Spam increasing again after shutdown of hosting company
This graph shows how spam volumes dropped 80 percent after McColo was shut down and are crawling back up two weeks later.
(Credit: MessageLabs)Spammers knocked offline two weeks ago when their hosting company, McColo Corp., was shut down are finally coming back online, security researchers said on Wednesday.
San Jose, Calif.-based McColo was believed to be responsible for up to 75 percent of all spam, according to Brian Krebs of The Washington Post, who broke the initial story.
Spam volumes, which dropped about 80 percent when McColo was shut down on November 11, remained relatively flat since then until a few days ago when they started climbing up, said Matt Sergeant, senior antispam technologist at MessageLabs, now owned by Symantec.
Since Sunday, the spam volume has risen to about 37 percent of what they were before McColo was unplugged, MessageLabs said.
McColo was hosting command and control servers that were being used to send instructions--like send spam or Trojans--to bot software that has been planted on PCs, mostly in the U.S., according to Sergeant. "With no work orders to process, the machines simply stopped spamming," he said.
Some of the botnets, with names like "Srizbi," "Asprox," "Rustock," and "Mega-D," are back up after connecting to different domains, Sergeant said. Some are connecting to ISPs outside the U.S., which will make it very difficult to shut them down again, he said.
"The problem now is that it was a lot easier to get a U.S.-based ISP shut down than it will be to get, for example, this Estonian ISP shut down," Sergeant said.
"We've stunted the spammers for a couple of weeks, which is a good thing for the Internet," he said. "We've increased their costs and, hopefully, that might put some spammers out of business."
Researchers are collaborating on the matter and providing information to U.S. law enforcement agencies, said Paul Ferguson, an advanced threat researcher at Trend Micro.
Some of the bots are programmed to connect to a new domain after a certain amount of time of inactivity, he said.
Researchers have been able to get some registrars to suspend some domains being used and have filed abuse complaints with some ISPs that appear to be unwitting hosts, Ferguson added.
Elinor Mills covers Internet security and privacy. She joined CNET News in 2005 after working as a foreign correspondent for Reuters in Portugal and writing for The Industry Standard, the IDG News Service, and the Associated Press. E-mail Elinor.
- Topics:
-
Vulnerabilities & attacks
- Share:
- Digg
- Del.icio.us
A better solution to the problem is that people only read emails that they deem worthy to them. Meaning, if the amount pay to read the email is not higher than a certain amount, you won't read it.
I personally don't read email from anybody when I don't like them. This includes the government.
Why do people insist on reading emails that hurt them? People shouldn't be dumb. If emails that make you mad, you don't read it. If you already read it, don't read it again. People aren't dumb. They know what is good for them and not good for them. There are some people who are very dumb, they just read every email.
I think best approach to spammers would be more good old-fashioned law enforcement. Almost all of them are obviously violating existing laws against fraud, misrepresentation, illegal drug sales, etc., and if they're selling anything, it should be easy to make a purchase and follow the money trail.
Maybe a penny an email might work, but if someone didn't secure their PC so it gets hijacked by a bot, that could be painful. Yeah, some places do black hole an entire country. Ar one time, we cut off the entire UK.
The best bet is to report the spam you get, practice commonsense stuff by never replying to it, to understand what is phish, and just be aware of scam. Also use an email client that can show the message as text and disable the HTML completely.
Don't open any attachments. Again, Do Not Open Attachments.
Sam Spade is an excellent tool for playing around with suspect emails.