41% of spam sent via Rustock botnet
Botnet spam back after short summer break.
In its latest intelligence report, security firm MessageLabs reports that 41% of all spam is being sent
through the Rustock botnet, an increase of 9% since April. The botnet sends an estimated 32 million spam emails
per minute.
Interestingly, the number of bots controlled by Rustock's botherders has almost halved in the same period. One of the
reasons for this apparent contradiction appears to be the drop in the use of TLS for sending the spam.
TLS makes use of an encrypted connection to send the messages and botherders may have believed this would decrease the
chances of their messages being intercepted; in April, 30% of all spam and 70% of Rustock spam was send using TLS.
However, TLS significantly slows down the connection, and with now less than 0.2% of spam being sent over TLS connections,
spammers seem to have realised that their delivery rates were being significantly impacted by its use.
Currently 92.2% of all email is spam - an increase of 3.3% since July; 95% of these spam messages are sent via botnets.
The relatively low spam ratio in July is explained by a temporary drop in spam coming from a number of botnets, most
notable the Grum botnet.
In August, Grum's output increased again and it now takes up second position among the most prolific spamming botnets,
with over 16% of spam sent through its bots. While Rustock has mostly infected computers in Western countries, Grum's bots
are more likely to be found in Russia, India and Vietnam.
The full MessageLabs report can be found here
(PDF), with comments on how this affects those sending legitimate email at the Word to the Wise blog
here.
26 August 2010
Tags:
botnet, grum, messagelabs, rustock, spam, tls.
del.icio.us 
digg this
0 comments
