Slashdot Mirror

← Back to Stories (view on slashdot.org)

Inside the Grum Botnet

Posted by Soulskill on from the creamy-nougat-filling dept.

tsu doh nimh writes "An examination of a control server seized in the recent takedown of the Grum spam botnet shows the crime machine was far bigger than most experts had assumed. A PHP panel used to control the botnet shows it had just shy of 200,000 systems sending spam when it was dismantled in mid-July. Researchers also found dozens of huge email lists, totaling more than 2.3 billion addresses, as well evidence it was used for phishing and malware attacks in addition to mailing pharmacy spam. Just prior to its takedown, Grum was responsible for sending about one in six spams worldwide."

34 comments

  1. And suddenly by ackthpt · · Score: 2

    200,000 voices were silenced.

    Not particularly good voices, with anything worthwhile to say.

    --

    A feeling of having made the same mistake before: Deja Foobar
    1. Re:And suddenly by PPH · · Score: 3, Insightful

      Actually, 200,000 voices with only one mind.

      Sort of like a political action committee

      --
      Have gnu, will travel.
    2. Re:And suddenly by Krojack · · Score: 1

      Or the Borg?

      Someone had to toss that in there...

    3. Re:And suddenly by Anonymous Coward · · Score: 0

      Wait, which OS did this malware run on?

    4. Re:And suddenly by Em+Adespoton · · Score: 1

      Don't worry... the voices weren't silenced; they just were required to switch to another communications mechanism. Grum's gone, but the people using it are still around, and sending their spam via other means. You will still get your links to HGH pills, botnet infectors and fake AV software.

    5. Re:And suddenly by hairyfeet · · Score: 3, Insightful

      The sad part? as someone who actually have to clean these machines it doesn't matter about UAC, or low rights mode, or any possible security you put in the OS because in the end it becomes another case of the dancing bunnies and there is no tech cure for that short of sticking them in a walled garden ala Apple where they can't do a damned thing without the corporation's approval.

      I've seen it a million times, all the malware writer has to do is offer them the right carrot, be it some celeb nekkid, some free porn, screensavers, hell I've seen people infect their machines for a chance to win an iPad. Offer them a cookie and all the security levels and permissions and AV software is worth jack and squat because they will disable it with a smile on their face.

      In the end all you can do is educate those that will listen and be ready to clean up the mess like with TFA for those that don't.

      --
      ACs don't waste your time replying, your posts are never seen by me.
  2. Yay CAN SPAM! by Anonymous Coward · · Score: 0

    More evidence that the law is working.

    1. Re:Yay CAN SPAM! by ackthpt · · Score: 2

      More evidence that the law is working.

      Law? Try people actually working on it.

      You can have all the laws you want, but until people set themselves to backtracking this junk, finding the servers and maybe even catching those behind them, the laws mean exactly nothing.

      It is nice to see them working on it, but I think more work could be done a little faster.

      --

      A feeling of having made the same mistake before: Deja Foobar
    2. Re:Yay CAN SPAM! by wmbetts · · Score: 1

      You're spreading fud. This is in no way CAN-SPAM compliant.

      --
      "Ubuntu" -- an African word, meaning "Slackware is too hard for me". - stolen from Dan C alt.os.linux.slackware
  3. Law enforcement jumped the gun here by Anonymous Coward · · Score: 5, Funny

    One man's botnet is another man's beowulf cluster

    Many people looked forward to these daily emails offering vital medications, herbal alternatives for male enhancement, and mortgage refinancing opportunities

    Grum, you will be missed!

    1. Re:Law enforcement jumped the gun here by Anonymous Coward · · Score: 0

      Imb*cile.

  4. Why am I still getting so much spam then? by Anonymous Coward · · Score: 1

    Yet it seems like I am getting more and more spam every day. You would think shutting down a server responsible for about 16% of spam, I would see some drop.

    1. Re:Why am I still getting so much spam then? by Anonymous Coward · · Score: 0

      Not all the points in the sample are equal to the average.

  5. Notify ISP's to Notify Infected Customers? by Krojack · · Score: 1

    Why can't they get the IP's of most of the infected computer, send those IP's w/time stamps to ISP's and require those ISP's to send letters to the infected customers letting them know that they help assist in sending billions of email SPAM and to get their computer cleaned? Maybe it will scare some people that feel they aren't vulnerable into realizing they are.

    I donno, it's a thought. I'm sure something could be improved upon that.

    1. Re:Notify ISP's to Notify Infected Customers? by Zocalo · · Score: 3, Insightful

      Based on the experiences of the DNS Changer Working Group trying to get ISPs to notify their infected users of the imminent demise of the substitute DNS Changer DNS servers, I'd say it is unlikely to work. The sad fact is that many ISPs (and there would be a *lot* of ISPs with hosts on a typical botnet) simply don't give a crap at the best of times, let alone when suggesting they take a course of action that would entail costs - postage of letters, support calls, setting up a sandbox for infected users, etc.

      --
      UNIX? They're not even circumcised! Savages!
    2. Re:Notify ISP's to Notify Infected Customers? by TheGoodNamesWereGone · · Score: 1

      It's a nice idea and a nice fantasy, but the sad fact is even if the ISPs sent someone out to clean off those zombie boxen free of charge they'd be infected worse than a transvestite hooker on Bourbon St again in no time flat. PEBKAC.

  6. 200,00 X 6 = 1,200,000 by John+Hasler · · Score: 1

    This implies that there are about 1.2 million bots worldwide. Seems low.

    --
    Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
    1. Re:200,00 X 6 = 1,200,000 by ackthpt · · Score: 2

      This implies that there are about 1.2 million bots worldwide. Seems low.

      True.

      Perhaps the others are all at work managing sock-puppets on facebook.

      --

      A feeling of having made the same mistake before: Deja Foobar
    2. Re:200,00 X 6 = 1,200,000 by KhabaLox · · Score: 1

      That assumes other botnets send the same number of spam emails per bot as Grum. Given it is the largest, and probably has the largest address list, it probably sends more spam per bot than other botnets. TFA says it had the capability of sending 18b spam message per day, which is about 90k messages per bot. Other botnets might be only sending 50k or 10k per bot per day.

      --
      Ceci n'est pas un sig.
    3. Re:200,00 X 6 = 1,200,000 by Anonymous Coward · · Score: 0

      "one in six spams worldwide" is not necessarily the same as one in six bots.

    4. Re:200,00 X 6 = 1,200,000 by Anonymous Coward · · Score: 1

      This implies that there are about 1.2 million bots worldwide. Seems low.

      True.

      Perhaps the others are all at work managing sock-puppets on Slashdot.

      There. FTFY. Courtesy of your friendly neighborhood sock puppet. :)

    5. Re:200,00 X 6 = 1,200,000 by jader3rd · · Score: 1

      This implies that there are about 1.2 million bots worldwide. Seems low.

      Not if all of the spam is coming from the same house.

    6. Re:200,00 X 6 = 1,200,000 by Ziggitz · · Score: 2

      Sounds about right. I imagine many many times that number get infected every year though. To remain infected and a functioning part of the botnet you need it to stay on the internet, not have it's antivirus updated, not have security updates for the OS, not fall into disuse, not taken in for service and still work without the owner's knowledge that it is infected.

      What kind of person would allow those conditions to occur? Grandma probably does, somebody probably set up the computer for her, she doesn't know how fast it should be, doesn't update the OS or antivirus, probably doesn't know how to and since it will still connect to facebook and let her play bejeweled, she doesn't do anything about it.

      So take the number of primary personal computing devices in the first world, take only the very tech incompetent but frequent users, from those take the ones with out of date operating systems, then keep only the ones that stay connected to the internet all the time and then only the ones that will not take those computers to be fixed. The low hanging fruit disappear very quickly. While there are way way more than 1.2 million people who will get a device infected each year, chances are they don't leave them infected for very long, so the retention rate for the botnet is probably only around 1% per year if not less.

      --
      There is no memory shortage. yes I have heard of XFCE. Go away.
    7. Re:200,00 X 6 = 1,200,000 by John+Hasler · · Score: 1

      You have a remarkably high opinion of the average computer user.

      --
      Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
    8. Re:200,00 X 6 = 1,200,000 by John+Hasler · · Score: 1

      > Given it is the largest... ...that we know of.

      --
      Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
    9. Re:200,00 X 6 = 1,200,000 by CSMoran · · Score: 1

      This implies that there are about 1.2 million bots worldwide. Seems low.

      Grum was responsible for 1/6 of spam volume, not 1/6 of world botnet size.

      --
      Every end has half a stick.
    10. Re:200,00 X 6 = 1,200,000 by tqk · · Score: 1

      What kind of person would allow those conditions to occur?

      You're ignoring all the Chinese, Indians, Pakistanis, Indonesians, ... all running pirated versions of Windows, possibly with the malware pre-installed with the pirated OS. Add poorly secured, or ancient and not updated, Linux and *BSD installs. These needn't even be home users. Whole companies in these countries have been known to rely on pirated OSs.

      --
      "Tongue tied and twisted, just an Earth bound misfit ..." -- Pink Floyd.
  7. And yet... by winkydink · · Score: 3, Interesting

    spam levels have increased since the takedown!

    http://www.eleven.de/botnet-timeline-en.html

    fast forward to Grum Botnet part of timeline.

    --

    "I'd rather be a lightning rod than a seismometer." -Ken Kesey

  8. Money by John+Bokma · · Score: 2

    For the same reason a lot of ISPs [b]do nothing about spam[/b]. It's paying customers versus angry nerds...

    --

    Perl Programmer for hire
  9. Yes by kamapuaa · · Score: 0

    Drawings of Natalie Portman, naked and petrified? Sign me up, as it is now I have to browse Deviantart profiles and it takes forever.

    --
    Slashdot: providing anti-social weirdos a soapbox, since 1997.
  10. Spams still coming by Taco+Cowboy · · Score: 2

    Even with the Grum Botnet taken offline, my email address is still getting all kinds of spam and scam, every single day

    Like others, I set up spam filters save the clutters, but I do not know how many genuinely worthy messages my spam-filter had mistakenly deleted

    Those goddamn spammers have ruined it

    --
    Muchas Gracias, Señor Edward Snowden !
    1. Re:Spams still coming by Anonymous Coward · · Score: 0

      Those goddamn spammers have ruined it

      No, you allowed it to be ruined through laziness.

      Crete an e-mail alias for each contact.

      Delete it if you receive any spam.

      Problem solved.

  11. Microsoft Spambot (tm) by Anonymous Coward · · Score: 0

    I wonder if the Grum spamhouse developers are paying Microsoft for the use of their intellectual property.