Slashdot Mirror
Most Spam Comes From Just Six Botnets
Ezhenito noted some research pointing out the (maybe) surprising bit of research that 6 botnets are responsible for 85 percent of the world's spam. That seems a bit high to me, but the only aspect of spam I am an expert in is *getting* it.
Bet I could connect any one of these bots to Kevin Bacon in 3 or less.
SJW: Someone who has run out of real oppression, and has to fake it.
Srizbi is the largest contributor at 39%
I believe this figure could be much larger if the Trojan.Srizbi client was ported to Mac and linux
Anyone know what licence it's distributed under?
Comment removed based on user account deletion
Why can't they focus thier efforts and resources on shaping traffic to block this kind of nonsense, rather than Torrents?
The problem with socialism is that they always run out of other people's money. - Margaret Thatcher
What TFA says is that most Spam comes from the following six types of Bot:
Srizbi: 39%
Rustock: 20%
Mega-D: 11%
Hacktool.Spammer: 7%
Pushdo: 6%
Storm: 2%
Other: 15%
This doesn't necessarily mean that most spam comes from six botnets. Some of the bots could be used by multiple bot masters; OTOH some botmasters could control multiple botnets using different bots.
Something else I just thought of:
The botmasters are going to use the best bot available, i.e. the one enabling them to send most spam at the least cost. On the other hand, the "good guys" are fighting spam (and the bots). So whenever a certain bot starts taking over (currently Srizbi) all the good guys will focus on that one and try to shut it down. So the bot decreases in value and another, better bot will take over. Evolution at its best.
The Antivirus companies which are trying to fight the malware are also trying their best. The big difference is that while the success of a spambot can be easily measured by the customer (i.e. the botmaster), the success of an AV product is much harder to estimate. Also, the typical AV customer doesn't have the ability/time to find out which AV product is best for him. Moreover, AV products are some sort of subscription service (you buy the package and get 1 year of updates) which makes it hard to switch products. Often AV products are bundled with computers, selected by business principles and not by technical superiority.
In other words, the evolution process of malware is far superior to the one of AV products.
In theory, yes it would.
In practice, no it wouldn't.
You'd be opening yourself up to prosecution. Even in countries without specific "misuse of computers" laws, running a program on someone else's computer is trespass. You might think that, since trespass is a civil matter, you'd only need to worry about someone who has the money to sue you taking a dim view of what you were up to. And you'd be right. But the botnet-controllers have got enough money and would be bothered to take you to court.
And I haven't even touched on the really horrifying issue: what if your benign, anti-malware malware malfunctioned, or was subverted by the next generation malignant, anti-benign-anti-malware-malware malware? You could easily end up becoming even worse than the enemy whose dirty tricks you borrowed.
Je fume. Tu fumes. Nous fûmes!
rather than creating a new gmail account, you should look at spamgourmet.com. The email accounts are created and limited automatically. Just give out an email address, and it automatically is limited to x many emails. You need to have a read up on it, but its very easy to use.
Or you can put a prefix to your gmail address with a '+'. ie. "temp+john38@gmail.com" the mail still gets delivered to john38@gmail, but with 'temp+john38@gmail.com' in the 'to:' field, allowing you to filter it easily.
I.O.U One Sig.
Oh, I did that too. I resigned, I still have my own mailserver, but it simply sends everything through my ISPs smtp server. Even then, I sometimes get flagged as spam. This is, alas, a battle we have lost ages ago :-(
1) static IP's. Then we can easily track down infected machines and take them offline. Advertising companies are jumping for joy at this one. The more stable the IP address, the more they can bombard you with ads specially tailored for you. I like the fact that DHCP refreshes my IP every day or so, it means that sites that use web-bugs and other semi-devious methods of gathering information and (much worse) sell it to other companies, only have a very limited time frame to do so - and the fact that my IP does refresh makes them that much less able to make any profit off of me. 2) Laws that require people to assume some form of responsibility when they connect a computer to the net. And what's going to happen if they don't "take responsibility?" By what metric do we judge responsibility? It sounds like the only way to enforce this is to dig into private internet usage information. I think the last thing I want is another person snooping around in the internet garbage bin for places my computer has been and is going to. 3) Perhaps some form of compulsory insurance policy. Mainly see the above, but in addition the last thing we need is another mandatory insurance policy. 4) Laws that require ISP's to disconnect spam bots and take some responsibility. This one may not be a terrible idea in practice, but ISP's are currently going nuts over things like bittorrent. What's to stop them from classifying bittorrent activity as "suspected botnet activity?"
I do like the spirit of the post, but I don't think there's a clear-cut solution to the problem.
Well, back to rejecting software patent applications.
While most of us treat spam as junk it is there to serve a very specific purpose. To get our money into the accounts of unscrupulous companies. A mate of mine (honestly) replied to spam and got some pills back. There are proper businesses behind them. Why can't we trace where the money goes and sue their butts off?
How many companies are actually advertising at any one time? Is all the spam for one company, ten companies, a thousand companies or a million?
I have excellent Karma and I am not afraid to Troll it.
I just checked this and i think you got the address round the wrong way.
you need to put it john38+temp@gmail.com for it to work as the other way round just goes to the wrong address
I was wondering whether it would help if Google (and maybe some of the other top 10) notified you when you showed up on one of the IP block lists with a big yellow box at the top of the page, like an IE alert: "Warning: Your computer has been reported to be a SPAM relay! Please clean up your computer with the following tools..."
Something like that. They could get the list of infected IPs from one of the black lists.
I'm not a network guy, so I don't know what kind of technical restrictions there would be... obviously this wouldn't work well with proxies - maybe NAT would be an issue as well? In any event, I personally would appreciate such a service, even if I got hit with false positives once in a while. Of course, the bots would eventually get wise and filter out the messages, but that's part of the fun of the war.
W..w..W - Willy Waterloo washes Warren Wiggins who is washing Waldo Woo.
While it may be difficult to terminate entire networks and IP address ranges, a more effective solution would be to identify the individuals who are directly responsible for sending unsolicited just e-mail through "botnets" and the individuals who are responsible for providing access to these illegally hijacked "botnets" and then kill them. Such an action would be most effective if done brutally and painfully, through acts of torture, with videos and images of the events and the aftermath released to the public as a warning to others who might engage in the same behaviour.
STOP MISUSING APOSTROPHES, YOU MORONS!!!
Actually, using something like the Spamhaus PBL (which pre-emptively lists IP ranges that shouldn't be sending direct-to-MX email, such as ISP dynamic ranges), you actually CAN block significant portions of these botnets.
The three of my relays that use the combined Spamhaus SBL, XBL, and PBL block about 3.5 million connection attempts per day, and let 1 million emails/day through to the next layer of filtering. (about 78% of the flow, assuming that each connection would only drop off one email) The PBL accounts for about half of those blocks.
Perhaps it's not a random Microsoft bash, but a reference to Bill Gates' claims in 2004 that the spam problem would be solved by 2006.