Deconstructing a Pump-and-Dump Spam Botnet

Behind the Front writes "eWeek has teamed up with Joe Stewart, a senior security researcher at SecureWorks in Atlanta, to show the inner working of a massive botnet that is responsible for the recent surge of 'pump and dump' spam. It's a detailed picture of how these sleazy operations work and why they're so hard to shut down. Sobering numbers: 70,000 infected machines capable of pumping out a billion messages a day, virtually all of them for penis enlargement and stock scams. Excellent graphics, too, including one chart that shows that Windows XP Service Pack 2 is hosting nearly half the attacked machines."

Comments

Re:Filter

[Hijacked Public]

Why does it seem reasonable to you? Why shouldn't I be able to do what I want with the bandwidth I purchased?

While I think ISPs should be able to do anything they want with the connections they sell, as long as they are up front about the terms, I will gravitate toward the ones who meddle less.

Has not happened and won't.

[twitter]

Are you saying that it's impossible to do?

No, just that it's more difficult to do, more limited in scope and much easier to identify and repair. These things don't exist in the Unix world, which includes plenty of granmothers on Mac OS X. There's a reason for that and it's not some silly market share issue.

All I have to do is get granny to download it and run it [a silly script that hoses user files]

Like I said, hard to do, limited in scope and unable to create a botnet. I'd like to see you get granny to pull up a browser or prompt, change your silly script to executable and then actually run it. Right.... Other, more insidious problems you might think of are limited in ability to spread by differences between distributions. Repair is trivial. Replacing binaries always brings improvement and is never difficult. All my family's important personal files are backed up to separate machines periodically with no effort on their part, so it will take a dedicated attack by someone who knows what they are doing to cause me real grief. Some very rational coding choices and the ability to share those decisions and work make the free software world a much better place for users. The best part about it all is how cheap and easy it is.

This can be contrasted to the Winblows world where content and executable code are mixed, your browser and email client run both without asking you and the OS has services you can't turn off that listen to the network when they should not. A billion dollar "security" industry has not been able to cover all of these holes.