Risk
11/18/2010
11:53 AM
50%
50%

Researchers Link Most Spam To Only 50 ISPs

Discovery that spammers are using only a relative handful of Internet providers suggests new ways of stopping botnets.

How Firesheep Can Hijack Web Sessions
(click image for larger view)
Slideshow: How Firesheep Can Hijack Web Sessions

Only 50 Internet service providers (ISPs) host the majority of the world's spam, according to a new study, and that finding could reshape private and public approaches to combating the botnets that infect computers and then use them as spam mailers.

The study was conducted for the Organization for Economic Cooperation and Development (OECD) by researchers at Delft University of Technology in the Netherlands and Michigan State University, who examined 109 billion spam messages from 170 million unique IP addresses, gathered via a "spam trap" from 2005 to 2009.

One major finding is that where there's spam, you'll find an infected -- aka zombie -- machine. That's because according to the study data, on average 80% to 90% of the world's spam comes from infected machines.

Researchers also found that the 33 member countries that comprise the OECD, as well as Estonia, the Russian Federation, Brazil, China, India, Indonesia, and South Africa, "harbor over 60% of all infected machines worldwide registered by the spam trap." In other words, the majority of infected machines aren't laying low in countries nearly off the grid.

But perhaps the biggest surprise, said the researchers, was that "we discovered that infected machines display a highly concentrated pattern." In particular, "the networks of just 50 ISPs account for around half of all infected machines worldwide." In other words, "the bulk of the infected machines are not located in the networks of obscure or rogue ISPs, but in those of established, well-known ISPs."

The results suggest a formidable new way to block botnets. With a caution that historical data is no guarantee of future botnet behavior, the researchers said that "current efforts to bring about collective action -- through industry self-regulation, co-regulation, or government intervention -- might initially achieve progress by focusing on the set of ISPs that together have the lion's share of the market."

In other words, if policymakers want to maximize their bang for buck, start by improving the security practices of the 50 ISPs that host half the world's spam.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2010-5075
Published: 2014-12-27
Integer overflow in aswFW.sys 5.0.594.0 in Avast! Internet Security 5.0 Korean Trial allows local users to cause a denial of service (memory corruption and panic) via a crafted IOCTL_ASWFW_COMM_PIDINFO_RESULTS DeviceIoControl request to \\.\aswFW.

CVE-2011-4720
Published: 2014-12-27
Hillstone HS TFTP Server 1.3.2 allows remote attackers to cause a denial of service (daemon crash) via a long filename in a (1) RRQ or (2) WRQ operation.

CVE-2011-4722
Published: 2014-12-27
Directory traversal vulnerability in the TFTP Server 1.0.0.24 in Ipswitch WhatsUp Gold allows remote attackers to read arbitrary files via a .. (dot dot) in the Filename field of an RRQ operation.

CVE-2012-1203
Published: 2014-12-27
Cross-site request forgery (CSRF) vulnerability in starnet/index.php in SyndeoCMS 3.0 and earlier allows remote attackers to hijack the authentication of administrators for requests that add user accounts via a save_user action.

CVE-2012-1302
Published: 2014-12-27
Multiple cross-site scripting (XSS) vulnerabilities in amMap 2.6.3 allow remote attackers to inject arbitrary web script or HTML via the (1) data_file or (2) settings_file parameter to ammap.swf, or (3) the data_file parameter to amtimeline.swf.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.