Five botnets responsible for 75% of spam sent
Each infected machine sends spam at rate of almost two messages per second.
Spam levels have increased 60% since the beginning of this year, according to security company Marshal8e6
in its latest Security Threats report. The increase means that spam levels are now back at where they were mid-2008,
prior to the closure of the infamous McColo ISP.
In the report, Marshal8e6 also looks at the sources of spam, most of which is still sent via
botnets made up of compromised computers. Just five botnets are responsible for around 75% of
the spam sent, with the Rustock botnet alone being responsible for 45%. The Rustock botnet uses sophisticated techniques
both to hide itself on the infected machine and to make the emails it sends looks legitimate: it uses HTML templates of
genuine newsletters in which it inserts its own links and images, thus tricking both users and
spam filters into believing the email is genuine.
The majority of spam still advertises pharmaceutical products, with Tamiflu and Acai Berry becoming prominent alongside
Viagra and Cialis. The confidence of spammers in the stock markets seems to have decreased with the credit crunch, as
only 0.1% of all spam messages are now pump-and-dump emails. The amount of spam
containing malicious attachments is small compared to values seen in mid-2008, but still reaches peaks of 3% when botnets
are running new malicious campaigns.
In the meantime, researchers at ESET looked at the relatively small Waledac botnet, which consists of at least
20,000 infected computers. They discovered that an infected machine is capable of sending more than 6,500 spam emails per
hour - which is almost two per second. This gives this botnet a theoretical capacity of three billion spam emails
per day; a number that is probably never reached, because not all infected machines will be online continuously.
The full Marshal8e6 Security Threats report can be downloaded
here (PDF), while
ESET's research is explained in a blog post here.
16 July 2009
Tags:
botnet, eset, marshal8e6, pump-and-dump spam, spam.
del.icio.us 
digg this
0 comments
This month's VB100 test saw some major changes and a radical overhaul of the VB100 test methodology - for the first time allowing products to use their 'cloud' look-up systems. John Hawes has all the details.