Slashdot Mirror
Most Spam Comes From Just Six Botnets
Ezhenito noted some research pointing out the (maybe) surprising bit of research that 6 botnets are responsible for 85 percent of the world's spam. That seems a bit high to me, but the only aspect of spam I am an expert in is *getting* it.
What TFA says is that most Spam comes from the following six types of Bot:
Srizbi: 39%
Rustock: 20%
Mega-D: 11%
Hacktool.Spammer: 7%
Pushdo: 6%
Storm: 2%
Other: 15%
This doesn't necessarily mean that most spam comes from six botnets. Some of the bots could be used by multiple bot masters; OTOH some botmasters could control multiple botnets using different bots.
Something else I just thought of:
The botmasters are going to use the best bot available, i.e. the one enabling them to send most spam at the least cost. On the other hand, the "good guys" are fighting spam (and the bots). So whenever a certain bot starts taking over (currently Srizbi) all the good guys will focus on that one and try to shut it down. So the bot decreases in value and another, better bot will take over. Evolution at its best.
The Antivirus companies which are trying to fight the malware are also trying their best. The big difference is that while the success of a spambot can be easily measured by the customer (i.e. the botmaster), the success of an AV product is much harder to estimate. Also, the typical AV customer doesn't have the ability/time to find out which AV product is best for him. Moreover, AV products are some sort of subscription service (you buy the package and get 1 year of updates) which makes it hard to switch products. Often AV products are bundled with computers, selected by business principles and not by technical superiority.
In other words, the evolution process of malware is far superior to the one of AV products.
No!?
Rejecting on invalid Helo, no rDNS and checking the Spamhaus zen RBL is quite effective. Improving on that requires an admin to explicitly block known residential blocks via rDNS and IP (grumble).
rather than creating a new gmail account, you should look at spamgourmet.com. The email accounts are created and limited automatically. Just give out an email address, and it automatically is limited to x many emails. You need to have a read up on it, but its very easy to use.
Or you can put a prefix to your gmail address with a '+'. ie. "temp+john38@gmail.com" the mail still gets delivered to john38@gmail, but with 'temp+john38@gmail.com' in the 'to:' field, allowing you to filter it easily.
I.O.U One Sig.
Comment removed based on user account deletion
Seeing that six botnets propagate most of the spam really shouldn't be a surprise to anyone who is familiar with spamhaus. After all, why would the spammers want to reinvent the wheel and produce new botnets when each botnet is itself constantly gaining new zombie PCs?
Really, this is nowhere near as useful as the spam distribution data that is available through spamhaus, telling us who is behind the bulk of the spam, and what geographic parts of the world they are associated with. The botnet building and controlling seems to be the easy part of the spammers' game now, and we can all thank our neighbors and their new un-patched boxes on 24/7 DSL / cable connections for that.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
Let's ignore all your points for a second and cut to the crux of the matter. The country you live in could legally enforce all of your suggestions absolutely perfectly. It wouldn't make a dent. You could do it in twenty, fifty countries. You still wouldn't make a dent. Law is not universal. In my continent you can't HAVE software patents, they actually do not exist. You aren't going to make that change any time soon no matter what your country does. Similarly for any legal resolution to spam, viruses, botnets etc. Even if 50% of the world's botnets are on American PC's (for example), by definition even the owner's don't want them or even know they are there. Nor do the ISP's, or the transport carriers, or anyone else along the line. But it's like suing people because they gave you a cold - they didn't want to catch the cold in the first place and, yes, although there are measures they can take to lessen their potential exposure to the virus, nothing is guaranteed.
1) "static IP's" - we can already trace where all the stuff comes from - there are complete trails back to the sending machines and from there back to the perpertrators. But most of it generally comes from computers abroad, or from people attacking computers from abroad, or via proxies, all of which are subject to different laws and untouchable. Even ASKING for the details belonging to a particular IP that resides in a foreign country is unbelievably difficult. And you won't get them, but your law enforcement might. And you think you can shut them off before they cause damage because you have their IP address? Nope. It's too late. By that time, the botnet's already moved on to take advantage of the next exploit. We have dynamically updating realtime, very expensive blocklists with dedicate people to add new machines as they are found - they don't stop that much, really.
2) "Laws that require people to assume some form of responsibility when they connect a computer to the net." - in every country in the world. With similar provisions. Quickly. Not going to happen. EVER. And then you're into why do you have to take responsibility and how do you ensure it? Your kid put a virus on your machine? I'll sue you, then. No? You caught a spyware toolbar which send me spam? I'll sue you, again. You'd either sue people literally off their computer seats, everything would get thrown out of court, or you've just helped the government introduce legislation to make them monitor everything you do at your computer, with fingerprint ID required to logon.
3) "Perhaps some form of compulsory insurance policy." - For owning a computer? No. If you could tax people for being stupid, the world would be split between the bankrupt and the filthy rich.
4) "Laws that require ISP's to disconnect spam bots and take some responsibility." - So now they're responsible for their users actions? They won't let you do it. If you do, they will shut themselves down and get out of the business. They ALREADY disconnect bots - it is in their interests. They ALREADY have to deny all responsibility for your actions. And they are ALREADY in deep legal grey areas because of the burden of proof of doing such things and the expense of a mistake (Sorry, Company X, I thought you sent a spam. I've just cut off your Internet by mistake. Bye-bye online business).
But the fact is that none of your measures are sensible or practical, some are even impossible, and all of them are in place in one way or another today. The fact is that every country in the world has a different idea. If we can't convince them all that death by execution or torture might be a bad idea, how the hell do you think you're going to get them to shut down botnets?
I just checked this and i think you got the address round the wrong way.
you need to put it john38+temp@gmail.com for it to work as the other way round just goes to the wrong address
Torrents/p2p uses its own ports and protocols, and here you just target client machines. You can easily (?) filter them. Much different is something that is just mail, and there you get it from your mail server, whatever it is, whatever measure is taking. And one of the most used techniques to reduce spam (greylisting) is specifically targetted by Snzbi (the bot responsible back at the time this was published, almost 3 weeks ago, of 39% of the spam), so it dont stop this particular botnet.
I don't care for the sucky aspects of it either but ultimately I have to keep email useful for the users on my network. We usually have ~=1000 valid incoming emails a day. Likely many of those are spam too but I've cranked up the filters as high as I dare. Blocking off residential IP space spares us from having to filter and deliver 50,000 to 100,000 spams a day. That is a pretty good chunk of CPU and bandwidth saved right there. An immediate 50:1 to 100:1 reduction on incoming server load is hard to pass up. Furthermore, some percentage of the traffic that we DO let through turns out to be spam anyway. My best estimate is perhaps 50 spams get through a day. If I had to categorize botnet traffic, that would inevitably go up and get users barking at me.
Now, I COULD let the botnet traffic in and heavily penalize it in spam points. On the other hand, I whitelist maybe two or three servers on residential IP space a year. The tradeoff in bandwidth, server resources, and filter accuracy between "allow categorized residential" and "block residential minus whitelist" is simply too favorable in the blocking direction.
Functional democracies require ways to deter griefers or at least the very worst of griefers. The spammers have made SMTP their personal playground and there is no end in sight to it. It is they who should have the blame for mail servers being configured as fortresses. It is all the mail admins can do to keep on top of their shenanigans.
There's a very simple reason you can't sue the companies who advertise via spam. They are not the ones sending you spam. Most email spam you receive is the result of affiliates of these companies who get paid a commission to sell you their products. Most companies strictly forbid the use of non CAN-SPAM compliant marketing, but some allow it "off the record". The best you can do is send an email to the online pharmacy or mortgage company or retailer on the other end and let them know "xyz account" is using spam to promote their product. Best case, you will get said affiliate's account banned. Most likely though, even if that does happen, the spammer will have multiple other accounts set to other bank accounts and other PO Boxes, et al. Ostensibly though, these companies have no hand in or knowledge of the promotion methods being used to sell their product, unless customers complain.
Perhaps it's not a random Microsoft bash, but a reference to Bill Gates' claims in 2004 that the spam problem would be solved by 2006.
The most effective spam blocking technique I've found is to route all my personal email addresses through gmail using its "Get Mail From Other Addresses" function. I'm down about 10 spams a day from about 300. And the spam is saved on the gmail server so I can check it now and then for false positives. I have to say, there are very few of them. Thanks, Google....
DAILY ROTATION
Really, you need to do it the other way around. You tell all your friends that you're john38+yeahreally@gmail.com, and you send anything without the +yeahreally to the bit bucket.
You can even give different people different +extensions, though managing the white list for them gets to be a pain. Especially since your new, improved email addresses will gradually leak into the spam books (everybody's got a friend dumb enough to push the "forward this article to a friend and sign them up for spam for life!") but it gives you some address space to play with even when you don't have direct control over the mail server.
Not many, I run this on my servers as well and rarely hear any problems from the clients using them.
Floodgates wide open is NOT an option because when I tried that I then heard many complaints from clients about slow server and way too much spam for their liking, they seem to prefer we try and do something about the spam levels rather than simply let everything through.