Deconstructing a Pump-and-Dump Spam Botnet

Behind the Front writes "eWeek has teamed up with Joe Stewart, a senior security researcher at SecureWorks in Atlanta, to show the inner working of a massive botnet that is responsible for the recent surge of 'pump and dump' spam. It's a detailed picture of how these sleazy operations work and why they're so hard to shut down. Sobering numbers: 70,000 infected machines capable of pumping out a billion messages a day, virtually all of them for penis enlargement and stock scams. Excellent graphics, too, including one chart that shows that Windows XP Service Pack 2 is hosting nearly half the attacked machines."

Filter

If more ISPs did egress filtering of email this sort of thing would be harder to do.

Re:Filter

> No, just block port 25 to all servers other than the ISPs for dynamic IP addresses.

I thought I paid for IP access. Deliberate port blocking by my ISP is blocking services I pay for.

IP access means IP access, it does mean port 80 web surfing only. Any steps toward that are plain wrong.

I agree it is a wild world out there but it is a problem of weak clients. The service provider should be blind unless a client is affecting network performance beyond their paid for slice. Then the client should be totally blocked.

Re:Filter

My ISP has a web-based configuration utility that allows me to set a server-side firewall to one of several default values. One of their options blocks several commonly-exploitable ports on Windows. I don't use those ports for anything, and I have my own firewall so those ports shouldn't reach my Windows boxes in any way whatsoever, but I set it to block them anyway. (This was the default setting, actually.)

Something similar would work fine. Block port 25 to SMTP by default and have a web config utility to change it. If you really wanted, you could set it up to email the user if they tried accessing port 25 when it was blocked ("You might be trying to get past this firewall. Or, you might have a virus. Here's how you can find out, and here's how you can disable it if you need . . . ")

Re:Filter

Something similar would work fine. Block port 25 to SMTP by default and have a web config utility to change it. If you really wanted, you could set it up to email the user if they tried accessing port 25 when it was blocked ("You might be trying to get past this firewall. Or, you might have a virus. Here's how you can find out, and here's how you can disable it if you need . . . ")

I like that idea. Virus tries sending out 10,000 emails, user gets 10,000 emails saying "You might have a virus....".

Re:Filter

If you are not capable of doing either of those things, then you should not have the privilege.

What if I don't want to go jump through hoops, or pay double for the privelege? What if I want to acess my work mail server from home? Or a clients? Or I just want to access the email that I've been using for years via pop/smtp?

Are you one of those imbeciles at Belgacom or something? Because they implemented the same cretinous strategy (without any advance warning, I may add) as you're suggesting.

Re:Filter

I hear that. It just doesn't seem unreasonable to me to cut off a customer who is sending tens of thousands of email per day. Put the very few with a legitimate reason on a white list (after a phone call) and cut the rest off until they clean up their act.

As Heinlein said, the answer to any question beginning with "Why don't they..." is "money". Presumably the ISPs figure you'll just take your business and your bot-infested computer elsewhere. But maybe if a few major ISPs got together and agreed to all do it, they'd cut off enough spam to make their customer bases happier, and attract back those customers who gave up in frustration.

Re:Filter

I think everyone is missing the point here. The problem really isn't spam. It's the fact that there are botnets out there that are 70,000 strong. Thank god they're only sending enlarge-your-penis emails. Instead of spending energy trying to stop the symptom, let's try and stop the disease. Forget the email, let's figure out a way to stop the infections in the first place. Then there's the issue of cutting off the funding. Why not try and stop the funders of spam. I think that BlueSecurity had it completely right. Piss off the people paying the spammers, and you stop the spam. Nobody's going to send spam for fun, and if they did, maybe we wouldn't mind reading them so much. 1. Stop the infections 2. Stop the funders of spam. 3. Profit! It's a simple as that. I hate how people miss the point on this spam stuff. The spam is only the symptom.

Shorting won't work...

No broker will allow you to short a pink sheet stock, which the overwhelming majority of pump and dump spam deals with.

Solution to Pump and Dump

Get pregnant, then that little piece of spam will have to provide child support for 18 years.

Yeah, but it can't post to Slashdot

Did we call or DID WE CALL IT?!?

ESNX up $3.13 from open of trading...

Infection vs Market Share

The charts would be a lot more interesting if they had them compared to market share. then you've got to consider that people are more likely to target the biggest market share. i mean, how many virus writers are targeting FDOS?

That was a bad picture

I'm sorry, but the terms "Penis Enlargement" and "Excellent Graphics" were situated a bit too close together in that summary for my liking.

Rebuild the email protocol

It is time to rebuild the email protocol. It needs to be redesigned to cope with modern systems and security needs. The pain of the transition would be worth it. It is just too easy to spoof header info now.

Re:Rebuild the email protocol

Your post advocates a

(x) technical ( ) legislative ( ) market-based ( ) vigilante

approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)

( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
(x) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
( ) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business

Specifically, your plan fails to account for

( ) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
( ) Asshats
( ) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
(x) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
( ) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
( ) Extreme profitability of spam
( ) Joe jobs and/or identity theft
( ) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
( ) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook

and the following philosophical objections may also apply:

(x) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
( ) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough

Furthermore, this is what I think about you:

(x) Sorry dude, but I don't think it would work.
( ) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your
house down!

Re:Rebuild the email protocol

The "we can't change anything because it is too hard waaaaaaa" post.

Thank you for being a wimp.

Re:Rebuild the email protocol

(x) Yes, I agree
( ) Nope, you're wrong

thats okay, but how to detect this infection?

Perused the article to know how to find out if my computer is infected or not but couldn't find anything. This is such an important news for Windows users, at least tell something abou thow to verify if a particular windows machine is having this problem.

I'm glad I run my own mail server

And implemented greylisting [wikipedia.org] on it. Cut out almost %100 of the spam I have been receiving (Was up to 50 emails a day, now I think only one has gone through since I installed postgrey on my mail server in 1.5 months!). Unfortunately, this is easy to get around, so it should only be a matter of time till that is worked around and becomes useless in the spam fight. By that time, hopefully another anti-spam method comes up...

Hit the nail right between the eyes.

This is the basic problem with any single antispam measure, or really any single computer security measure.

1. Someone comes up with a defense mechanism that works well.
2. It works so well that more people use it.
3. It becomes popular enough for the bad guys to beat, so they do.
4. The defense becomes useless, forcing someone to come up with a new defense.
5. Goto 1.

"unknown country"

i guess many of those from "unknown" are actually german since germanys largest ISP cannot get its head out of his arse and finally change hostnames to something.DE.. instead it is .net all the time for most germans. This also always causes great disconcert when you have to explain logs to a customer and the damn script does not base location on IP but on host..

eweek confirms it: Linux and Mac are dying!

From the graphs, it's obvious that Linux, BSD, and MacOS lumped together are only 0.05 percent of the desktop market!!

Re:eweek confirms it: Linux and Mac are dying!

Do you really think that 0.05% of all spam comes from Linux, BSD, MacOS, Solaris and OS/2 lumped together? Then I'll have to disappoint you. Look again. Windows 95 is curiously absent from the graph. How big a part of 0.05% do you think it could handle?

Windows 95

Hackers and Spammers no longer support Windows 95. It's too hard to write worms, bots, and viri that are backward compatible.

How can we compete?

Seeing the complexity of a botnet like this is scary. The people responsible for this kind of thing are intelligent, always evolving and don't care about any of the repercussions of their actions. It seems that any proposed solution we can come up with to combat spam will just be worked around shortly after it is implemented.

From the article:
"the Trojan comes with its own anti-virus scanner--a pirated copy of Kaspersky's security software--that removes competing malware files from the hijacked machine"

I never would have thought of something like this. Trojans fighting for territory... crazy.

The software uses proxy servers to avoid blacklisting bot IP addresses, harvests email addresses from the infected machines and randomly changes images used in image-based spam to throw off anti-spam technologies. The people behind this are clever. How can we compete effectively?

C'mon

Well of course Windows is going to be in the majority of affected machines... There is a dramatically higher number of people in the world using Windows than any other OS, so... wouldn't it make sense?

As a proud user of Kubuntu, I can relate to /.'s tendency to point out everything that appears to be wrong with Windows... but come on, isn't it a little much to explicitly point it out in this case?

Re:C'mon

Actually, the dig was at Windows XP SP2 in particular - not just Windows generally.

If these bots have control over 'the most secure Windows yet' [com.com], then that is worthy of note.

Mark

PS Yes, I know the link is from 2004 - but they've not released anything since, so it must still be true, right?

I'm just surprised that those spams still ...

work. After all, the folks who are doing the "advertising" must be getting some sort of return.

Which leads me to wonder about the folks who actually believe that those penis enlargement pills work.

And as far as the "pump and dump" spam goes, are there folks who beleive those spams? Or are they of the mindset of the "greater sucker"? Meaning, if I buy this stock now, after this spam circulates, there will be others who buy this shit stock and push up the price allowing me to make money.

Yeah, I know the guy who originates the "buy" recomendation is hoping for everyone to buy the stock, but what makes some of the recipients think they'll make out?

Okay, so now there are statistics.....

But when, if ever, will anyone shut down the MS machine? Never is when. MS is far to invested into large corporations and government institutions to ever have anyone, never mind MS, say, all windows products must be updated or dumped. Its just not going to happen. If you owe the bank $1000 dollars, you are in trouble if you're late on the payments, if you owe the bank $10,000,000,000 dollars and you're late, the bank is in trouble.

Right now, the later is more the case. If MS had to upgrade or recall all XP products, it would cause a large harm to the economy, not just MS's bottom line. Think of what would have to be spent on the upgrades or change outs?

Too many people have invested in MS products to just shut it down, and just like England won't wake up one morning and start driving on the right side of the road, MS products will remain in service. (I'm not trying to imply that the left side is the incorrect one, just illustrating the size of the problem)

Reports like this do seem to show MS in a very bad light, but how it gets fixed will be even more interesting. When government types want to show they are doing something about spam, will they do anything to make MS responsible, or make MS fix it? Probably not, so the real answer to spam, or answers, is to implement measures that do not rely on the end user, or the end user's OS to fix it.

IMO, This means that ISP's are going to have to sandbox segments of their networks to throttle spam, and that cost will be passed on to consumers, or possibly will be borne by the ISP for bragging rights about having less spam than any other ISP, in much the same way that the Bell companies used to do advertising about what they are spending to improve services for consumers.

This also leaves me with a suspicion about the marketing team for Vista? How better to fix XP SP2 than to upgrade to Vista?

Blue Frog, where are you?

Blue Security had a good thing going with their "Blue Frog" software. At one time there was an open source version being developed. Anyone know the status?

Hmm, maybe they shouldn't have worded it this way

virtually all of them for penis enlargement ... Excellent graphics, too,

nmap?

I wonder tho how they ... know which os the bots are running?
i mean i use nmap, and other portscanners myself but the OS detection
is just a sane guess and far from perfect

I also wonder what the 0.05 % of other OS'es are because i do think
this malware is written on the win32 api, so i rather guess these were inconclusive
OS fingerprinting and/or *Nix systems running a virtual machine or ... wine ...
if this is possible (i'm not trying to troll here)

And if this is possible i do want to know what kind of measures the users of these non conclusive
Os fingerprinting scans used because ... it would stop many script-kiddies from trying to automatic crack your machines, if they can't find which OS you're running ...

Anyone has some tips about this in particular
How do i fool commonly used portscanners etc ... in their OS detection ... on Windows and *Nix systems?

where does it end?

I hope I'm not being Chicken Little [wikipedia.org], but there's much worse that botherds could do with their botnets than just sending stock scam and penis pill spam. I'm wondering if the only solution won't be for major governments to take major action (perhaps under the guise of national security), and I'm not sure this would be a bad thing. What if it were made a (minor) crime to operate a computer that's vulnerable to being a botnet node? The only question would be, who would pay for the cleanup: the vulnerable machine owners, Microsoft, or taxpayers?

It's amazing how complex pump and dump schemes are

getting. A few weeks back I read an article that stated that some crackers had managed to get into the accounts of some of TD Waterhouse's investment clients. Since most of these accounts were retirement accounts liquidating them and stealing all the assets would have been difficult, required a lot of paperwork, and ran a much higher risk of getting caught. So instead what the attackers did was liquidate all the assets of the victims and then used those assets to buy a bunch of pump and dump stocks(high demand low supply=much higher prices). Pumped the value of the stock up significantly then as the name suggests, dumped it.
As much as I think they are scum for doing so, you have to admit that was pretty creative....

how effective is it?

Do these pump and dump scams even work? If so, by what kind of margins?

-Rick

What is the Top500 ranking?

This network of some 73,000 machines has to rank as one of, if not the, leading supercomputer in the world. Why aren't they ranked in the Top500 list?

Thad

I don't know what to worry over

From the impressive slideshow
a) That spam trojans are out there and running rampant on infected machines
b) That a country named 'Unknown' is second only to the US when it comes to the Top 20 spam locales
c) that there haven't been a lot of respondents to the penis-enlargement emails, hence the widespread marketing campaign

Completely random thought (new windows patch?)

Since most infected computers on this botnet are XP SP2 and likely have Windows Firewall enabled on them... How hard can it be for MS to code up a patch to the firewall code that detects outgoing connections to TCP port 25 (SMTP) and throws a warning on the screen? Send the patch out over Windows Update. Your average Hotmail/Yahoo/Gmail user won't ever notice. People who use Outlook Express or some other SMTP-sending client may have to click a "yes, I'm actually sending e-mail" button when they send e-mail and suffer half a second of annoyance, and that's just assuming you alarm on every outgoing SMTP connection. There are probably better ways to do it. Something like this would completely wreck SpamThru's functionality, wouldn't it? Just a thought.

How many of the 70,000 are elderly?

I recently helped an elderly neighbor secure her computer (I was paid for this service, and I make sure I do get paid every time I get called over for help) by installing some good firewall and anti-virus programs (as well as setting up Firefox and Thunderbird for their primary browsers. When I ran a virus scan on her computer (I installed AVG, as her McAfee subscription had expired), I found several viruses and malware programs on there, all of which I removed, which came with games she downloaded (stuff like mahjong and solitaire). I regret not writing down what viruses she had gotten infected with, so I could find out what she did.

I did the same thing on my grandmother's computer as well (when she was alive), and odds are there are a lot of seniors who are online and engage in a lot of bad habits that we know are bad - including running IE with minimal protections, opening strange attachments, and so forth. This is not a new problem, and, frankly, a problem that only education (or getting 75% of seniors to switch to Mac OS or Linux) can fix.

Limits

youd be surprised the limits people go round to send legitimate emails, a company i worked for had a rate limit of x per 30 seconds and xx per 10 min period. even the legit customers phoned for advice on how to get around it.

Short positions

If it were possible to take short positions on these stocks, and people would chort rather than buy the stocks that are pumped, then the financial incentive for the pump and dumpers would go away, as would the spam.

Blue Frog

Too bad it died...

govt action

I don't see why the government doesnt go after companies using spam as a selling technique. They still have to recieve money somehow and that can be traced. If the G would shut a few down and lock a few people up for a deacade then there would be a lot less spamming going on.

How do these bots spread?

Email? (in which case why dont more ISPs run good email virus scanners? Is there a free (as in beer) email virus scanner out there for those email server admins who cant afford to buy one? (or are there reasons other than cost as to why email server admins and ISPs and stuff arent routinely scanning email as a matter of couse?)

Exploits in the OS? (why arent ISPs blocking ports like MS-RPC and MS file sharing (things that shouldnt be going out over the internet anyway) for example)?

Is there something the SEC can do? (perhaps finding the people who buy the stock, pay the spammers to send the spams, sit back and watch whilst their stock becomes a lot more valuable and then proceed to sell it all. (IANAL or a stockbroker but I dont think you can buy/own stock without at least some way to tell who you are).

Article is decidedly short on info

It did identify the trojan, but gave no info on how to check for the trojan or get rid of it.

The article mentions certain databases that were hacked to discover identities of potential victims to mail the pump & dump spew, but which databases were cracked? I think the owners of these databases are legally obligated to inform the folks who's data was acquired. Why are these databases not identified? Why have I not been contacted by any of these database owners? Since I am a recipient of the spew (700 to 1000 per day), I have to assume my data was among that which was cracked. I'd like to know who gave away my data....

All in all this article is no more than a rehash of old info on botnets. Give me some hard data I can use to to help me protect myself!!!!

Subject

There's a lot of humor potential in going to a site laced with ads and a list of 30 sponsors to read about spam.

Armchair analysis

So, let's look at what we have here: The vast majority of SPAM is aimed at small-cocked poor men who aren't too bright.

SPAM exists because it works.

People who respond to SPAM aren't to bright: they're replying to SPAM. This is confirmed by several people I know who are dimwits, who have replied to SPAM to "get a great deal". You know the type: they get great stereo speaker deals from the backs of moving vans.

The majority of SPAM has penis-enlargement and stock-scams as their subject matter.

So we need to educated the small-cocked men of the world, help them get decent jobs, and SPAM will be eradicated!

oh the irony

I just love it when things work out like this... both on the article page and on this very page that I'm typing on now there is a full color ad for Windows Server 2003 and the London Stock Exchange. Making the worlds computing systems more reliable one trojan infested botnet at a time...

How is blocking this a problem?

I don't see how blocking this is such a problem. If a machine suddenly starts pumping out email, the ISP cuts its net connection and phones the owner and asks about it. If the owner doesn't know about it, refuse them access until their machine is fixed, since after all it is the *owner's* responsibility to keep their computer clean.

Now, what am I overlooking? Why is that apparently so hard?

Pump and dump cannot work

The reason pump and dump scams do not work is because the initiators of the scam will have bought early at the low price, THIS IS RECORDED by stockbrokers, and REFLECTS NEW DEMAND for a stock. Then then send out these emails hoping to increase demand, and thus the price. Now, someone with some brains Understands That These Stocks are PUMP AND DUMP. Then then get short options on the stock.

surprise! the stock goes up for a while and crashes.

remember kids, the stock market transmits all known information near instantaneously through price. the price change is immediate, because participing in the stock market causes these changes.

the SEC can also easily learn who is pumping and dumping by analyzing buying patterns.

Where's law enforcement on this?

Those guys shouldn't be that hard to find with enough law enforcement effort. Get a credit card from a cooperating bank. Put a trace on it. Buy some Viagra from a spam. Watch where the money goes, which is probably some bank in a high-crime country. Visit the bank and talk to them. Threaten to have their abilty to process credit cards cut off. Pry the actual payee out of them. Discover that it's another intermediary and start over.

This is what we pay the FBI for. This is why the FBI has field offices outside the US. This is why the Financial Crimes Information Network [fincen.gov] exists.

The FBI's Internet-related criminal enforcement [fbi.gov] unit has gotten soft. They sit up in Baltimore and send out child pornography, then go after the people they've entrapped. The process is even mostly automated [fbi.gov] now. That's an easy way to get their stats up, and fits the Bush administration's "regulate sex, not business" mindset, but doesn't solve crimes that have victims. Something to push on after Jan. 20, when the Democrats take Congress and can start asking hard questions of the executive branch.

Microsoft accountable

Isn't it about time Microsoft was held accountable for it's part in this mess? And I don't mean getting all it's XP users to upgrade to Vista, I mean doing something to solve the problem now. Surely a massive publicity campaign together with some patches would do a huge amount of good here?

Time for ISPs to kick them off their networks

If an ISP detects an inordinate amount of traffic that is clearly spam related, then the ISP should dump that customer off their network until they get it cleaned up. Call the customer. Or email. Give them a chance to explain (it's always possible that the traffic is legit, even though it might not be "ordinary", and that should be OK). If the answer is "I have no idea why so much traffic is being sent from my machine on port 3456... and what's a port?" then kick them off the network. Tell them to go get a virus checker and get their system cleaned up and they'll re-enable them in a couple of days. If the traffic persists when they get back on, then dump 'em off for a week.

The problem is that to an ISP, you're just a $50 check every month. I guess they figure it's better for business to have a bunch of zombies on their network than it is to be without the monthly check from those customers.

Seriously, if the only way to get people to act with some level of responsibility is to kick them off the network, then so be it.

-S

Real solution to spam:

(a) have a system that automatically harvests spams

(b) append a request for contact info (name, actually address) to said spams

(c) have Evil Henchmen(tm) go door to door shooting people stupid enough to respond to the spams

(d) once the market is destroyed, spam will cease to be a problem

Just like crack, whores, smokes, and booze, as long as there are buyers, there'll be people willing to provide the "product."

-b.

70k hosts?

...If you dont mind me saying, a amatuer botnetter can manage that....Anyone who is 'talented' and knows what they are doing can easily manage 200k.

fix for spam: Capital Punishment.

All you gotta do is kill them. Once the first few heads roll, the rest of 'em will knock it off.

If they are overseas, hire the Israelis. They'll track the fuckers down and take 'em out. Once you pump a bag of bullets into the first few dozen, spam will go away.

RS

Class action against Microsoft

Why can't we organise a class action against Microsoft? It is their shitty code that is responsible for most of this... their shitty code and really poorly thought out security measures.

Then we should go after some of the large ISP who hide their brains in the sand (shit anyone) and pretend they do not know certain customer's machines are spewing night and day.

Nail it at the source

I don't mean the source as the botnet, but the source as the people who paid to use these services.

For the pump and dump scams in stocks at least, it is highly likely that the majoriry shareholder (probably the company itself) is behind this.

someting i find odd.

i find it odd that there is so many small penises out there looking for
larger penises for the penis enlargement scams to be so
profitable.
it kinda renews my self confidence.
penis

Re:Class action against Microsoft

Thats crazy... that's like going after P2P admins for users sharing illegal content. It would never fly.

Re:Disgusted...

I'd want to have the source code though. Wouldn't want to have a trojan installing itself, I'd rather compile it into place.
I may check the code, so Russian comments are not acceptable.

Re:It's never going to end, unless....

I know that if I were offered a job that didn't require me to travel, and it pays me enough money to get out of serious debt, I would probably jump at an opportunity to make $50,000 for writing a clever trojan. Wouldn't you? If you were about to loose your house and American Dream, and everything you worked for in the last 20 years after you got layed off because of outsourcing. An offer of an immediate cash outlay of $50,000 is a bit hard to turn down.

Sure, and I'll make another $200,000 on the backside of the deal selling software to delete the trojan after its usefulness has expired. Pump out more malware and then make money selling protection software. The perfect waterfront racket.

-b.

Re:Reminds me of Herry Potter...

Flamebait? When Lee Jordan said it he was greeted with nods and scattered applause...