Spammers battle counter-hackers

Posted on 12 Nov 2009 at 12:25

Spam email is on the rise despite the best efforts of security companies and researchers to shut down their operations. The unwanted email messages are continuing to flood inboxes with Trojans, links to malicious websites and adverts for drugs and counterfeit goods. The problem is due to the techniques that spammers now use to keep their systems online, according to security company McAfee.

Sam Masiello, McAfee's director of threat management, notes that today is the first anniversary of an event that caused spam levels to plummet. The significant reduction in spam occurred because a company called McColo, which was suspected of providing internet services to cyber criminals, was disconnected from the internet by its ISPs. Masiello writes: "Email volumes dropped off as much as 60 percent to 70 percent... Three of the largest spam-sending botnets at the time - Rustock, Srizbi, and Mega-D - had command and control machines hosted at McColo and were drastically affected. Mega-D's volume dropped by more than 95 percent and Srizbi volumes dropped by more than 80 percent."

Once McColo was removed from the internet the cyber criminals were unable to contact their systems and spamming all but ceased. This was to prove a brief respite, as Masiello observes: "However, only days after McColo was taken offline, it was reconnected for a brief period - about 12 hours - by its uplink provider, giving just enough time for the Rustock botnet owners to recommunicate with their infected machines and point the command and control centers to other service providers."

According to McAfee's data it took five months for spam levels to return to normal. Today they are much higher and the spammers know that they need to plan for similar disconnections. In the words of Masiello, "McColo has taught botnet owners a lesson. As a result botnet control centers have become more distributed, spanning many networks in many countries. Today taking down a big hosting provider would prove only a minor inconvenience as opposed to a major victory for security forces."

Author: Simon Edwards