Slashdot Log In
Deconstructing a Pump-and-Dump Spam Botnet
Posted by
Zonk
on Fri Nov 17, 2006 11:12 AM
from the gaah-scary-graphics dept.
from the gaah-scary-graphics dept.
Behind the Front writes "eWeek has teamed up with Joe Stewart, a senior security researcher at SecureWorks in Atlanta, to show the inner working of a massive botnet that is responsible for the recent surge of 'pump and dump' spam. It's a detailed picture of how these sleazy operations work and why they're so hard to shut down. Sobering numbers: 70,000 infected machines capable of pumping out a billion messages a day, virtually all of them for penis enlargement and stock scams. Excellent graphics, too, including one chart that shows that Windows XP Service Pack 2 is hosting nearly half the attacked machines."
Related Stories
[+]
Is the Botnet Battle Already Lost? 374 comments
An anonymous reader writes "Researchers are finding it practically futile to keep up with evolving botnet attacks. 'We've known about [the threat from] botnets for a few years, but we're only now figuring out how they really work, and I'm afraid we might be two to three years behind in terms of response mechanisms,' said Marcus Sachs, a deputy director in the Computer Science Laboratory of SRI International, in Arlington, Va. There is a general feeling of hopelessness as botnet hunters discover that, after years of mitigating command and controls, the effort has largely gone to waste. 'We've managed to hold back the tide, but, for the most part, it's been useless,' said Gadi Evron, a security evangelist at Beyond Security, in Netanya, Israel, and a leader in the botnet-hunting community. 'When we disable a command-and-control server, the botnet is immediately re-created on another host. We're not hurting them anymore.' There is an interesting image gallery of a botnet in action as discovered by security researcher Sunbelt Software."
[+]
25 Percent of All Computers in a Botnet? 408 comments
Beckham's_Ponytail writes to mention an Ars Technica article, with some disturbing news out of the World Economic Forum in Davos, Switzerland. Vint Cerf, one of the 'fathers of the internet', has stated that the number of botnets online is larger than believed. So large, in fact, that he estimates that at this point one in four computers is infected with botnet software. We've discussed the rise of botnets numerous times here on Slashot, but the image of 150 million infected computers is more than a little bit sobering. With the extremely lucrative activities that can be done with botnets (such as password ripping, spamming, DDoSing), as well as reports of organized crime adopting 'cyber-terrorism' as a new line of income, is it likely that law enforcement will ever be able to curb this particular bane?
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Filter (Score:4, Insightful)
you are missing the point (Score:3, Insightful)
Re:Filter (Score:5, Insightful)
As Heinlein said, the answer to any question beginning with "Why don't they..." is "money". Presumably the ISPs figure you'll just take your business and your bot-infested computer elsewhere. But maybe if a few major ISPs got together and agreed to all do it, they'd cut off enough spam to make their customer bases happier, and attract back those customers who gave up in frustration.
Parent
Re:Filter (Score:4, Insightful)
Parent
Re: (Score:3, Insightful)
Re:Filter (Score:5, Insightful)
I thought I paid for IP access. Deliberate port blocking by my ISP is blocking services I pay for.
IP access means IP access, it does mean port 80 web surfing only. Any steps toward that are plain wrong.
I agree it is a wild world out there but it is a problem of weak clients. The service provider should be blind unless a client is affecting network performance beyond their paid for slice. Then the client should be totally blocked.
Parent
Re:Filter (Score:4, Interesting)
Something similar would work fine. Block port 25 to SMTP by default and have a web config utility to change it. If you really wanted, you could set it up to email the user if they tried accessing port 25 when it was blocked ("You might be trying to get past this firewall. Or, you might have a virus. Here's how you can find out, and here's how you can disable it if you need . . . ")
Parent
Re:Filter (Score:5, Funny)
I like that idea. Virus tries sending out 10,000 emails, user gets 10,000 emails saying "You might have a virus....".
Parent
Re:Filter (Score:4, Insightful)
Are you one of those imbeciles at Belgacom or something? Because they implemented the same cretinous strategy (without any advance warning, I may add) as you're suggesting.
Parent
Shorting won't work... (Score:4, Informative)
Parent
Infection vs Market Share (Score:4, Insightful)
That was a bad picture (Score:5, Funny)
Rebuild the email protocol (Score:5, Insightful)
Re:Rebuild the email protocol (Score:5, Funny)
(x) technical ( ) legislative ( ) market-based ( ) vigilante
approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)
( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
(x) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
( ) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business
Specifically, your plan fails to account for
( ) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
( ) Asshats
( ) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
(x) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
( ) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
( ) Extreme profitability of spam
( ) Joe jobs and/or identity theft
( ) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
( ) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook
and the following philosophical objections may also apply:
(x) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
( ) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough
Furthermore, this is what I think about you:
(x) Sorry dude, but I don't think it would work.
( ) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your
house down!
Parent
Re:Rebuild the email protocol (Score:5, Insightful)
Thank you for being a wimp.
Parent
Re:Rebuild the email protocol (Score:4, Funny)
( ) Nope, you're wrong
Parent
thats okay, but how to detect this infection? (Score:4, Insightful)
eweek confirms it: Linux and Mac are dying! (Score:5, Funny)
Re:eweek confirms it: Linux and Mac are dying! (Score:5, Insightful)
Parent
Windows 95 (Score:4, Funny)
Parent
I'm just surprised that those spams still ... (Score:4, Insightful)
Which leads me to wonder about the folks who actually believe that those penis enlargement pills work.
And as far as the "pump and dump" spam goes, are there folks who beleive those spams? Or are they of the mindset of the "greater sucker"? Meaning, if I buy this stock now, after this spam circulates, there will be others who buy this shit stock and push up the price allowing me to make money.
Yeah, I know the guy who originates the "buy" recomendation is hoping for everyone to buy the stock, but what makes some of the recipients think they'll make out?
Subject (Score:4, Insightful)
Where's law enforcement on this? (Score:4, Interesting)
Those guys shouldn't be that hard to find with enough law enforcement effort. Get a credit card from a cooperating bank. Put a trace on it. Buy some Viagra from a spam. Watch where the money goes, which is probably some bank in a high-crime country. Visit the bank and talk to them. Threaten to have their abilty to process credit cards cut off. Pry the actual payee out of them. Discover that it's another intermediary and start over.
This is what we pay the FBI for. This is why the FBI has field offices outside the US. This is why the Financial Crimes Information Network [fincen.gov] exists.
The FBI's Internet-related criminal enforcement [fbi.gov] unit has gotten soft. They sit up in Baltimore and send out child pornography, then go after the people they've entrapped. The process is even mostly automated [fbi.gov] now. That's an easy way to get their stats up, and fits the Bush administration's "regulate sex, not business" mindset, but doesn't solve crimes that have victims. Something to push on after Jan. 20, when the Democrats take Congress and can start asking hard questions of the executive branch.
Hit the nail right between the eyes. (Score:5, Insightful)
1. Someone comes up with a defense mechanism that works well.
2. It works so well that more people use it.
3. It becomes popular enough for the bad guys to beat, so they do.
4. The defense becomes useless, forcing someone to come up with a new defense.
5. Goto 1.
Parent
Re:C'mon (Score:4, Insightful)
If these bots have control over 'the most secure Windows yet' [com.com], then that is worthy of note.
Mark
PS Yes, I know the link is from 2004 - but they've not released anything since, so it must still be true, right?
Parent