Deconstructing a Pump-and-Dump Spam Botnet

Behind the Front writes "eWeek has teamed up with Joe Stewart, a senior security researcher at SecureWorks in Atlanta, to show the inner working of a massive botnet that is responsible for the recent surge of 'pump and dump' spam. It's a detailed picture of how these sleazy operations work and why they're so hard to shut down. Sobering numbers: 70,000 infected machines capable of pumping out a billion messages a day, virtually all of them for penis enlargement and stock scams. Excellent graphics, too, including one chart that shows that Windows XP Service Pack 2 is hosting nearly half the attacked machines."

Comments

Filter

[insecuritiez]

If more ISPs did egress filtering of email this sort of thing would be harder to do.

Re:Filter

[jfengel]

I hear that. It just doesn't seem unreasonable to me to cut off a customer who is sending tens of thousands of email per day. Put the very few with a legitimate reason on a white list (after a phone call) and cut the rest off until they clean up their act.

As Heinlein said, the answer to any question beginning with "Why don't they..." is "money". Presumably the ISPs figure you'll just take your business and your bot-infested computer elsewhere. But maybe if a few major ISPs got together and agreed to all do it, they'd cut off enough spam to make their customer bases happier, and attract back those customers who gave up in frustration.

Re:Filter

[RichMan]

> No, just block port 25 to all servers other than the ISPs for dynamic IP addresses.

I thought I paid for IP access. Deliberate port blocking by my ISP is blocking services I pay for.

IP access means IP access, it does mean port 80 web surfing only. Any steps toward that are plain wrong.

I agree it is a wild world out there but it is a problem of weak clients. The service provider should be blind unless a client is affecting network performance beyond their paid for slice. Then the client should be totally blocked.

Infection vs Market Share

[MrSplog]

The charts would be a lot more interesting if they had them compared to market share. then you've got to consider that people are more likely to target the biggest market share. i mean, how many virus writers are targeting FDOS?

Rebuild the email protocol

[Hoi Polloi]

It is time to rebuild the email protocol. It needs to be redesigned to cope with modern systems and security needs. The pain of the transition would be worth it. It is just too easy to spoof header info now.

Re:Rebuild the email protocol

[Archangel Michael]

The "we can't change anything because it is too hard waaaaaaa" post.

Thank you for being a wimp.

thats okay, but how to detect this infection?

[Anonymous Coward]

Perused the article to know how to find out if my computer is infected or not but couldn't find anything. This is such an important news for Windows users, at least tell something abou thow to verify if a particular windows machine is having this problem.

I'm just surprised that those spams still ...

[Jawood]

work. After all, the folks who are doing the "advertising" must be getting some sort of return.

Which leads me to wonder about the folks who actually believe that those penis enlargement pills work.

And as far as the "pump and dump" spam goes, are there folks who beleive those spams? Or are they of the mindset of the "greater sucker"? Meaning, if I buy this stock now, after this spam circulates, there will be others who buy this shit stock and push up the price allowing me to make money.

Yeah, I know the guy who originates the "buy" recomendation is hoping for everyone to buy the stock, but what makes some of the recipients think they'll make out?

Re:eweek confirms it: Linux and Mac are dying!

[mrjb]

Do you really think that 0.05% of all spam comes from Linux, BSD, MacOS, Solaris and OS/2 lumped together? Then I'll have to disappoint you. Look again. Windows 95 is curiously absent from the graph. How big a part of 0.05% do you think it could handle?

Hit the nail right between the eyes.

[Rob T Firefly]

This is the basic problem with any single antispam measure, or really any single computer security measure.

1. Someone comes up with a defense mechanism that works well.
2. It works so well that more people use it.
3. It becomes popular enough for the bad guys to beat, so they do.
4. The defense becomes useless, forcing someone to come up with a new defense.
5. Goto 1.