Endpoint
10/27/2009
03:28 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%
Repost This

MAAWG's Mission Evolving As Botnets, Web Threats Intensify

ISP group is starting to look at more than just email abuse as attacks span Websites, social networks

MESSAGING ANTI-ABUSE WORKING GROUP (MAAWG) GENERAL MEETING -- PHILADELPHIA -- ISPs and vendors here at the mostly closed-door Messaging Anti-Abuse Working Group (MAAWG) meeting this week shared data and research on more than just email abuse -- botnets, Web-borne attacks, social neworks, and wireless threats were also among the topics for ISPs and email providers.

Spam and malicious email have been gradually declining as more stealthy and efficient Web-borne attacks have become a popular choice for the bad guys. MAAWG ISPs and vendors yesterday reported slight drops in email abuse, but it's still steady at around 90 percent of all email traffic.

"Email [abuse] will remain substantial," says Michael O'Reirdan, chairman of MAAWG and distinguished engineer in national engineering and technical operations at a major U.S. ISP. Even so, O'Reirdan says he'd like for MAAWG to change its name to more than a messaging title to better reflect the evolving threats to ISPs and their users.

Other MAAWG members, such as Cisco, note that malware distribution via email has become less of a threat in developed countries. "Email as a malware distribution [vector] is somewhat dead except in emerging economies," says Henry Stern, senior security researcher for Cisco's IronPort team. G-20 countries are now sending anywhere from 20 to 40 percent less spam this year than last, he says.

That's, in turn, pushing spamming botnets out of the U.S. to lesser-developed countries with emerging broadband infrastructures. "It's more lucrative for them to go outside the U.S. There's a migration away from old email spam here" and to other methods, such as attacks on social networks, for instance, says Patrick Peterson, a Cisco fellow.

MAAWG's O'Reirdan says the shift is all about economics. "The ROI of attacking us [in the U.S.] is high. But the ROI of bots in the U.S. is low," he says.

A U.S. bot goes for 13 cents, whereas a bot in Vietnam or another developing Asian nation is only about one-quarter of a penny, according to Cisco.

"In the developed economy, Web as an infection vector has eclipsed email," Cisco's Peterson says. But those machines infected via the Web suffer the same fate as those via email: They typically become members of a botnet to continue the infection cycle, he notes.

MAAWG members say the organization's mission is already becoming more than just messaging abuse. "The charter is expanding beyond messaging," says Mark Risher, senior director of product management and spam czar for Yahoo, a MAAWG member. "People [here] are talking about instant messaging spam, smishing, [and other threats]."

Risher says the bad guys are basically applying some of their same messaging attack tactics to other vectors. "They are spamming to different communications media," he says.

One emerging attack on social networks, for example, sends messages to a victim's friends that he has updated his profile photo. When the friends click on a link to the photo, they are then infected, as well, and the cycle continues, according to Risher. He says a few social network vendors attended and participated in the meetings this week.

ISPs traditionally have been hesitant to suspend abused accounts for fear of customer backlash. But some MAAWG members have discussed strategies, such as user reputation programs, where providers would track a user's account activity such that unusual behavior would raise a red flag, for instance. "It used to be that every action was [looked at] in isolation, but that was naive," Risher says. "When you focus on building a reputation and taking an accounting of the good the account is doing, you can give them the benefit of the doubt." When you notice something changes, he adds, you can more easily detect fraud.

One ISP in Thailand, for instance, fires up a "splash screen" with statistics for the user when it detects something unusual with the account, such as bot activity or other fraud. "They've gotten positive customer support calls [about it]," he says. "It used to be [ISPs] worried that users would be resentful if they suspended their accounts." But outcomes like that of the Thai ISP shows otherwise, he says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Senior Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise Magazine, ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-0360
Published: 2014-04-23
Memory leak in Cisco IOS before 15.1(1)SY, when IKEv2 debugging is enabled, allows remote attackers to cause a denial of service (memory consumption) via crafted packets, aka Bug ID CSCtn22376.

CVE-2012-1317
Published: 2014-04-23
The multicast implementation in Cisco IOS before 15.1(1)SY allows remote attackers to cause a denial of service (Route Processor crash) by sending packets at a high rate, aka Bug ID CSCts37717.

CVE-2012-1366
Published: 2014-04-23
Cisco IOS before 15.1(1)SY on ASR 1000 devices, when Multicast Listener Discovery (MLD) tracking is enabled for IPv6, allows remote attackers to cause a denial of service (device reload) via crafted MLD packets, aka Bug ID CSCtz28544.

CVE-2012-3062
Published: 2014-04-23
Cisco IOS before 15.1(1)SY, when Multicast Listener Discovery (MLD) snooping is enabled, allows remote attackers to cause a denial of service (CPU consumption or device crash) via MLD packets on a network that contains many IPv6 hosts, aka Bug ID CSCtr88193.

CVE-2012-3918
Published: 2014-04-23
Cisco IOS before 15.3(1)T on Cisco 2900 devices, when a VWIC2-2MFT-T1/E1 card is configured for TDM/HDLC mode, allows remote attackers to cause a denial of service (serial-interface outage) via certain Frame Relay traffic, aka Bug ID CSCub13317.

Best of the Web