Inside the Grum Botnet 34
tsu doh nimh writes "An examination of a control server seized in the recent takedown of the Grum spam botnet shows the crime machine was far bigger than most experts had assumed. A PHP panel used to control the botnet shows it had just shy of 200,000 systems sending spam when it was dismantled in mid-July. Researchers also found dozens of huge email lists, totaling more than 2.3 billion addresses, as well evidence it was used for phishing and malware attacks in addition to mailing pharmacy spam. Just prior to its takedown, Grum was responsible for sending about one in six spams worldwide."
And suddenly (Score:3)
200,000 voices were silenced.
Not particularly good voices, with anything worthwhile to say.
Re:And suddenly (Score:4, Insightful)
Actually, 200,000 voices with only one mind.
Sort of like a political action committee
Re: (Score:2)
Or the Borg?
Someone had to toss that in there...
Spams still coming (Score:3)
Even with the Grum Botnet taken offline, my email address is still getting all kinds of spam and scam, every single day
Like others, I set up spam filters save the clutters, but I do not know how many genuinely worthy messages my spam-filter had mistakenly deleted
Those goddamn spammers have ruined it
And yet... (Score:4, Interesting)
spam levels have increased since the takedown!
http://www.eleven.de/botnet-timeline-en.html [eleven.de]
fast forward to Grum Botnet part of timeline.
Re: (Score:2)
Don't worry... the voices weren't silenced; they just were required to switch to another communications mechanism. Grum's gone, but the people using it are still around, and sending their spam via other means. You will still get your links to HGH pills, botnet infectors and fake AV software.
Comment removed (Score:4, Insightful)
Re: (Score:3)
More evidence that the law is working.
Law? Try people actually working on it.
You can have all the laws you want, but until people set themselves to backtracking this junk, finding the servers and maybe even catching those behind them, the laws mean exactly nothing.
It is nice to see them working on it, but I think more work could be done a little faster.
Re: (Score:2)
You're spreading fud. This is in no way CAN-SPAM compliant.
Law enforcement jumped the gun here (Score:5, Funny)
One man's botnet is another man's beowulf cluster
Many people looked forward to these daily emails offering vital medications, herbal alternatives for male enhancement, and mortgage refinancing opportunities
Grum, you will be missed!
Why am I still getting so much spam then? (Score:1)
Yet it seems like I am getting more and more spam every day. You would think shutting down a server responsible for about 16% of spam, I would see some drop.
Notify ISP's to Notify Infected Customers? (Score:2)
Why can't they get the IP's of most of the infected computer, send those IP's w/time stamps to ISP's and require those ISP's to send letters to the infected customers letting them know that they help assist in sending billions of email SPAM and to get their computer cleaned? Maybe it will scare some people that feel they aren't vulnerable into realizing they are.
I donno, it's a thought. I'm sure something could be improved upon that.
Re:Notify ISP's to Notify Infected Customers? (Score:4, Insightful)
Money (Score:3)
Re: (Score:2)
200,00 X 6 = 1,200,000 (Score:2)
This implies that there are about 1.2 million bots worldwide. Seems low.
Re: (Score:3)
This implies that there are about 1.2 million bots worldwide. Seems low.
True.
Perhaps the others are all at work managing sock-puppets on facebook.
Re: (Score:1)
This implies that there are about 1.2 million bots worldwide. Seems low.
True.
Perhaps the others are all at work managing sock-puppets on Slashdot.
There. FTFY. Courtesy of your friendly neighborhood sock puppet. :)
Re: (Score:2)
That assumes other botnets send the same number of spam emails per bot as Grum. Given it is the largest, and probably has the largest address list, it probably sends more spam per bot than other botnets. TFA says it had the capability of sending 18b spam message per day, which is about 90k messages per bot. Other botnets might be only sending 50k or 10k per bot per day.
Re: (Score:2)
> Given it is the largest... ...that we know of.
Re: (Score:2)
This implies that there are about 1.2 million bots worldwide. Seems low.
Not if all of the spam is coming from the same house [dilbert.com].
Re: (Score:2)
Sounds about right. I imagine many many times that number get infected every year though. To remain infected and a functioning part of the botnet you need it to stay on the internet, not have it's antivirus updated, not have security updates for the OS, not fall into disuse, not taken in for service and still work without the owner's knowledge that it is infected.
What kind of person would allow those conditions to occur? Grandma probably does, somebody probably set up the computer for her, she doesn't kn
Re: (Score:2)
You have a remarkably high opinion of the average computer user.
Re: (Score:2)
What kind of person would allow those conditions to occur?
You're ignoring all the Chinese, Indians, Pakistanis, Indonesians, ... all running pirated versions of Windows, possibly with the malware pre-installed with the pirated OS. Add poorly secured, or ancient and not updated, Linux and *BSD installs. These needn't even be home users. Whole companies in these countries have been known to rely on pirated OSs.
Re: (Score:2)
This implies that there are about 1.2 million bots worldwide. Seems low.
Grum was responsible for 1/6 of spam volume, not 1/6 of world botnet size.
Yes (Score:1)
Drawings of Natalie Portman, naked and petrified? Sign me up, as it is now I have to browse Deviantart profiles and it takes forever.