The Russians Are Spamming - Twenty-Four Seven Security

« Hackers Today All Business (Your Business) | Main | 5 Most Common Security Mistakes »

November 17, 2006
The Russians Are Spamming

According to Eweek, the recent surge of penny stock and pharmaceutical come-on spam mails are originating from a highly sophisticated group of Russian spammers. Internet security researches and law enforcement officials have been tracking a well-organized botnet operation that apparently controls over 70,000 peer-to-peer computers.

Joe Stewart, the senior security researcher at SecureWorks, said the gang functions with a level of sophistication rarely seen in the hacking underworld. First, the botnet Trojan comes with it’s own virus scanner, a pirated copy of Kaspersky’s security software, that removes other malware that might compete with them. Second, once a Windows machine is infected, it joins a vast peer-to-peer botnet controlled by a single control server. And if that single control server is disabled by botnet hunters, the hackers simply have to activate another infected computer in the 70,000 strong network to regain control of the whole system.

Stewart, a reverse engineering expert, gained access to files from a SpamThru and found the attackers are meticulous and keeping stats on bot infections throughout the world. Stewart found that computers in 166 countries were part of the botnet, with the U.S. comprising over half of all infections.

The botnet stats tracker even logs the Windows version of the infected client down to the service pack level. Stewart found that the Windows XP SP2 (Service Pack 2) dominate the botnet, an indication that Microsoft’s latest version of its operating system is clearly being infected.

Another sign of the complexity is that the people must likely to become victims of stock pump-and-dump scams, which are those that engaged in online trading, were those must likely to be targeted for the spam mails. Stewart also calculated that with a botnet network of 70,000 computers, the group can possibly mail out a billion spam mails a day (which only assumes one recipient per message, so in actuality could be much higher).

In better news, my company, Message Partners, released its Message Processing Platform (MPP) version 3 this week. I'm thrilled that MPPv3 introduces the first integrated pre and post-queue spam filter for Postfix. Postfix is the leading open source email server, and is used by many large service providers and enterprises for their email filtering proxies. When combined with MPPv3, this creates the ideal email filtering platform perfect for the most demanding environments, and represents a crucial addition to the fight against the rising tide of spam that threatens to cripple email servers.

Tags: Botnet, Spam, Malware, Russian Hackers