Deconstructing a Pump-and-Dump Spam Botnet

Behind the Front writes "eWeek has teamed up with Joe Stewart, a senior security researcher at SecureWorks in Atlanta, to show the inner working of a massive botnet that is responsible for the recent surge of 'pump and dump' spam. It's a detailed picture of how these sleazy operations work and why they're so hard to shut down. Sobering numbers: 70,000 infected machines capable of pumping out a billion messages a day, virtually all of them for penis enlargement and stock scams. Excellent graphics, too, including one chart that shows that Windows XP Service Pack 2 is hosting nearly half the attacked machines."

Filter

[insecuritiez]

If more ISPs did egress filtering of email this sort of thing would be harder to do.

Re:

[DeGem]

Your assuming that the spam is comming off a mail server the ISP is controling.

Re:

[ILikeRed]

No, just block port 25 to all servers other than the ISPs for dynamic IP addresses. If they do not want to use their ISPs mail server, they can purchase a static IP, or set up a proxy with a different port. If you are not capable of doing either of those things, then you should not have the privilege.

Re:Filter

[RichMan]

> No, just block port 25 to all servers other than the ISPs for dynamic IP addresses.

I thought I paid for IP access. Deliberate port blocking by my ISP is blocking services I pay for.

IP access means IP access, it does mean port 80 web surfing only. Any steps toward that are plain wrong.

I agree it is a wild world out there but it is a problem of weak clients. The service provider should be blind unless a client is affecting network performance beyond their paid for slice. Then the client should be totally blocked.

Re:

[tinkerghost]

Check your TOS with your ISP again. Many of them have prohibitions against running servers off of your dynamic IP address. Most of that is holdover from having a 'server' defined you as a business user, but it's still there. I know that RCN shut down Port 80 inbound following Code red because there was more virus traffic than actual requests - it's staggering how many people are running IIS without knowing it. At one point they also blocked all port 25 traffic not directed to the official network mail serve

Re:Filter

[ZorbaTHut]

My ISP has a web-based configuration utility that allows me to set a server-side firewall to one of several default values. One of their options blocks several commonly-exploitable ports on Windows. I don't use those ports for anything, and I have my own firewall so those ports shouldn't reach my Windows boxes in any way whatsoever, but I set it to block them anyway. (This was the default setting, actually.)

Something similar would work fine. Block port 25 to SMTP by default and have a web config utility to change it. If you really wanted, you could set it up to email the user if they tried accessing port 25 when it was blocked ("You might be trying to get past this firewall. Or, you might have a virus. Here's how you can find out, and here's how you can disable it if you need . . . ")

Re:Filter

[jimicus]

Something similar would work fine. Block port 25 to SMTP by default and have a web config utility to change it. If you really wanted, you could set it up to email the user if they tried accessing port 25 when it was blocked ("You might be trying to get past this firewall. Or, you might have a virus. Here's how you can find out, and here's how you can disable it if you need . . . ")

I like that idea. Virus tries sending out 10,000 emails, user gets 10,000 emails saying "You might have a virus....".

Re:Filter

[Hognoxious]

If you are not capable of doing either of those things, then you should not have the privilege.

What if I don't want to go jump through hoops, or pay double for the privelege? What if I want to acess my work mail server from home? Or a clients? Or I just want to access the email that I've been using for years via pop/smtp?

Are you one of those imbeciles at Belgacom or something? Because they implemented the same cretinous strategy (without any advance warning, I may add) as you're suggesting.

Re:

[johnw]

The problem with this approach seems to be one that could be addressed by separating the two different ways in which SMTP is used.

1) It's used by MUAs to pass mail to some sort of parent system for delivery.

2) It's used by MTAs to pass mail around between themselves - typically passing from the originator's MTA to the recipient's MTA.

If the first function was switched to a different port number (i.e. not 25) and made authenticated, then port 25 could be blocked by default for dial-up-style users without inc

Re:

[b0s0z0ku]

If the first function was switched to a different port number (i.e. not 25) and made authenticated, then port 25 could be blocked by default for dial-up-style users without inconveniencing anyone.

It's been done. Port 587 is used for non-secure client-to-server SMTP already. Some ISP's allow port 587 passthrough but block 25. Personally, I think that sucks, and I'll summarily dump any ISP that blocks 25, if only because I need access to port 25 for things like testing clients' servers sometimes.

-b.

Re:

[dodobh]

587/tcp is for message submission. 25/tcp is MTA to MTA. Your MUA has no business talking on port 25.

Re:

[berzerke]

No, just block port 25 to all servers other than the ISPs for dynamic IP addresses.

Some ISP's do this. And this is reason I can't set up a SPF record for my domain. All my parents outgoing email would fail and their ISP (AT&T) doesn't publish any SPF records (and what if they change ISP's, something they have been talking about doing). Considering they are on dail-up, buying a static IP is out of the question. Getting AT&T to unblock them is impossible (I've tried).

Re:

[jetmarc]

> No, just block port 25 to all servers other than the ISPs for
> dynamic IP addresses. If they do not want to use their ISPs
> mail server, they can purchase a static IP, or set up a proxy
> with a different port.

I did purchase a static IP and pay for it on the monthly bill. Yet half of my outgoing email is still returned as "rejected for possible spam".

Maybe your provider keeps "static" IPS separate from "dynamic IPs". Mine appearently doesn't (just assigns me one of his IPs as static). Or the

Re:

[giorgiofr]

Wrong solution. If a mail server admin does not want to receive spam from residential IPs, he has the means to block before it even reaches the server. Lists of such IPs abound.

Re:

[dodobh]

Blocking 25 is fine. Blocking 587 is moronic. Using 465 is kinda stupid, but blocking it is wrong too.

you are missing the point

[weierstrass]

then they would use the massive botnets of 0wned machines for something else, that probably also wouldn't be conducive to the health and general well-being of the internet...

Re:Filter

[jfengel]

I hear that. It just doesn't seem unreasonable to me to cut off a customer who is sending tens of thousands of email per day. Put the very few with a legitimate reason on a white list (after a phone call) and cut the rest off until they clean up their act.

As Heinlein said, the answer to any question beginning with "Why don't they..." is "money". Presumably the ISPs figure you'll just take your business and your bot-infested computer elsewhere. But maybe if a few major ISPs got together and agreed to all do it, they'd cut off enough spam to make their customer bases happier, and attract back those customers who gave up in frustration.

Re:

[Hijacked Public]

Why does it seem reasonable to you? Why shouldn't I be able to do what I want with the bandwidth I purchased?

While I think ISPs should be able to do anything they want with the connections they sell, as long as they are up front about the terms, I will gravitate toward the ones who meddle less.

Re:

[MobyDisk]

You should, and you can. Just remember that this is all about false positivies and false negatives. Let's say I ran an ISP and I cut-off everyone who sent 10,000 messages or more a day. How many legitimate users would that cut-off? 1%? .01%? .001%? If someone has a legitimate need to send 10k emails then they can give their ISP a call, declare that they have legit reason, and get their service re-enabled. I hate such systems, but if it eliminated 70,000 pwned computers and forced 70 legitimate users t

Re:

[aaronl]

That won't work, for one of two reasons that I can think of off the top of my head. Either you'll get malware that will only spam 9000 messages per day, or you'll get customers that are cut off regularly, get pissed, and change ISPs. If you're unlucky, you'll also get some lawsuits about it, justified or not.

You're better off trying to force rate limit outgoing email, keep state on your clients, and trying to cut off outgoing SMTP for abusive hosts. However, you would then be monitoring traffic, and that

Re:

[salec]

Either you'll get malware that will only spam 9000 messages per day, or you'll get customers that are cut off regularly, get pissed, and change ISPs. If you're unlucky, you'll also get some lawsuits about it, justified or not.

Isn't similar approach used to prevent spamming message board and other online communities? Basically there are sensible natural limits for a human-generated messages to be written and sent. Even if bots adapt and start mimicking human behavior, we still get at least a little offload a

Re:Filter

[tha_mink]

I think everyone is missing the point here. The problem really isn't spam. It's the fact that there are botnets out there that are 70,000 strong. Thank god they're only sending enlarge-your-penis emails. Instead of spending energy trying to stop the symptom, let's try and stop the disease. Forget the email, let's figure out a way to stop the infections in the first place. Then there's the issue of cutting off the funding. Why not try and stop the funders of spam. I think that BlueSecurity had it completely right. Piss off the people paying the spammers, and you stop the spam. Nobody's going to send spam for fun, and if they did, maybe we wouldn't mind reading them so much. 1. Stop the infections 2. Stop the funders of spam. 3. Profit! It's a simple as that. I hate how people miss the point on this spam stuff. The spam is only the symptom.

Re:

[ciscoguy01]

I'm guessing the real money issue is that the ISPs don't want to (or don't have the resources to) help their users clean up their infested machines.

That's likely a big part of the reason big ISPs fail to monitor for botlike traffic, they are too cheap. Last night I had to call AT&T about an email sending and usenet authentication issue affecting my wife. I first had to hurdle the tech support in India with a pretty hard to understand accent who didn't know what usenet was. I was finally escalated t

outbound email only on request

[davidwr]

If I were running an ISP, I'd have common ports such as IM, file-transfer/ftp/torrent, ssh, 80/443, irc, and many others allowed and all other ports blocked or restricted to certain destinations by default.

I'd have a web-page for my customers so they can click things such as:

Outgoing Email:
[x] web based [turn on port 80/443]
[x] through remote-login [turn on remote-login ports]
[x] through us [turn on mail ports, restrict to our servers]
[ ] through another server: ______ (specify list of outgoing mail servers

Re:

[dknj]

and this is why you're not running an isp...

Re:

[jandrese]

While that would work, it is the sledgehammer approach. You're assuming there is no legitimate reason for someone to be sending mail directly from his home account. I think a less obtrusive method would be to monitor outgoing traffic for excessive SMTP (more than 5MB in 30 minutes for 1 full hour perhaps), and if it is detected block off that customer so that all web browser traffic is redirected to the ISPs "your computer is infected, here is how to clean it" page. I think if people were made aware of t

Re:

[CrazedWalrus]

(8-12 hours to process an email?!?)

8-12 hours?! Sounds like someone put an internet in your tubes! Back the truck up!

Hasn't worked for me

[Chapter80]

Has anyone had any luck with these stock tips? None of them seem to be panning out for me. I wonder if I am not acting fast enough. I've really taken a beating on some of these.

Fortunately, I should have significantly more money to invest shortly, as soon as I get a rather large sum from a new online friend and business associate and new friend, Mr. Emmanuel Obi from Africa, of all places.

Re:

[bitflip]

You should be short selling them, instead.

Shorting won't work...

[camusflage]

No broker will allow you to short a pink sheet stock, which the overwhelming majority of pump and dump spam deals with.

Re:

[Anonymous Coward]

Luck? Did you see www.spamstocktracker.com [spamstocktracker.com]?

Infection vs Market Share

[MrSplog]

The charts would be a lot more interesting if they had them compared to market share. then you've got to consider that people are more likely to target the biggest market share. i mean, how many virus writers are targeting FDOS?

Re:

[Overzeetop]

Well, 99.95% of the infected machines on the botnet are an identifiable variant of Windows, with 0.05% listed as "other". I'm okay with writing off the 35 machines which are not known Win* variants. It's pretty safe to say that the Windows OS is clearly the problem.

Re:

[InsaneGeek]

Why would you say the Windows OS is clearly the problem? The trojan *only* run on Windows, so one would expect that all of the clients are Windows. It's like saying that Linux OS is clearly the problem when looking for Linux kernel bugs and the fact that they don't affect Windows at all.

Re:

[Ilgaz]

I understand what you mean. Check the hacked servers http://www.phishtank.com/ [phishtank.com] , almost all run Apache on Linux. Why? It has bigger marketshare on webservers.

I think the OS X, Linux, FreeBSD "I am invulnerable because of OS I run, I don't need security updates or basic sense of security" will cause problems soon just like phishing.

Re:

[MECC]

almost all run Apache on Linux

Where does phishtank keep stats on webserver used and OS its run on? I didn't see that data anywhere on their site. Are you going to netcraft and looking up all 1,429 online phishing websites? If so, do you have a breakdown by OS and webserver?

Re:

[Ilgaz]

You can easily figure via the "technology" phishing site uses, almost all are hacked PHP. There are only a couple of ASP technology (windows, small business server etc.) I have come across while verifying others submissions. When they take the page down, you generally see "Apache x.x server on Linux" on 404 messages too.

In fact, you can freely use their database to do such research yourself, that philosophy of the site make us "work for free" as everything is open and available to public/developers.

You can

Re:

[misleb]

Even more likely, it is just bad PHP (usually Linux/Apache) that allows SQL injection or XSS. You dont' necessarily have to hack the servern OS itself just to get a list of addresses. There are lot of well known, vulnerable PHP apps out there such as old versions awstats. Patching your OS (which in the case of most Linuxes would include apache) is one thing, but trying to keep all your PHP up to date and secure is quite another. Plenty of otherwise security conscious admins are running vulnerable PHP code.

-

Re:

[Ilgaz]

Changing content on a website to serve your needs is not very different than infecting a machine with a worm to send millions of messages to people IMHO. In fact as those infected phishing sites are advertised via windows botnets, you know someone has to send "update your details" fake mail.

If you use the netcraft, they of course run outdated kernel and apache with easy to guess passwords (I assume the pwd part)

Whoever got the largest marketshare gets attacked, it is not a "Windows" excuse/apology of course

That was a bad picture

[Overzeetop]

I'm sorry, but the terms "Penis Enlargement" and "Excellent Graphics" were situated a bit too close together in that summary for my liking.

Rebuild the email protocol

[Hoi Polloi]

It is time to rebuild the email protocol. It needs to be redesigned to cope with modern systems and security needs. The pain of the transition would be worth it. It is just too easy to spoof header info now.

Re:Rebuild the email protocol

[LordEd]

Your post advocates a

(x) technical ( ) legislative ( ) market-based ( ) vigilante

approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)

( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
(x) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
( ) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business

Specifically, your plan fails to account for

( ) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
( ) Asshats
( ) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
(x) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
( ) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
( ) Extreme profitability of spam
( ) Joe jobs and/or identity theft
( ) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
( ) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook

and the following philosophical objections may also apply:

(x) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
( ) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough

Furthermore, this is what I think about you:

(x) Sorry dude, but I don't think it would work.
( ) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your
house down!

Re:Rebuild the email protocol

[Archangel Michael]

The "we can't change anything because it is too hard waaaaaaa" post.

Thank you for being a wimp.

Re:

[LordEd]

I see... so if somebody came out with the solution to pollution problems would be to eliminate all vehicles and replace them with bikes, would you change?

(hint) (x) Huge existing investment in cars

Re:

[LordEd]

Ah.... The "we can't change anything because it is too hard waaaaaaa" post.

Thank you for being a wimp.

Re:

[Renegade88]

Am I the only one who thinks this form-checkbox type of comment is trite? It's not original, it's not funny, it's annoying at best. Stop doing it.

Re:Rebuild the email protocol

[Anonymous Coward]

(x) Yes, I agree
( ) Nope, you're wrong

Re:

[growse]

Whilst I agree in spirit, the single problem with email now is that you have no way of knowing if a sender really is who they say they are. I can send an email to you which claims to be from Steve Ballmer and you have no way of knowing 100% if it's real or not.

I'm not sure how this would be solved with a redesign either. The only way I can think of doing it is to have a mandatory digital signature attached to the email, so you can lookup exactly who signed it and prosecute/disable signature if spam. If som

Re:

[vertinox]

It is time to rebuild the email protocol. It needs to be redesigned to cope with modern systems and security needs.

The main problem is that you would need to get everyone to get on board with it all at once.

However, I don't see why companies do this internally as it is.

For internal communication you should be using a secure system and anything external just gets put in a different mailbox or system. Still... Its a great deal of work.

Re:

[RareButSeriousSideEf]

"The main problem is that you would need to get everyone to get on board with it all at once."

I think the opposite is true. If people have the option of trying the New, Improved, Secure Email without abandoning their current routine, a gradual transition might have a fighting chance. Lots of people with traditional phones also have SIP and VoIP and such. Heck, with a bit of finesse, new protocol plugins could be integrated into existing mail clients.

Digital signatures could come in dual-varieties: Authorit

Domain Keys Identified Mail

[Kunta Kinte]

It is time to rebuild the email protocol.

We may have to settle for working on a fix. The industry isn't going to replace such an entrenched protocol easily, even if that may be the best solution.

A large part of the problem is lack of a good, entrenched E-mail Authenication [wikipedia.org] standard. The IETF's Domain Keys Identified Mail [dkim.org] is working on fixing this, but that will take a while. DKIM is pretty much the standardization of Yahoo's DomainKeys protocol. [yahoo.com]

My guess, is that we will have to wait at least a yea

thats okay, but how to detect this infection?

[Anonymous Coward]

Perused the article to know how to find out if my computer is infected or not but couldn't find anything. This is such an important news for Windows users, at least tell something abou thow to verify if a particular windows machine is having this problem.

If you have to ask...

[Ayanami Rei]

... then you probably are.

Steps:

1) Get rid of XP. If you're going to run Windows, then run Server 2003. Try to get your company to pay for it if you can.
2) Don't disable the "MSIE Enhanced Security Configuration", whatever you do.
3) Use Firefox or Opera, never use IE, unless absolutely necessary (Windows Update)
4) Always run as a limited user. Never as a user with Administrator access. Right-click on installers and say "Run as... The Following User: Administrator" to install them.
5) Get yourself all of the

Re:

[Bastian]

Get a virus scanner, silly. I believe this trojan is detected by all of them.

I'm glad I run my own mail server

[zitch]

And implemented greylisting [wikipedia.org] on it. Cut out almost %100 of the spam I have been receiving (Was up to 50 emails a day, now I think only one has gone through since I installed postgrey on my mail server in 1.5 months!). Unfortunately, this is easy to get around, so it should only be a matter of time till that is worked around and becomes useless in the spam fight. By that time, hopefully another anti-spam method comes up...

Hit the nail right between the eyes.

[Rob T Firefly]

This is the basic problem with any single antispam measure, or really any single computer security measure.

1. Someone comes up with a defense mechanism that works well.
2. It works so well that more people use it.
3. It becomes popular enough for the bad guys to beat, so they do.
4. The defense becomes useless, forcing someone to come up with a new defense.
5. Goto 1.

greylisting+dnsblocking f0r teh win.

[Anonymous Coward]

Except greylisting+dnsblocking, for which there is no defense.

If everyone greylisted, spamming operations would slow down to a crawl. If the go full speed, then the only sites which will accept their spam (or better, to escape detection, temporarily reject it after DATA) are spamtraps, which means the rest of the world becomes instantly unavailable because of dnsblocking.

If they have to slow down.. well, we win.

It's just beautiful.

Re:

[wawannem]

Well, greylisting is suprisingly more effective than most anti-spam measures if you combine it with a decent rbl. The basic premise is that when a message comes in, the server looks at the sender, recipient, and sending host/server. If this is the first time that the greylisting server has encountered this triplet, it tells the sending server to wait X minutes (where X is most likely 5). There are 3 likely outcomes at this point. First outcome, this is a legitimate message from a legitimate server and the w

Re:

[caseih]

Greylisting is no longer completely effective. Initially when I started it cut down on 100% of the spam, as you said. But now, thanks to this new botnet which does honor RFCs for e-mail, I have enlargement and stock spam coming through just fine after waiting out the delay. I won't disable greylisting though; it still keeps out a lot of spam. I'm just saying greylisting doesn't actually completely work. I agree with another poster who said SMTP is pretty much done. Too many people have ruined it for t

eweek confirms it: Linux and Mac are dying!

[Trelane]

From the graphs, it's obvious that Linux, BSD, and MacOS lumped together are only 0.05 percent of the desktop market!!

Re:

[Overzeetop]

You forgot OS/2 ;-)

Re:

[zieroh]

And AmigaOS.

Re:

[Bandman]

I was disappointed that there wasn't a Win 3.1x contingent. Someone has got to still be running it.

Re:

[19061969]

Huh! Oberon always gets ignored... ;-)

Re:eweek confirms it: Linux and Mac are dying!

[mrjb]

Do you really think that 0.05% of all spam comes from Linux, BSD, MacOS, Solaris and OS/2 lumped together? Then I'll have to disappoint you. Look again. Windows 95 is curiously absent from the graph. How big a part of 0.05% do you think it could handle?

Windows 95

[Pinky3]

Hackers and Spammers no longer support Windows 95. It's too hard to write worms, bots, and viri that are backward compatible.

C'mon

[Tarlus]

Well of course Windows is going to be in the majority of affected machines... There is a dramatically higher number of people in the world using Windows than any other OS, so... wouldn't it make sense?

As a proud user of Kubuntu, I can relate to /.'s tendency to point out everything that appears to be wrong with Windows... but come on, isn't it a little much to explicitly point it out in this case?

99.95% Windows

[pedestrian crossing]

Well of course Windows is going to be in the majority of affected machines... There is a dramatically higher number of people in the world using Windows than any other OS, so... wouldn't it make sense?

As a proud user of Kubuntu, I can relate to /.'s tendency to point out everything that appears to be wrong with Windows... but come on, isn't it a little much to explicitly point it out in this case?

According to their chart, 99.95% of the systems on the botnet run Windows in some form. Unless all other desk

Re:C'mon

[Mark Hood]

Actually, the dig was at Windows XP SP2 in particular - not just Windows generally.

If these bots have control over 'the most secure Windows yet' [com.com], then that is worthy of note.

Mark

PS Yes, I know the link is from 2004 - but they've not released anything since, so it must still be true, right?

Re:

[InsaneGeek]

I think the problem is that there really is nothing inherrent in Linux, etc that would prevent them from being part of a botnet if I run a trojan. As a Linux user I can open up a port >1024 and my .profile or .xinitrc can run a botnet program without me noticing it. Grandma is just as likely to click on a "run this" spam message on Linux as she is on XP, just right now there are limited number of uninformed Grandma's running Linux so people aren't creating programs for it.

Probably the bigger reason for

Re:

[A.K.A_Magnet]

You're assuming a remote exploit in the web browser or mail client. Currently, your grandma opens an attached file in a mail and gets infected. With GNU/Linux, she would have to set it "executable" before being able to run it. She doesn't know how to do that (hopefully) so she won't get infected.

Programs should be installed system-wide by an administrator (you?), and from a trusted source (signed apt repositories).

This is a huge difference with Windows and its security model. By default on Windows, al

Re:

[mrjb]

come on, isn't it a little much to explicitly point it out in this case?
No :)

I'm just surprised that those spams still ...

[Jawood]

work. After all, the folks who are doing the "advertising" must be getting some sort of return.

Which leads me to wonder about the folks who actually believe that those penis enlargement pills work.

And as far as the "pump and dump" spam goes, are there folks who beleive those spams? Or are they of the mindset of the "greater sucker"? Meaning, if I buy this stock now, after this spam circulates, there will be others who buy this shit stock and push up the price allowing me to make money.

Yeah, I know the guy who originates the "buy" recomendation is hoping for everyone to buy the stock, but what makes some of the recipients think they'll make out?

Re:

[artifex2004]

Yeah, I know the guy who originates the "buy" recomendation is hoping for everyone to buy the stock, but what makes some of the recipients think they'll make out?

There are plenty of idiots out there with access to both internet and credit cards. Really.
And a lot of them also think that if someone has your email, they must know you from somewhere.

When I worked at a brokerage firm, people used to call me and ask for advice (which I couldn't give, not being licensed) on how much to invest in whatever stock t

Okay, so now there are statistics.....

[zappepcs]

But when, if ever, will anyone shut down the MS machine? Never is when. MS is far to invested into large corporations and government institutions to ever have anyone, never mind MS, say, all windows products must be updated or dumped. Its just not going to happen. If you owe the bank $1000 dollars, you are in trouble if you're late on the payments, if you owe the bank $10,000,000,000 dollars and you're late, the bank is in trouble.

Right now, the later is more the case. If MS had to upgrade or recall all XP products, it would cause a large harm to the economy, not just MS's bottom line. Think of what would have to be spent on the upgrades or change outs?

Too many people have invested in MS products to just shut it down, and just like England won't wake up one morning and start driving on the right side of the road, MS products will remain in service. (I'm not trying to imply that the left side is the incorrect one, just illustrating the size of the problem)

Reports like this do seem to show MS in a very bad light, but how it gets fixed will be even more interesting. When government types want to show they are doing something about spam, will they do anything to make MS responsible, or make MS fix it? Probably not, so the real answer to spam, or answers, is to implement measures that do not rely on the end user, or the end user's OS to fix it.

IMO, This means that ISP's are going to have to sandbox segments of their networks to throttle spam, and that cost will be passed on to consumers, or possibly will be borne by the ISP for bragging rights about having less spam than any other ISP, in much the same way that the Bell companies used to do advertising about what they are spending to improve services for consumers.

This also leaves me with a suspicion about the marketing team for Vista? How better to fix XP SP2 than to upgrade to Vista?

Re:

[Pooh22]

The end-users need incentives to not polute the (digital) environment, so sending bills in return for sending spam is helpful.

In order to make it acceptable, an ISP could start by dealing out points first (adding or subtracting, like traffic violations cause points to be taken off your license in some countries). They could give positive rewards for not sending spam and eventually charge people when they do send spam.

I don't see any other way, because people just don't learn if it's for free.

Simon

nmap?

[goarilla]

I wonder tho how they ... know which os the bots are running?
i mean i use nmap, and other portscanners myself but the OS detection
is just a sane guess and far from perfect

I also wonder what the 0.05 % of other OS'es are because i do think
this malware is written on the win32 api, so i rather guess these were inconclusive
OS fingerprinting and/or *Nix systems running a virtual machine or ... wine ...
if this is possible (i'm not trying to troll here)

And if this is possible i do want to know what kind o

Re:

[Cruise_WD]

If you RTA, you'll find that they know because the Trojan itself logs which machines it's infecting, presumably because the people behind it like to know what's working and what isn't. Therefore this data is coming straight from the (trojan) horse's mouth...*badum bish*

It's amazing how complex pump and dump schemes are

[antifoidulus]

getting. A few weeks back I read an article that stated that some crackers had managed to get into the accounts of some of TD Waterhouse's investment clients. Since most of these accounts were retirement accounts liquidating them and stealing all the assets would have been difficult, required a lot of paperwork, and ran a much higher risk of getting caught. So instead what the attackers did was liquidate all the assets of the victims and then used those assets to buy a bunch of pump and dump stocks(high demand low supply=much higher prices). Pumped the value of the stock up significantly then as the name suggests, dumped it.
As much as I think they are scum for doing so, you have to admit that was pretty creative....

how effective is it?

[RingDev]

Do these pump and dump scams even work? If so, by what kind of margins?

-Rick

Re:

[mgblst]

Yes, 7.

Re:

[spaceyhackerlady]

Just to reiterate what these scum are doing:

1. Buy some really cheap stock at a really cheap price.
2. Hype it to victims.
3. Sell it to victims at inflated prices. Pocket the profit.
4. Victims are now stuck with a worthless stock that they can only sell at a large loss.

They usually work for the pump and dumper. Everybody else gets screwed. That's why it's a scam.

The companies are real, and you can look them up on NASDAQ [nasdaq.com] or Pink Sheets [slashdot.org]. I've looked a few of them up, and they all show an enormous spi

Re:

[KokorHekkus]

Do these pump and dump scams even work? If so, by what kind of margins?

A previous article posted on Slashdot indicateda a return between 4.9% to 6% (per scam) when it works. See http://it.slashdot.org/article.pl?sid=06/08/25/182 1256 [slashdot.org]

What is the Top500 ranking?

[Thagg]

This network of some 73,000 machines has to rank as one of, if not the, leading supercomputer in the world. Why aren't they ranked in the Top500 list?

Thad

How many of the 70,000 are elderly?

[AceCaseOR]

I recently helped an elderly neighbor secure her computer (I was paid for this service, and I make sure I do get paid every time I get called over for help) by installing some good firewall and anti-virus programs (as well as setting up Firefox and Thunderbird for their primary browsers. When I ran a virus scan on her computer (I installed AVG, as her McAfee subscription had expired), I found several viruses and malware programs on there, all of which I removed, which came with games she downloaded (stuff like mahjong and solitaire). I regret not writing down what viruses she had gotten infected with, so I could find out what she did.

I did the same thing on my grandmother's computer as well (when she was alive), and odds are there are a lot of seniors who are online and engage in a lot of bad habits that we know are bad - including running IE with minimal protections, opening strange attachments, and so forth. This is not a new problem, and, frankly, a problem that only education (or getting 75% of seniors to switch to Mac OS or Linux) can fix.

Short positions

[bperkins]

If it were possible to take short positions on these stocks, and people would chort rather than buy the stocks that are pumped, then the financial incentive for the pump and dumpers would go away, as would the spam.

govt action

[MooseTick]

I don't see why the government doesnt go after companies using spam as a selling technique. They still have to recieve money somehow and that can be traced. If the G would shut a few down and lock a few people up for a deacade then there would be a lot less spamming going on.

Re:

[oahazmatt]

I don't see why the government doesnt go after companies using spam as a selling technique. They still have to recieve money somehow and that can be traced. If the G would shut a few down and lock a few people up for a deacade then there would be a lot less spamming going on.

Because once we authorize the government (or let them authorize themselves) to keep eyes on botnets, there is a possibility that the government may begin to overextend itself onto the Internet in an unfavorable manor.

How do these bots spread?

[jonwil]

Email? (in which case why dont more ISPs run good email virus scanners? Is there a free (as in beer) email virus scanner out there for those email server admins who cant afford to buy one? (or are there reasons other than cost as to why email server admins and ISPs and stuff arent routinely scanning email as a matter of couse?)

Exploits in the OS? (why arent ISPs blocking ports like MS-RPC and MS file sharing (things that shouldnt be going out over the internet anyway) for example)?

Is there something the SEC

Re:

[cdrguru]

For an ISP of any size mail filtering is a significant problem. You don't just add something onto the mail server farm without taking a pretty severe performance hit. I do not believe there is anything free that can handle a substantial load.

Another factor is that most of the very cautious folks I deal with have a real simple solution - no attachments, period. ISP's cannot implement something like that. They can block executable attachments, but that isn't really effective any longer. From what I under

Subject

[Legion303]

There's a lot of humor potential in going to a site laced with ads and a list of 30 sponsors to read about spam.

Where's law enforcement on this?

[Animats]

Those guys shouldn't be that hard to find with enough law enforcement effort. Get a credit card from a cooperating bank. Put a trace on it. Buy some Viagra from a spam. Watch where the money goes, which is probably some bank in a high-crime country. Visit the bank and talk to them. Threaten to have their abilty to process credit cards cut off. Pry the actual payee out of them. Discover that it's another intermediary and start over.

This is what we pay the FBI for. This is why the FBI has field offices outside the US. This is why the Financial Crimes Information Network [fincen.gov] exists.

The FBI's Internet-related criminal enforcement [fbi.gov] unit has gotten soft. They sit up in Baltimore and send out child pornography, then go after the people they've entrapped. The process is even mostly automated [fbi.gov] now. That's an easy way to get their stats up, and fits the Bush administration's "regulate sex, not business" mindset, but doesn't solve crimes that have victims. Something to push on after Jan. 20, when the Democrats take Congress and can start asking hard questions of the executive branch.

Re:

[Animats]

• 15 USC 7701 [cornell.edu], the CAN-SPAM act.
• 47 USC 1030 [cornell.edu], the Computer Fraud and Abuse Act

The FBI has an office in Moscow [usembassy.gov]. And smaller offices in most of the capitals of the former Soviet sphere, including Bucharest, Kiev, Prague, and Tbilisi. They have to work through the local authorities, which they routinely do, with moderate success.

Re:

[cdn-programmer]

Its like going after Boeing because someone put some tape over the port that allows outside air to get at the gauge that measures air pressure and estimates elevation on a 757.

You can point your finger all you want at the maintenance worker who didn't read the warnings in GIANT PRINT - but Boeing was still sued and paid.

Boeing was not being irresponsible. I do not think the same can be said of Microsoft because many of the security problems have been pointed out CONSTANTLY since before 1995.

Re:

[shark72]

"Thats crazy... that's like going after P2P admins for users sharing illegal content. It would never fly."

It's not like that at all, but that's due to a distinction that's apparently too fine for some people.

Take a look at your favorite torrent tracker. Unless it's legaltorrents or something of its ilk, you know they set it up to capitalize on the huge demand for pirated material (and to make ad money off same), you know most of the traffic is pirated material, and you know that the admin knows this.

Re:

[Thansal]

Create a piece of malware that installs a modified version of a free anti-malware program?
Something runs invisibly in the background, auto updates (with out informing the user) etc etc etc.

Now infect as many computers as you can (And ofcourse have it propigate itself).

There yah go, we have solved the malware problem!

Note: I don't ACTUALY endorse this idea. I don't believe in the ends justifying the means. Personaly I think that computer manufacturers/MS (and MS has been doing this, and I am glad that they

Re:

[99BottlesOfBeerInMyF]

Seeing the complexity of a botnet like this is scary. The people responsible for this kind of thing are intelligent, always evolving and don't care about any of the repercussions of their actions.

Yeah, but you should see the security guys... way smarter.

It seems that any proposed solution we can come up with to combat spam will just be worked around shortly after it is implemented.

That depends upon the nature of the solution. This is not an unsolvable problem. It is mostly a matter of motivation.

T

Re:

[99BottlesOfBeerInMyF]

The problem isn't "Windows is insecure", the problem is that people are given a general-purpose computing instrument and they want a web & email appliance.

Sort of. People want a little more than the web and e-mail. They want word processing, games, and maybe a few other applications. But OS's are not designed to meet the needs of the common user, and they should be set up with defaults that make sense.

Most of this stuff is not installed because of security exposures in that allow stealh installatio

Re:

[King_TJ]

Nope! Not a viable or reasonable solution. You think the RIAA looks bad now for suing grandmas and small kids?!?

Think of all the computer users out there who did nothing more than purchase a brand new PC in order to use it exactly for its "intended purposes". (writing school papers, getting on the Internet to read web sites and do email, and play a few games) The fact that they get hijacked and serve as part of a bot-net while being used as-advertised means the fault doesn't lie with the end-user!

Put yo

Re:

[ummit]

I hear you, but: put yourself in the shoes of "Joe Homeowner" for a moment, if you will. You know nothing about chemistry or combustion. You simply purchased your house because you needed a roof over your head. But the law requires you to install smoke detectors (and, in many jurisdictions now, also carbon monoxide detectors). In fact, the reason this is a law is precisely because the average homeowner knows nothing about chemistry or combustion; that's why people need emphatic (enforceable) reminders to