, listen to music, surf the web, use office and work from home via VPN and all that without being logged in as administrator. Where is the problem?
I am perfectly aware that there are a few programs that have trouble running as non administrator most notably CD burning/ripping stuff. You can always run them "Run as administrator" or find one that works fine. Mind you, I never bothered finding one that works well, just picked up one from Sourceforge and run it as root.
The whole Windows security "issue" is strictly educational. The underlying OS has a very solid security framework that IMHO is better than Linux because it's more granular.
Parent
Re: (Score:3, Informative)
I have no doubt that Windows has nice foundations, but this never seems to translate into my experience as an end-user. I use a W2K machine at work and quite frankly I spend probably close to 10% of my time there as an administrator. I need to set Thunderbird to be the default mail reader or something. Most of it is just installing new software.
Quite frankly, I've yet to find Windows as good as sudo when it comes to limiting my time as root. On Linux, if I need to execute a 2 second command as root, I run
Re: (Score:3, Interesting)
Just what is the Windows equivalent of sudo that ships standard with Windows XP?
I doubt that a Windows equivalent to sudo would ever come about, not because it isn't necessary, but because the model that drives useful work in Windows isn't command line based (even from an Administrator's point of view). That may be changing with MS switching over to Powershell, but as it stands, what you're asking for may not actually be necessary.
Vista, though, is supposed to have that magic little password prompt when you need admin privileges on a non-admin account, but if it comes up as
Re: (Score:3, Informative)
Just what is the Windows equivalent of sudo that ships standard with Windows XP?
It's called, "runas". It is a Windows program that allows you to run an arbitrary program as any other user (if you know the password, of course).
Windows won't let you do anything of substance once you're running as non-administrator. That is the problem.
That's not what I've observed. Back when I was using Windows 2K, I regularly ran as an ordinary user. Most programs worked just fine. Almost all of the Windows programs worked under a regular user, except for the ones that genuinely needed Admin access.
Ever tried to install software ... as an unprivileged user on W2K??
You can install software as an unprivileged user if you don't require Admin access to write to the direct
Re: (Score:3, Informative)
The -u (user) option causes sudo to run the specified command as a user other than root. To specify a uid instead of a username, use #uid.
Re: (Score:3, Informative)
Linux is indeed more secure because of the higher eyeball count that comes with open source software. However, if you really want security then make sure to use older versions with backports for security fixes. Programmers introduce security flaws all the time. We are fail constantly, and our failures are made right later on - in open source.
Even the absolutely best AV product possible cannot block every threat because that problem is currently NP complete, to the best of my understanding. Such a produ
Is this a surprise to anyone? (Score:3, Informative)
Really, this is nowhere near as useful as the spam distribution data that is available through spamhaus, telling us who is behind the bulk of the spam, and what geographic parts of the world they are associated with. The botnet building and controlling seems to be the easy part of the spammers' game now, and we can all thank our neighbors and their new un-patched boxes on 24/7 DSL / cable connections for that.
Sue the companies who advertise (Score:5, Interesting)
How many companies are actually advertising at any one time? Is all the spam for one company, ten companies, a thousand companies or a million?
Re:Sue the companies who advertise (Score:5, Insightful)
There are plenty of spams requiring real businesses behind. Most of these businesses are located in western countries. Why can't they track them?
Parent
Re: (Score:3, Interesting)
Re:Hmm (Score:5, Funny)
Parent
Re:Hmm (Score:5, Insightful)
The three of my relays that use the combined Spamhaus SBL, XBL, and PBL block about 3.5 million connection attempts per day, and let 1 million emails/day through to the next layer of filtering. (about 78% of the flow, assuming that each connection would only drop off one email) The PBL accounts for about half of those blocks.
Parent
Re: (Score:3, Funny)
Re: (Score:3, Funny)
Re:Hmm (Score:5, Funny)
Parent
Re:Hmm (Score:4, Funny)
microsoft is fixing spam just like they fixed viruses.
ty
Parent
Re:Hmm (Score:5, Informative)
Parent
Blocking known residential blocks sucks (Score:4, Insightful)
I (like others I'm sure, but maybe not so many of us these days) run a mail/web server from home. I just use it for personal mail. I have SPF and rDNS set up, I play by all the rules. Why block me because I use ADSL at home with a static IP ?
Whilst I appreciate that accepting mail from my IP is potentially a higher risk factor, blocking all residential blocks sems to me to be overkill.
Parent
Re:Blocking known residential blocks sucks (Score:4, Insightful)
Parent
Double standard (Score:3, Insightful)
Re: (Score:3, Informative)
Re:Anti-bots? (Score:5, Insightful)
In practice, no it wouldn't.
You'd be opening yourself up to prosecution. Even in countries without specific "misuse of computers" laws, running a program on someone else's computer is trespass. You might think that, since trespass is a civil matter, you'd only need to worry about someone who has the money to sue you taking a dim view of what you were up to. And you'd be right. But the botnet-controllers have got enough money and would be bothered to take you to court.
And I haven't even touched on the really horrifying issue: what if your benign, anti-malware malware malfunctioned, or was subverted by the next generation malignant, anti-benign-anti-malware-malware malware? You could easily end up becoming even worse than the enemy whose dirty tricks you borrowed.
Parent
Re:Anti-bots? (Score:4, Insightful)
If more people configured their sendmail to reject bad HELOs, it would be a lot harder to send spam.
Parent
Re: (Score:3, Insightful)
Spoken like someone who has never actually debugged crappy code before. If I had a nickel for every time someone just needed "a half-hour" to fix a problem in code....
Re:Anti-bots? (Score:5, Interesting)
Something like that. They could get the list of infected IPs from one of the black lists.
I'm not a network guy, so I don't know what kind of technical restrictions there would be... obviously this wouldn't work well with proxies - maybe NAT would be an issue as well? In any event, I personally would appreciate such a service, even if I got hit with false positives once in a while. Of course, the bots would eventually get wise and filter out the messages, but that's part of the fun of the war.
Parent
Re: (Score:3, Funny)
I was wondering whether it would help if Google (and maybe some of the other top 10) notified you when you showed up on one of the IP block lists with a big yellow box at the top of the page, like an IE alert: "Warning: Your computer has been reported to be a SPAM relay! Please clean up your computer with the following tools..."
Yeah, it would be just like those Windows dialog box advertisements that jump around and say "Your computer is infected with a VIRUS! Click OK to run our FREE VIRUS REMOVAL SOFTWARE!" I always trust any random box that jumps up in front of me. There's no way that I, being a totally botnet'd infected Windows MSIE user, would simply be numb to the sheer number of popups and messages my computer throws at me every day. I read each and every one and carefully consider what it has to say before clicking the clo
Re: (Score:3, Interesting)
Re:How much spam do you actually get? (Score:5, Informative)
Or you can put a prefix to your gmail address with a '+'. ie. "temp+john38@gmail.com" the mail still gets delivered to john38@gmail, but with 'temp+john38@gmail.com' in the 'to:' field, allowing you to filter it easily.
Parent
Re:How much spam do you actually get? (Score:5, Informative)
you need to put it john38+temp@gmail.com for it to work as the other way round just goes to the wrong address
Parent
Re: (Score:3, Informative)
You can even give different people different +extensions, though managing the white list for them gets to be a pain. Especially since your new, improved email addresses will gradually leak into the spam books (everybody's got a friend dumb enough to push the "forward this article to a friend and sign them up for spam for life!")
Re: (Score:3, Insightful)
Spammer's note to self: (1) duplicate all gmail addresses with dummy "+" fields purged. (2) duplicate all gmail addresses with the most common non-filtered dummy fields, such as "family" and "work". Now each gmail address will be hit with a dozen or a hundred variations, in hopes that on
Re:Control Server? (Score:4, Informative)
Here is some info on the Srizbi [symantec.com]
Basically, it's a rootkit that downloads config files from one of several IP's or domains to then start sending spam.
Parent
You have overlooked a more permanent solution. (Score:5, Funny)
Parent
Re:People need to take responsibility (Score:5, Insightful)
1) static IP's. Then we can easily track down infected machines and take them offline.
I do like the spirit of the post, but I don't think there's a clear-cut solution to the problem.
Parent
Re: (Score:3, Informative)