P2P Spam?

Sgt York writes "In a NYT article (republished in the Houston Chronicle, no subscription required) experts at CERT, F-secure, Trusecure, and the Hall of Justice (see article) think that SoBig.F is a spam scheme in the making. They say that SoBig.F is the 6th variant in an ongoing experiment with the possible goal of setting up a distributed spam network, to be rented out to the highest bidder. If that is their goal, they are well on their way. Another disturbing note in the article is that "In the case of four of the six programs, a new version was launched immediately after the self-timed expiration date of the preceding one". SoBig.F expires in two weeks. "

Comments

Truly P2P if SOBIG.G contains the spam message

[JohnGrahamCumming]

I think the superheroes involved in the SOBIG fight miss the entire point.
The authors are probably testing the feasibility of sending out a virus (which
given the number of copies I receive) will happily be opened by people and
then simultaneously sending out spam messages to the same group of people.

There's no need for the SOBIG authors to control the machines after SOBIG has
been executed. They just need to include the spam message in the virus
itself.

That would make it truly P2P spam. Unsuspecting user X who opens SOBIG would
transmit the mechansim for sending more spam and his portion of the spam
deluge. Of course there could be a downside to all this, once the blacklist
people start cutting off EVERY ISP in the world because of spam messages SOBIG
would defeat itself because no one would be getting mail.

John.

Re:Truly P2P if SOBIG.G contains the spam message

[Brad Mace]

They'd need some big balls to associate their company name with a virus. Once the identity of the people unleashing viruses AND sending tons of spam in known, they won't exist for long. For that reason alone I'd say it's much more likely they'd be setting up a distributed spamming network.

Re:Truly P2P if SOBIG.G contains the spam message

[RatBastard]

But teh spam message is not for the person who's computer is infected. It's for every email recipient that that computer user knows. The P2P spam network created in this way would be HUGE and unblockable. Who is going to block every subnet on earth? Not gonna happen. The best we can hope for is that ISPs get smart and start blocking SMTP ports on all ip addresses not registered as SMTP servers.

This could turn into a VERY ugly mess.

Re:Truly P2P if SOBIG.G contains the spam message

[IM6100]

That's interesting. A formal registry of SMTP servers.

Will we soon be formally registering all people running an HTTPD in the same fashion?

Re:Truly P2P if SOBIG.G contains the spam message

[frankthechicken]

I thought this as well, until I realised that regular spam services are still profitable enterprises for their clients. If these companies can stand to be associated with spam, I'm fairly sure that can stand to be associated with a virus.

So the highest bidder get's to spam?

[iplayfast]

OK, so some company decides to buy. Wouldn't they now be liable for unauthorized use of the computers. Why would a company take the risk? I think this is a red herring, and that it's just another way for worm/virus writers to justify themselves to the world (and themselves).

This can't be right

[corebreech]

Couldn't we then find out who wrote the virus just by interrogating the companies who benefit from the advertising?

Re:This can't be right

[87C751]

Couldn't we then find out who wrote the virus just by interrogating the companies who benefit from the advertising?

Others have done this, but what they typically discover is a chain of fronts and cutouts that provide an insulating layer of plausable deniability. As soon as an investigation starts to traverse the chain, key links disolve and the trail goes cold. Besides, Mr. SoBig could easily market his zombie army's services without so much as a single customer even hearing his voice on the phone.

Re:huh?

[wmaker]

No one actually knows how he/she got the list though. The person wrote the virus, gains the list, and sells it. No questions asked about HOW he got the e-mail addresses.

A Bad Thing?

[sethadam1]

If the entire internet were absolutely smashed with spam, at leats one good thing might emerge - the will to actually combat it realistically!

With all the techno-dweebs on this site and all the fasntastic opinions about whitelists and blacklists and graylists and modifying SMTP and replacing SMTP and handshakes and authentication and a million other solutions, perhaps someone, somewhere, will finally being to make a dent in actually dealing with the spam problem.

Re:Bad plan

[Wiseazz]

Most companies that spam me on a regular basis probably aren't interested in PR.

Unless herbal penis enlargers are now a legit business. Last I checked, no such luck. Maybe if it worked... well, so I'm told.

Hence, GPG.

[sethadam1]

That's when encryption will be publically adopted.

Re:Hence, GPG.

[RollingThunder]

Not necessarily encryption, but more likely signing.

Re:Hence, GPG.

[Inode Jones]

Which will be useless unless you can prove that signing cannot happen without human intervention.

If the GPG secret key is on a Windoze user's hard drive, then what stops the virus from waiting in the background, sniffing the passphrase, then invoking GPG itself?

My prediction: viruses will be used for industrial espionage:

1. Infect home PC of target, and do nothing noticeable.
2. Wait until VPN into employer comes up.
3. Fetch secret info and store on hard drive.
4. Wait until VPN link is dropped and regular Internet access is once again possible.
5. Send secret info to instigator.

Re:Hence, GPG.

[IM6100]

Not hardly. If and when 'encryption' is publically adopted, it will be with a wobbly plug-in to Outlook Express or something similar. It'll become the new security nightmare.

Fixed hosts don't work, but...

[RobertB-DC]

I suspect that the 20 hardcoded download sites in the current variant are a proof-of-concept, not a future strategy. Every time a virus is exposed that tries to download from some fixed location, I've wondered why virus writers would even try such a thing, when it's obvious that white hats will reverse-engineer their code?

What if the next version uses something more flexible... like a Google search on some particular string? Spend a few months sprinkling links to the download on servers around the world, with pages containing some unique string (call it "foo123"). When the next virus activates, it does a Google search for "foo123", and downloads its replacement. As fast as hosts are removed, more can be created and indexed.

For even better effect, use a moderately common word or phrase that Google couldn't remove from its index without causing big problems.

On the non-technical side... I was struck by the post in a previous SoBig discussion that noted that this variant expires on 9/10, and if the F-Secure expert is right, that's not a good sign:

"I think the motivation is clear. It's money," said Mikko Hypponen, director of anti-virus research at F-Secure, an antivirus firm based in Finland that is decoding the illicit program. "Behind Sobig we have a group of hackers who have a budget and money."

If there's a budget and money, then there's organization, and I'm concerned about the organizations that might see 9/11 as a good day to launch a distributed attack.

Re:Fixed hosts don't work, but...

[Simon Brooke]

What if the next version uses something more flexible... like a Google search on some particular string? Spend a few months sprinkling links to the download on servers around the world, with pages containing some unique string (call it "foo123"). When the next virus activates, it does a Google search for "foo123 [google.com]", and downloads its replacement. As fast as hosts are removed, more can be created and indexed.

OK, let's see how you would do it...

The payload of the original virus would be a encrypted peer-to-peer daemon somewhat like Freenet, except that it would only allow uploads signed with a particular digital signature. The client would of course have to include the public key of that signature, but not the private key.

Once infected a machine would open a listening port and attempt to connect to machines chosen randomly but with a bias to its local class C (as with CodeRed). Once contact has been established the machines would exchange IPs so that each could recontact the other. Each machine would continue to probe for peers until it had found a certain number - say twenty - and then it would remain quiescent, just listening. Periodically (say weekly) it would handshake again with its known peers, and if any failed to handshake twice successively it would seek others until it had again reached quota.

Once the virus was widespread the author would send a signed file to one infected machine. The name of the file would be a unique string (for simplicity of exposition say a serial number, although any systematically unique string would do) so the first file the virus author injected might be 0001, the next 0002 and so on. The machine would accept the file as genuine because it could decrypt it with its local copy of the public key, and would pass it on unchanged to all the other infected nodes it knew about. If a machine had already received 0001 and was offered 0001 by a peer it would refuse it to save time and network congestion - not to be nice to other users, but because if the thing blocked up network bandwidth completely, it wouldn't be able to do it's own dirty work.

The signed files could contain

1. a list of targets and a date/time. When the action date/time in the file was reached, the virus would mount a DDoS attack on the hosts listed in that file for twenty four hours and then delete the file.
2. the URL of a file to load and then spam out in the same way the virus itself originally spread. Because this file doesn't have to be put up before the virus is launched it could be put up on any defaced site anywhere and need not be tracable back to the author.
3. a hotfix patch to the virus itself, which would immediately be installed and run.

This would be incredibly difficult to defend against because

• in DDoS mode the hosts to be attacked wouldn't be known until the attack file began to propagate - and it could propagate very, very fast indeed, since the peer-to-peer network has connected itself in advance.
• It would be impossible to introduce 'white' payloads into the network because only the author would have the necessary private key.
• Because of the upgrade facility, as defences against the virus became available the author could inject into the network 'hot fixes' which would work around these defences.
• Because the author could inject new signed files into any infected node, it would be very difficult to track down where they were being injected.

Furthermore, the network could be used to launch several sequential attacks, which would not even need to have been planned at the time the virus was written. The author could, in effect, sell use of a flexible, massively distributed mass-UCE/DDoS attack engine to the highest bidder...

Hang on, hang on... just wait until I get a patent on that idea!

sobig.M kills blacklists?

[glsunder]

What if the goal (or effect, either way) was to get things to the point where nearly everything was blacklisted for spam? The virus wouldn't have to send real spam, just fake spam in a way that would cause the person's ISP to be put on the blacklists. Once that happened, people would shut off the spam blocking software, and spam would reign supreme.

Holy Crap

[stratjakt]

They could be hunting spam relays. They could be looking to anonymously bounce kiddy porn. They could be looking for thousands of boxes to keep their warez .torrent files alive and kicking.

Hey, I just thought of that. That'd rock, be much easier and more effective than hunting for pubs. You even have one of your drones host the tracker in the first place.

Anyways, who cares. Patch your machines and shut up. We're seeing as many sobig stories as we are SCO, and it really isnt that big of a deal.

Eventually

[zantolak]

I'd rather not be a doomsayer, but seriously: If all the spam and viruses continue, people will get so sick of it that they'll take serious action. Since the anti-spam laws are both ineffective and draconian, and very few spammers have been successfully shut down, and worms, trojans, and viruses run rampant despite the availability of patches and better OSes: Everyone will be using a strict whitelist, ISPs will remove the ability to send and receive attachments, and HTML email will be disabled because of the scripting risk. The spammers and malware writers will have forced us to cripple our own communications. Just my 2c.
End wild prognostications.

Re:Eventually

[forkboy]

THe other possible scenario is that prosecutors will start going after the company that advertised via the spam. I'd like that solution, I've been saying that should be going on for years...spammers will go away if people are now afraid to use that method of marketing for fear of hefty fines.

Re:Unbelievable

[Nurseman]

Yeah, right. You do know that more jails and more jail time doesn't lead to less crime?

I dont know if that's the point, jail should be punishment for breaking the rules, and not worry about being a deterrent.

Re:SMTP IS DYING/DEAD

[symbolset]

Erm, my sendmail install seems to still be working, and (checking) yes, it still delivers mail. SMTP seems to still be working.

It's Exchange that seems to be dead. Given the sudden dearth of enlargement offers in my inbox, I have to say "it's a good thing."

Re:This is why ISPs are changing their SMTP rules?

[87C751]

My ISP is not blocking port 25, and I have a colocated server -- but I send my mail through the ISP's relay.

Ah, but does your ISP's relay allow you to use your own domain? I could do that too, but I'd have to use frobnitz@fuse.net or some such abomination as my return address. That's not why I own a domain.

S'ok, though... DaemonPortOptions and a quick 'killall -HUP sendmail' took care of everything.

Theory doesn't make sense

[KeithH]

If this theory were true, then the "test" virii would be much more benign. Since they have been quite noticable, people have been compelled to take steps to close the holes. I would suspect that the next variant will be much less of a nuisance than its predecessors simply because the target market has been substantially reduced.

No, if I was looking for a fun conspiracy theory, I would enjoy suspecting that Microsoft has decided that this is a good time have all their customers tighten up their security.

Occam's Razor

[janolder]

Come on boys and girls - I know it's fun to chat about conspiracies, but how likely do you think it is that some spammer creates a reasonably sophisticated worm like SoBig.[A-F] with the intent to create open relays when he can just as well use all the open relays out there instead?

Keep in mind that writing and releasing a virus/worm/trojan requires a bit of skill and time and has the nasty side-effect of carrying significant jail time. Spammers don't have skill (or they'd be engineers), spammers don't have time (they have to work around filters all the time) and several years of jail time might not be too appealing to spammers either. Piggybacking on SoBig's backdoor for the purpose of spamming is guaranteed to have some nice FBI folks knocking on your door, confiscating all your equipment and looking for evidence of virus creation. Just a matter of time until you're read your rights from there on.

I know people make a lot out of the fact that SoBig carries its own SMTP client engine. So what though? That feature enables SoBig to also use non-Outlook machines as staging areas. Simple.

Use Occam's Razor and some common sense and see SoBig as what it is: a plain old worm somebody wrote to show off to his friends that has nothing to do with spam. Somebody as skilled as the worm writer probably hates spam as much as the rest of us. Not that I'm justifying SoBig in any way, I just removed 570 copies of SoBig.F from my inbox. :-(