Spam still suffering after McColo shut-down

 

Gallery

Posted on 24 Nov 2008 at 15:23

Two weeks after the shutdown of spam hosting network McColo, spam levels are yet to return to their previous sky-high levels, security experts have reported.

McColo was shut down by its ISP after an investigative journalist made enquiries about the web hosting company's illicit activities. McColo was hosting the command and control infrastructure for three of the world's most prolific spam botnets; Srizbi, Mega-D and Rustock. When McColo was shut down, the spammers were disconnected from the networks of spam-sending bot computers under their control.

The move saw the volume of spam around the world fell by as much as 70 per cent. However, experts predicted that by late November, the spammers will have regrouped and spam will be back to full force, but so far, that has not happened.

"The challenge for spammers is to re-establish connections with the thousands of zombie computers still infected with their bot code. We fully expect spam will resume in large volumes eventually. However, almost a week later, the spammers haven't managed to do that yet," said Phil Hay, lead threat analyst with the TRACE Team.

Throughout 2008, security firm Marshal8e6's TRACE team has published reports showing just a handful of major spamming botnets are responsible for as much as 90 per cent of spam.

"This is the most significant single event in the fight against spam we have ever seen," said Hay.

Marshal8e6 notes that the command and control servers for the Srizbi, Mega-D and Rustock botnets were affected by the McColo shut down.

According to Marshal8e6's statistics, just prior to McColo's shut down, these three botnets were ranked first, second and fifth respectively as the world's most prolific sources of spam, together responsible for nearly 70 per cent of spam.

Author: Robert Jaques