Slashdot Mirror
Most Spam Comes From Just Six Botnets
Ezhenito noted some research pointing out the (maybe) surprising bit of research that 6 botnets are responsible for 85 percent of the world's spam. That seems a bit high to me, but the only aspect of spam I am an expert in is *getting* it.
Bet I could connect any one of these bots to Kevin Bacon in 3 or less.
SJW: Someone who has run out of real oppression, and has to fake it.
Srizbi is the largest contributor at 39%
I believe this figure could be much larger if the Trojan.Srizbi client was ported to Mac and linux
Anyone know what licence it's distributed under?
Yes there is. We must activate Skynet to put an end to this Botnet/spam/virus that is spreading to our computers. Only then will we be rid of these Bots.
unimatrixzer0
Comment removed based on user account deletion
Hi,
microsoft is fixing spam just like they fixed viruses.
ty
"All great things are simple & expressed in a single word: freedom, justice, honor, duty, mercy, hope." --Churchill
Why can't they focus thier efforts and resources on shaping traffic to block this kind of nonsense, rather than Torrents?
The problem with socialism is that they always run out of other people's money. - Margaret Thatcher
What TFA says is that most Spam comes from the following six types of Bot:
Srizbi: 39%
Rustock: 20%
Mega-D: 11%
Hacktool.Spammer: 7%
Pushdo: 6%
Storm: 2%
Other: 15%
This doesn't necessarily mean that most spam comes from six botnets. Some of the bots could be used by multiple bot masters; OTOH some botmasters could control multiple botnets using different bots.
Something else I just thought of:
The botmasters are going to use the best bot available, i.e. the one enabling them to send most spam at the least cost. On the other hand, the "good guys" are fighting spam (and the bots). So whenever a certain bot starts taking over (currently Srizbi) all the good guys will focus on that one and try to shut it down. So the bot decreases in value and another, better bot will take over. Evolution at its best.
The Antivirus companies which are trying to fight the malware are also trying their best. The big difference is that while the success of a spambot can be easily measured by the customer (i.e. the botmaster), the success of an AV product is much harder to estimate. Also, the typical AV customer doesn't have the ability/time to find out which AV product is best for him. Moreover, AV products are some sort of subscription service (you buy the package and get 1 year of updates) which makes it hard to switch products. Often AV products are bundled with computers, selected by business principles and not by technical superiority.
In other words, the evolution process of malware is far superior to the one of AV products.
In theory, yes it would.
In practice, no it wouldn't.
You'd be opening yourself up to prosecution. Even in countries without specific "misuse of computers" laws, running a program on someone else's computer is trespass. You might think that, since trespass is a civil matter, you'd only need to worry about someone who has the money to sue you taking a dim view of what you were up to. And you'd be right. But the botnet-controllers have got enough money and would be bothered to take you to court.
And I haven't even touched on the really horrifying issue: what if your benign, anti-malware malware malfunctioned, or was subverted by the next generation malignant, anti-benign-anti-malware-malware malware? You could easily end up becoming even worse than the enemy whose dirty tricks you borrowed.
Je fume. Tu fumes. Nous fûmes!
No!?
Rejecting on invalid Helo, no rDNS and checking the Spamhaus zen RBL is quite effective. Improving on that requires an admin to explicitly block known residential blocks via rDNS and IP (grumble).
Comment removed based on user account deletion
rather than creating a new gmail account, you should look at spamgourmet.com. The email accounts are created and limited automatically. Just give out an email address, and it automatically is limited to x many emails. You need to have a read up on it, but its very easy to use.
Or you can put a prefix to your gmail address with a '+'. ie. "temp+john38@gmail.com" the mail still gets delivered to john38@gmail, but with 'temp+john38@gmail.com' in the 'to:' field, allowing you to filter it easily.
I.O.U One Sig.
Comment removed based on user account deletion
Blocking known residential blocks sucks as a solution as it removes some of the democracy of the net.
I (like others I'm sure, but maybe not so many of us these days) run a mail/web server from home. I just use it for personal mail. I have SPF and rDNS set up, I play by all the rules. Why block me because I use ADSL at home with a static IP ?
Whilst I appreciate that accepting mail from my IP is potentially a higher risk factor, blocking all residential blocks sems to me to be overkill.
1) static IP's. Then we can easily track down infected machines and take them offline. Advertising companies are jumping for joy at this one. The more stable the IP address, the more they can bombard you with ads specially tailored for you. I like the fact that DHCP refreshes my IP every day or so, it means that sites that use web-bugs and other semi-devious methods of gathering information and (much worse) sell it to other companies, only have a very limited time frame to do so - and the fact that my IP does refresh makes them that much less able to make any profit off of me. 2) Laws that require people to assume some form of responsibility when they connect a computer to the net. And what's going to happen if they don't "take responsibility?" By what metric do we judge responsibility? It sounds like the only way to enforce this is to dig into private internet usage information. I think the last thing I want is another person snooping around in the internet garbage bin for places my computer has been and is going to. 3) Perhaps some form of compulsory insurance policy. Mainly see the above, but in addition the last thing we need is another mandatory insurance policy. 4) Laws that require ISP's to disconnect spam bots and take some responsibility. This one may not be a terrible idea in practice, but ISP's are currently going nuts over things like bittorrent. What's to stop them from classifying bittorrent activity as "suspected botnet activity?"
I do like the spirit of the post, but I don't think there's a clear-cut solution to the problem.
Well, back to rejecting software patent applications.
Seeing that six botnets propagate most of the spam really shouldn't be a surprise to anyone who is familiar with spamhaus. After all, why would the spammers want to reinvent the wheel and produce new botnets when each botnet is itself constantly gaining new zombie PCs?
Really, this is nowhere near as useful as the spam distribution data that is available through spamhaus, telling us who is behind the bulk of the spam, and what geographic parts of the world they are associated with. The botnet building and controlling seems to be the easy part of the spammers' game now, and we can all thank our neighbors and their new un-patched boxes on 24/7 DSL / cable connections for that.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
While most of us treat spam as junk it is there to serve a very specific purpose. To get our money into the accounts of unscrupulous companies. A mate of mine (honestly) replied to spam and got some pills back. There are proper businesses behind them. Why can't we trace where the money goes and sue their butts off?
How many companies are actually advertising at any one time? Is all the spam for one company, ten companies, a thousand companies or a million?
I have excellent Karma and I am not afraid to Troll it.
Let's ignore all your points for a second and cut to the crux of the matter. The country you live in could legally enforce all of your suggestions absolutely perfectly. It wouldn't make a dent. You could do it in twenty, fifty countries. You still wouldn't make a dent. Law is not universal. In my continent you can't HAVE software patents, they actually do not exist. You aren't going to make that change any time soon no matter what your country does. Similarly for any legal resolution to spam, viruses, botnets etc. Even if 50% of the world's botnets are on American PC's (for example), by definition even the owner's don't want them or even know they are there. Nor do the ISP's, or the transport carriers, or anyone else along the line. But it's like suing people because they gave you a cold - they didn't want to catch the cold in the first place and, yes, although there are measures they can take to lessen their potential exposure to the virus, nothing is guaranteed.
1) "static IP's" - we can already trace where all the stuff comes from - there are complete trails back to the sending machines and from there back to the perpertrators. But most of it generally comes from computers abroad, or from people attacking computers from abroad, or via proxies, all of which are subject to different laws and untouchable. Even ASKING for the details belonging to a particular IP that resides in a foreign country is unbelievably difficult. And you won't get them, but your law enforcement might. And you think you can shut them off before they cause damage because you have their IP address? Nope. It's too late. By that time, the botnet's already moved on to take advantage of the next exploit. We have dynamically updating realtime, very expensive blocklists with dedicate people to add new machines as they are found - they don't stop that much, really.
2) "Laws that require people to assume some form of responsibility when they connect a computer to the net." - in every country in the world. With similar provisions. Quickly. Not going to happen. EVER. And then you're into why do you have to take responsibility and how do you ensure it? Your kid put a virus on your machine? I'll sue you, then. No? You caught a spyware toolbar which send me spam? I'll sue you, again. You'd either sue people literally off their computer seats, everything would get thrown out of court, or you've just helped the government introduce legislation to make them monitor everything you do at your computer, with fingerprint ID required to logon.
3) "Perhaps some form of compulsory insurance policy." - For owning a computer? No. If you could tax people for being stupid, the world would be split between the bankrupt and the filthy rich.
4) "Laws that require ISP's to disconnect spam bots and take some responsibility." - So now they're responsible for their users actions? They won't let you do it. If you do, they will shut themselves down and get out of the business. They ALREADY disconnect bots - it is in their interests. They ALREADY have to deny all responsibility for your actions. And they are ALREADY in deep legal grey areas because of the burden of proof of doing such things and the expense of a mistake (Sorry, Company X, I thought you sent a spam. I've just cut off your Internet by mistake. Bye-bye online business).
But the fact is that none of your measures are sensible or practical, some are even impossible, and all of them are in place in one way or another today. The fact is that every country in the world has a different idea. If we can't convince them all that death by execution or torture might be a bad idea, how the hell do you think you're going to get them to shut down botnets?
If more people configured their sendmail to reject bad HELOs, it would be a lot harder to send spam.
Je fume. Tu fumes. Nous fûmes!
I just checked this and i think you got the address round the wrong way.
you need to put it john38+temp@gmail.com for it to work as the other way round just goes to the wrong address
I was wondering whether it would help if Google (and maybe some of the other top 10) notified you when you showed up on one of the IP block lists with a big yellow box at the top of the page, like an IE alert: "Warning: Your computer has been reported to be a SPAM relay! Please clean up your computer with the following tools..."
Something like that. They could get the list of infected IPs from one of the black lists.
I'm not a network guy, so I don't know what kind of technical restrictions there would be... obviously this wouldn't work well with proxies - maybe NAT would be an issue as well? In any event, I personally would appreciate such a service, even if I got hit with false positives once in a while. Of course, the bots would eventually get wise and filter out the messages, but that's part of the fun of the war.
W..w..W - Willy Waterloo washes Warren Wiggins who is washing Waldo Woo.
An MX record isn't required for sending mail, for receiving mail there's a fallback to A if no MX is found. The problem you're describing (backscatter) is solved by SPF; if only more people configured their MTA to check that before generating a bounce :(
That targets the top 5, 10 etc botnet issues so they can be addressed specifically without having to do broad spectrum AV searches (That fail depending on product)
While it may be difficult to terminate entire networks and IP address ranges, a more effective solution would be to identify the individuals who are directly responsible for sending unsolicited just e-mail through "botnets" and the individuals who are responsible for providing access to these illegally hijacked "botnets" and then kill them. Such an action would be most effective if done brutally and painfully, through acts of torture, with videos and images of the events and the aftermath released to the public as a warning to others who might engage in the same behaviour.
STOP MISUSING APOSTROPHES, YOU MORONS!!!
Spammer's note to self: (1) duplicate all gmail addresses with dummy "+" fields purged. (2) duplicate all gmail addresses with the most common non-filtered dummy fields, such as "family" and "work". Now each gmail address will be hit with a dozen or a hundred variations, in hopes that one will get through the filter.
Actually, using something like the Spamhaus PBL (which pre-emptively lists IP ranges that shouldn't be sending direct-to-MX email, such as ISP dynamic ranges), you actually CAN block significant portions of these botnets.
The three of my relays that use the combined Spamhaus SBL, XBL, and PBL block about 3.5 million connection attempts per day, and let 1 million emails/day through to the next layer of filtering. (about 78% of the flow, assuming that each connection would only drop off one email) The PBL accounts for about half of those blocks.
The second option sounds a lot easier.
As our way of thanking you for your positive contributions to Slashdot, you are eligible to disable Slashdot 2.0.
And what's the problem with running "sed 's/\+.*@gmail/@gmail/'"?
"You know what's worse? It'd be a quick half-hour job to fix it, if only the owners had thought to demand the Source Code."
Spoken like someone who has never actually debugged crappy code before. If I had a nickel for every time someone just needed "a half-hour" to fix a problem in code....
"But this one goes to 11!"
Perhaps it's not a random Microsoft bash, but a reference to Bill Gates' claims in 2004 that the spam problem would be solved by 2006.
For security, the MD5 hash of this message and sig is 09f911029d74e35bd84156c5635688c0.
The most effective spam blocking technique I've found is to route all my personal email addresses through gmail using its "Get Mail From Other Addresses" function. I'm down about 10 spams a day from about 300. And the spam is saved on the gmail server so I can check it now and then for false positives. I have to say, there are very few of them. Thanks, Google....
DAILY ROTATION
Yet if ISPs were blocking residential http servers, these anti-spam nerds would FLIP OUT. ISP blocked your residential smtp server? Meh *shrugs* The anti-spam crusaders are ruining the open nature of the internet. False positives are unacceptable. I'll take spam over false positives any day.
Really, you need to do it the other way around. You tell all your friends that you're john38+yeahreally@gmail.com, and you send anything without the +yeahreally to the bit bucket.
You can even give different people different +extensions, though managing the white list for them gets to be a pain. Especially since your new, improved email addresses will gradually leak into the spam books (everybody's got a friend dumb enough to push the "forward this article to a friend and sign them up for spam for life!") but it gives you some address space to play with even when you don't have direct control over the mail server.
Here's a one-word answer: Jurisdiction.
Basically, the Russian mafia is behind a lot of the botnet activity. They're employing talented but criminal programmers to write this stuff in a number of locations. Staff are paid for their work, and even provided benefits in some cases.
The botnet control servers are spread between a number of (mostly eastern-bloc) countries. Interpol can initiate action, but relies on the local police to carry it to the end, and the local police are...bought and paid for by the crimelords. Furthermore, if one slightly suidical policeman (or force) decides to act against the botnet operation, then all it means is that one of the tentacles is cut off. While it's busy regrowing (i.e. the data centre is being rebuilt a block away), the effect is minimal at best because there are similar systems set up in other countries.
What it would take to legally shut down the botnets is the coordinated effort of interpol and the police forces of several countries, combined with a lack of fear of organised crime. Six months later, they'd need to do the same thing again, probably with different countries. After doing this roughly three times a year for three or four years, the criminals in charge might decide to give up and move into another area--however, after the first attempt, there would be a lot of dead or injured cops showing up, and quite possibly their families as well. If you could pull off a raid like that once, do you think ANYONE would want to take part in a second raid, given the mortality rate (and peripheral damage)?
To shut them down illegally would take a well-funded and heavily armed black-ops team, to go in and start slaughtering the programmers, bombing the data centres, and (ideally) assassinating the crime lords. Basically, an anti-mafia mafia. The CIA has a history of doing this, but generally to depose governments, not criminals.
"People who do stupid things with hazardous materials often die." -- Jim Davidson on alt.folklore.urban
Bill Gates: No one is ever going to need more than 6 botnets.
Not many, I run this on my servers as well and rarely hear any problems from the clients using them.
Floodgates wide open is NOT an option because when I tried that I then heard many complaints from clients about slow server and way too much spam for their liking, they seem to prefer we try and do something about the spam levels rather than simply let everything through.
Sure wish that you hadn't replied anonymously - I do appreciate your response. On one hand it's humourous, and on the other, it's validity cannot be overlooked.
Allow me to address each of your concerns in turn.
1. Users of email will not put up with it
Most users of e-mail don't care what happens between send and receive. Like the postal service, once they drop their envelope into the slot, they expect magic to happen after it leaves their hands and arrives at their intended destination. They are vociferous when their message isn't delivered, or if they receive too many messages that are "off-colour".
2. Huge existing software investment in SMTP
I don't easily discount the existing investment in smtp. I do, however, believe that the next step is to quit building barriers and start looking for alternate solutions in ernest. Adding a protocol for mail handling would require adding a layer that doesn't currently exist between mail servers.
3. Armies of worm riddled broadband-connected Windows boxes
This is, indeed, a barrier. If the new mechanism requires authentication, you will be able to easily locate and address these boxes. This isn't an ideal approach, but the other option of "not providing a patch for these hosts" isn't realistic.
4. Eternal arms race involved in all filtering approaches
I admit that I don't fully understand the implication of this comment - are you referring to the cost of funding a certification service?
5. (x) Ideas similar to yours are easy to come up with, yet none have ever been shown practical
I freely admit that this idea was reasonably easy to come up with. What I don't understand is why there isn't more emphasis on change, and why there is so much entropy associated with it?
6. (x) Blacklists suck
7. (x) Whitelists suck
I agree with both of these. However, a central location that works for everyone would not be as bad as dozens of home-grown black/white lists.
8. (x) Why should we have to trust you and your servers?
There's no reason for you to trust anything of mine - your role is merely to get a [hopefully freely available] certificate and add the protocol [and any accompanying patches related to activating it]. When you are comfortable with [the next big thing], disable smtp and wait for the complaints to roll in.
9. (x) I don't want the government reading my email
I can't help you with this one. It's possible that the government is already reading your mail. How would this system be any different? Granted, it's close to impossible to remain anonymous in this system, but I would expect to that there will always be a sever somewhere that would offer you that option if you want it.
You're going to have to reboot the system to reset that, as has been mentioned. However, there's an easy way to prevent this kind of thing from happening again. Once your system is up and running, log in (as root) and type "rm -rf /"
Doing this will prevent any sort of malicious command from being run in the future.