Endpoint
10/27/2009
03:28 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%
Repost This

MAAWG's Mission Evolving As Botnets, Web Threats Intensify

ISP group is starting to look at more than just email abuse as attacks span Websites, social networks

MESSAGING ANTI-ABUSE WORKING GROUP (MAAWG) GENERAL MEETING -- PHILADELPHIA -- ISPs and vendors here at the mostly closed-door Messaging Anti-Abuse Working Group (MAAWG) meeting this week shared data and research on more than just email abuse -- botnets, Web-borne attacks, social neworks, and wireless threats were also among the topics for ISPs and email providers.

Spam and malicious email have been gradually declining as more stealthy and efficient Web-borne attacks have become a popular choice for the bad guys. MAAWG ISPs and vendors yesterday reported slight drops in email abuse, but it's still steady at around 90 percent of all email traffic.

"Email [abuse] will remain substantial," says Michael O'Reirdan, chairman of MAAWG and distinguished engineer in national engineering and technical operations at a major U.S. ISP. Even so, O'Reirdan says he'd like for MAAWG to change its name to more than a messaging title to better reflect the evolving threats to ISPs and their users.

Other MAAWG members, such as Cisco, note that malware distribution via email has become less of a threat in developed countries. "Email as a malware distribution [vector] is somewhat dead except in emerging economies," says Henry Stern, senior security researcher for Cisco's IronPort team. G-20 countries are now sending anywhere from 20 to 40 percent less spam this year than last, he says.

That's, in turn, pushing spamming botnets out of the U.S. to lesser-developed countries with emerging broadband infrastructures. "It's more lucrative for them to go outside the U.S. There's a migration away from old email spam here" and to other methods, such as attacks on social networks, for instance, says Patrick Peterson, a Cisco fellow.

MAAWG's O'Reirdan says the shift is all about economics. "The ROI of attacking us [in the U.S.] is high. But the ROI of bots in the U.S. is low," he says.

A U.S. bot goes for 13 cents, whereas a bot in Vietnam or another developing Asian nation is only about one-quarter of a penny, according to Cisco.

"In the developed economy, Web as an infection vector has eclipsed email," Cisco's Peterson says. But those machines infected via the Web suffer the same fate as those via email: They typically become members of a botnet to continue the infection cycle, he notes.

MAAWG members say the organization's mission is already becoming more than just messaging abuse. "The charter is expanding beyond messaging," says Mark Risher, senior director of product management and spam czar for Yahoo, a MAAWG member. "People [here] are talking about instant messaging spam, smishing, [and other threats]."

Risher says the bad guys are basically applying some of their same messaging attack tactics to other vectors. "They are spamming to different communications media," he says.

One emerging attack on social networks, for example, sends messages to a victim's friends that he has updated his profile photo. When the friends click on a link to the photo, they are then infected, as well, and the cycle continues, according to Risher. He says a few social network vendors attended and participated in the meetings this week.

ISPs traditionally have been hesitant to suspend abused accounts for fear of customer backlash. But some MAAWG members have discussed strategies, such as user reputation programs, where providers would track a user's account activity such that unusual behavior would raise a red flag, for instance. "It used to be that every action was [looked at] in isolation, but that was naive," Risher says. "When you focus on building a reputation and taking an accounting of the good the account is doing, you can give them the benefit of the doubt." When you notice something changes, he adds, you can more easily detect fraud.

One ISP in Thailand, for instance, fires up a "splash screen" with statistics for the user when it detects something unusual with the account, such as bot activity or other fraud. "They've gotten positive customer support calls [about it]," he says. "It used to be [ISPs] worried that users would be resentful if they suspended their accounts." But outcomes like that of the Thai ISP shows otherwise, he says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Senior Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise Magazine, ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Latest Comment: LOL.
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6213
Published: 2014-04-19
Unspecified vulnerability in Virtual User Generator in HP LoadRunner before 11.52 Patch 1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1833.

CVE-2013-6214
Published: 2014-04-19
Unspecified vulnerability in the Integration Service in HP Universal Configuration Management Database 9.05, 10.01, and 10.10 allows remote authenticated users to obtain sensitive information via unknown vectors, aka ZDI-CAN-2042.

CVE-2012-0871
Published: 2014-04-18
The session_link_x11_socket function in login/logind-session.c in systemd-logind in systemd, possibly 37 and earlier, allows local users to create or overwrite arbitrary files via a symlink attack on the X11 user directory in /run/user/.

CVE-2012-6646
Published: 2014-04-18
F-Secure Anti-Virus, Safe Anywhere, and PSB Workstation Security before 11500 for Mac OS X allows local users to disable the Mac OS X firewall via unspecified vectors.

CVE-2013-4279
Published: 2014-04-18
imapsync 1.564 and earlier performs a release check by default, which sends sensitive information (imapsync, operating system, and Perl version) to the developer's site.

Best of the Web