Deconstructing a Pump-and-Dump Spam Botnet

Behind the Front writes "eWeek has teamed up with Joe Stewart, a senior security researcher at SecureWorks in Atlanta, to show the inner working of a massive botnet that is responsible for the recent surge of 'pump and dump' spam. It's a detailed picture of how these sleazy operations work and why they're so hard to shut down. Sobering numbers: 70,000 infected machines capable of pumping out a billion messages a day, virtually all of them for penis enlargement and stock scams. Excellent graphics, too, including one chart that shows that Windows XP Service Pack 2 is hosting nearly half the attacked machines."

Comments

Filter

[insecuritiez]

If more ISPs did egress filtering of email this sort of thing would be harder to do.

Re:Filter

[jfengel]

I hear that. It just doesn't seem unreasonable to me to cut off a customer who is sending tens of thousands of email per day. Put the very few with a legitimate reason on a white list (after a phone call) and cut the rest off until they clean up their act.

As Heinlein said, the answer to any question beginning with "Why don't they..." is "money". Presumably the ISPs figure you'll just take your business and your bot-infested computer elsewhere. But maybe if a few major ISPs got together and agreed to all do it, they'd cut off enough spam to make their customer bases happier, and attract back those customers who gave up in frustration.

Re:Filter

[RichMan]

> No, just block port 25 to all servers other than the ISPs for dynamic IP addresses.

I thought I paid for IP access. Deliberate port blocking by my ISP is blocking services I pay for.

IP access means IP access, it does mean port 80 web surfing only. Any steps toward that are plain wrong.

I agree it is a wild world out there but it is a problem of weak clients. The service provider should be blind unless a client is affecting network performance beyond their paid for slice. Then the client should be totally blocked.

Re:Filter

[Hognoxious]

If you are not capable of doing either of those things, then you should not have the privilege.

What if I don't want to go jump through hoops, or pay double for the privelege? What if I want to acess my work mail server from home? Or a clients? Or I just want to access the email that I've been using for years via pop/smtp?

Are you one of those imbeciles at Belgacom or something? Because they implemented the same cretinous strategy (without any advance warning, I may add) as you're suggesting.

Re:Filter

[tha_mink]

I think everyone is missing the point here. The problem really isn't spam. It's the fact that there are botnets out there that are 70,000 strong. Thank god they're only sending enlarge-your-penis emails. Instead of spending energy trying to stop the symptom, let's try and stop the disease. Forget the email, let's figure out a way to stop the infections in the first place. Then there's the issue of cutting off the funding. Why not try and stop the funders of spam. I think that BlueSecurity had it completely right. Piss off the people paying the spammers, and you stop the spam. Nobody's going to send spam for fun, and if they did, maybe we wouldn't mind reading them so much. 1. Stop the infections 2. Stop the funders of spam. 3. Profit! It's a simple as that. I hate how people miss the point on this spam stuff. The spam is only the symptom.

Infection vs Market Share

[MrSplog]

The charts would be a lot more interesting if they had them compared to market share. then you've got to consider that people are more likely to target the biggest market share. i mean, how many virus writers are targeting FDOS?

Rebuild the email protocol

[Hoi Polloi]

It is time to rebuild the email protocol. It needs to be redesigned to cope with modern systems and security needs. The pain of the transition would be worth it. It is just too easy to spoof header info now.

Re:Rebuild the email protocol

[Archangel Michael]

The "we can't change anything because it is too hard waaaaaaa" post.

Thank you for being a wimp.

thats okay, but how to detect this infection?

[Anonymous Coward]

Perused the article to know how to find out if my computer is infected or not but couldn't find anything. This is such an important news for Windows users, at least tell something abou thow to verify if a particular windows machine is having this problem.

C'mon

[Tarlus]

Well of course Windows is going to be in the majority of affected machines... There is a dramatically higher number of people in the world using Windows than any other OS, so... wouldn't it make sense?

As a proud user of Kubuntu, I can relate to /.'s tendency to point out everything that appears to be wrong with Windows... but come on, isn't it a little much to explicitly point it out in this case?

Re:C'mon

[Mark Hood]

Actually, the dig was at Windows XP SP2 in particular - not just Windows generally.

If these bots have control over 'the most secure Windows yet', then that is worthy of note.

Mark

PS Yes, I know the link is from 2004 - but they've not released anything since, so it must still be true, right?

I'm just surprised that those spams still ...

[Jawood]

work. After all, the folks who are doing the "advertising" must be getting some sort of return.

Which leads me to wonder about the folks who actually believe that those penis enlargement pills work.

And as far as the "pump and dump" spam goes, are there folks who beleive those spams? Or are they of the mindset of the "greater sucker"? Meaning, if I buy this stock now, after this spam circulates, there will be others who buy this shit stock and push up the price allowing me to make money.

Yeah, I know the guy who originates the "buy" recomendation is hoping for everyone to buy the stock, but what makes some of the recipients think they'll make out?

Re:eweek confirms it: Linux and Mac are dying!

[mrjb]

Do you really think that 0.05% of all spam comes from Linux, BSD, MacOS, Solaris and OS/2 lumped together? Then I'll have to disappoint you. Look again. Windows 95 is curiously absent from the graph. How big a part of 0.05% do you think it could handle?

Hit the nail right between the eyes.

[Rob T Firefly]

This is the basic problem with any single antispam measure, or really any single computer security measure.

1. Someone comes up with a defense mechanism that works well.
2. It works so well that more people use it.
3. It becomes popular enough for the bad guys to beat, so they do.
4. The defense becomes useless, forcing someone to come up with a new defense.
5. Goto 1.

Re:where does it end?

[ummit]

I hear you, but: put yourself in the shoes of "Joe Homeowner" for a moment, if you will. You know nothing about chemistry or combustion. You simply purchased your house because you needed a roof over your head. But the law requires you to install smoke detectors (and, in many jurisdictions now, also carbon monoxide detectors). In fact, the reason this is a law is precisely because the average homeowner knows nothing about chemistry or combustion; that's why people need emphatic (enforceable) reminders to install these safety devices.

So a law that mandated safe computing clearly would not be out of the question, and would not be "blaming" those computer users who did nothing more than purchase a brand new PC in order to use it for its intended purposes.

Subject

[Legion303]

There's a lot of humor potential in going to a site laced with ads and a list of 30 sponsors to read about spam.