Spam Stikes Back: Botnets Return

By Kevin Parrish, published on November 28, 2008 at 8:00 AM
Source: Tom's Guide | Keywords: , ,
Syndication: Add to your Google homepage Add to My Yahoo!

Spam Strikes Back: McColo Corp was knocked out for a brief moment weeks ago, but apparently the blow wasn’t enough to keep its evil minions down for the count.

Spam King says, \MessageLabs, a subsidiary of Symantec, is reporting that levels of chunky spam are on the rise once again despite internet service providers pulling the feed to one of the largest spamming accomplices ever, McColo Corp (story). In fact, the volume has risen 37 percent since Sunday, just a few short weeks after the company was shut down (and coincidentally just in time for Black Friday and Christmas bonuses). Spam volumes originally dropped 80 percent when McColo was taken offline on November 11, but slowly began to rise against shortly thereafter.

Matt Sergeant, senior anti-spam technologist at MessageLabs, says that some of the botnets - Asprox, Mega-D and Rustock to name just a few- are now accessing domains outside the States. Sergeant admits that these will be extremely hard to take offline. "The problem now is that it was a lot easier to get a U.S.-based ISP shut down than it will be to get, for example, this Estonian ISP shut down," Sergeant said.

Botnets are small networks of infected computers (silently running bot software) that take commands from one central location. McColo played host to the controlling servers, thus when the company’s Internet service was revoked weeks ago, the botnets no longer received commands and remained silent. But even after the demise of McColo, email levels began to steadily rise according to IronPort, reaching an estimated 71 billion messages just one day after the shutdown. While McColo was no longer a threat, something else was spinning the wheels of spam.

"The Asprox and Rustock botnets are back with a vengeance after having found new command and control," Sergeant said in a statement. "Cutwail never went away and it seems its owners have used the opportunity to increase output. Mega-D is also on the rise again. Srizbi, having once been responsible for 50 percent of all spam, is now completely defunct. Without this botnet, spam levels won’t return to what they had been."

Still, Sergeant believes that spammers were stunted for a couple of weeks, and hopes that the brief victory increased their overall costs in keeping the botnets functional. But consumers need to be aware that the increase in spam is mostly not a sign of McColo’s ghastly return. In fact, the rise was expected, as some bots are pre-programmed to re-connect to a new domain after a certain amount of inactivity.

For now, spam researchers are currently collaborating and working with law enforcement to take down more hosts. Some domains are already suspended. Sergeant stresses that consumers need to stay on top of their spam filters and anti-virus engines by keeping them up-to-date.

Comments | Print | Send to a friend
Slideshows related to this news

Google Ads

Comments

Pei-chen 11/28/2008 7:24 AM
Hide
-2+
Pei-chen

Can't they find the person that's hosting these servers?

afrobacon 11/28/2008 10:22 AM
Hide
-1+
afrobacon

I wouldn't doubt if someone was getting paid under the table...

croc 11/28/2008 10:50 AM
Hide
-0+
croc

In Estonia???? Don't know Estonian law, but it may very likely be legal. Like in the US after the so-called 'can-spam' act was passed...

jaragon13 11/29/2008 4:56 AM
Hide
-1+
jaragon13

"Spam Stikes Back: Botnets Return"
Shouldn't it be "strikes" instead of "stikes"?

tipoo 11/29/2008 5:07 AM
Hide
-0+
tipoo

jaragon13 :
"Spam Stikes Back: Botnets Return"Shouldn't it be "strikes" instead of "stikes"?




of course not, that would be silly ;)

jalek 11/29/2008 9:44 AM
Hide
-0+
jalek

Maybe the author's machine is one of the bots and the "r" key sets it off.

I've cleaned up a couple of these machines. Blame corporations and agencies that don't monitor their networks. When in action, these machines were reported as "slow" while their network traffic was maxed.

Now our routers just disable the ports of anyone sending in huge quantities so they can be checked out.

Alternator 11/29/2008 10:59 AM
Hide
-0+
Alternator

I don't know the tech behind these or if it would have been possible. But wouldn't it have been better to take control of the host and use that to identify the infected networks so they might have been able to do something about those as well?

Katzhuu 12/01/2008 9:57 AM
Hide
-0+
Katzhuu

Old news, Estonian ISP already shut down new spamprovider.

Comments are closed on this page.

Google Ads