Attacks/Breaches

9/30/2009
06:09 PM
50%
50%

Which Botnet Is Worst? Report Offers New Perspective On Spam Growth

Rustock might be biggest, but Grum is worst offender, MessageLabs study says

In the early days of botnets, size was the main measure of the threat. But as the malicious networks become more sophisticated, researchers say, the biggest networks aren't always the worst offenders.

In a new report (PDF) issued yesterday, researchers at Symantec's MessageLabs unit offered a detailed analysis of the size and output of current botnets, including venerable spam carriers, such as Rustock, as well as emerging offenders, such as Grum and Maazben. One of the report's conclusions: Size doesn't always matter.

Rustock, for example, is still the largest of the botnets, with an estimated size of between 1.3 million and 1.9 million nodes. Cutwail is next in size, with an estimated 1 million to 1.5 million bots.

But neither of these two botnets is the largest proliferator of spam, according to Paul Wood, senior analyst at MessageLabs and one of the authors of the report. That title goes to a rapidly emerging botnet called Grum, which delivered an average of 39.9 billion spam messages per day last quarter -- more than 23 percent of all the spam on the Internet.

"Despite the fact that it's half the size of Rustock, Grum is generating much more spam," Wood says. "It's getting each bot to do a lot more work."

Bobax, a botnet that has been around for more than two years, is also becoming more efficient, generating more than 27 billion messages per day and 15.2 percent of all Internet spam, the report says. That means each Bobax node generates more than 1,400 spam messages per minute.

Botnet operators have discovered that many ISPs don't immediately recognize the huge output of individual bots because each bot's performance is affected only on the upload, not on the download, Wood says. "Your computer might be a bot, but it might not affect your download performance very much," he observes. "It's only when users try to upload something and experience a performance problem that the ISP gets a complaint."

As they become more sophisticated, botnet operators are finding ways to make their infrastructures more efficient, Wood says. A new botnet, Maazben, accounted for only 0.5 percent of Internet spam 30 days ago, but now is generating 4.5 percent -- about 2.4 billion messages a day -- at its peak. As with Bobax, each Maazben bot is highly productive, pushing out nearly 1,300 spam messages per minute.

The operators of Rustock also are becoming more calculated in their approach, Wood says, but in a different way. For years, the botnet generated huge spikes of spam "every fortnight or so," and then would go quiet for long periods, he says. Now Rustock is becoming more regular in its activity, outputting large batches of spam from 3 a.m. to 7 a.m. (U.S. Eastern time) each day, and then going silent after 7 p.m.

"We don't know why it's operating on this schedule, but there's clearly some automation going on there," Wood says. "Is there some sort of maintenance period? Is it doing something else during that time? It's hard to tell. But clearly, with its size Rustock is capable of much greater activity."

No matter what their size or how efficiently they operate, botnets clearly are at the heart of the spam problem, MessageLabs says. According to the report, botnets generated an average of more than 150 billion messages per day last quarter -- nearly 88 percent of all the spam on the Internet.

"The takedown of ISPs like McColo definitely helped, but it doesn't solve the problem," Wood says. "Already we see botnet operators spreading traffic across multiple ISPs, effectively giving themselves better backup than some enterprises have."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
12 Free, Ready-to-Use Security Tools
Steve Zurier, Freelance Writer,  10/12/2018
Most IT Security Pros Want to Change Jobs
Dark Reading Staff 10/12/2018
6 Security Trends for 2018/2019
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/15/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-18381
PUBLISHED: 2018-10-16
Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
CVE-2018-18382
PUBLISHED: 2018-10-16
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
CVE-2018-18374
PUBLISHED: 2018-10-16
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.
CVE-2018-18375
PUBLISHED: 2018-10-16
goform/getProfileList in Orange AirBox Y858_FL_01.16_04 allows attackers to extract APN data (name, number, username, and password) via the rand parameter.
CVE-2018-18376
PUBLISHED: 2018-10-16
goform/getWlanClientInfo in Orange AirBox Y858_FL_01.16_04 allows remote attackers to discover information about currently connected devices (hostnames, IP addresses, MAC addresses, and connection time) via the rand parameter.