Endpoint
10/27/2009
03:28 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

MAAWG's Mission Evolving As Botnets, Web Threats Intensify

ISP group is starting to look at more than just email abuse as attacks span Websites, social networks

MESSAGING ANTI-ABUSE WORKING GROUP (MAAWG) GENERAL MEETING -- PHILADELPHIA -- ISPs and vendors here at the mostly closed-door Messaging Anti-Abuse Working Group (MAAWG) meeting this week shared data and research on more than just email abuse -- botnets, Web-borne attacks, social neworks, and wireless threats were also among the topics for ISPs and email providers.

Spam and malicious email have been gradually declining as more stealthy and efficient Web-borne attacks have become a popular choice for the bad guys. MAAWG ISPs and vendors yesterday reported slight drops in email abuse, but it's still steady at around 90 percent of all email traffic.

"Email [abuse] will remain substantial," says Michael O'Reirdan, chairman of MAAWG and distinguished engineer in national engineering and technical operations at a major U.S. ISP. Even so, O'Reirdan says he'd like for MAAWG to change its name to more than a messaging title to better reflect the evolving threats to ISPs and their users.

Other MAAWG members, such as Cisco, note that malware distribution via email has become less of a threat in developed countries. "Email as a malware distribution [vector] is somewhat dead except in emerging economies," says Henry Stern, senior security researcher for Cisco's IronPort team. G-20 countries are now sending anywhere from 20 to 40 percent less spam this year than last, he says.

That's, in turn, pushing spamming botnets out of the U.S. to lesser-developed countries with emerging broadband infrastructures. "It's more lucrative for them to go outside the U.S. There's a migration away from old email spam here" and to other methods, such as attacks on social networks, for instance, says Patrick Peterson, a Cisco fellow.

MAAWG's O'Reirdan says the shift is all about economics. "The ROI of attacking us [in the U.S.] is high. But the ROI of bots in the U.S. is low," he says.

A U.S. bot goes for 13 cents, whereas a bot in Vietnam or another developing Asian nation is only about one-quarter of a penny, according to Cisco.

"In the developed economy, Web as an infection vector has eclipsed email," Cisco's Peterson says. But those machines infected via the Web suffer the same fate as those via email: They typically become members of a botnet to continue the infection cycle, he notes.

MAAWG members say the organization's mission is already becoming more than just messaging abuse. "The charter is expanding beyond messaging," says Mark Risher, senior director of product management and spam czar for Yahoo, a MAAWG member. "People [here] are talking about instant messaging spam, smishing, [and other threats]."

Risher says the bad guys are basically applying some of their same messaging attack tactics to other vectors. "They are spamming to different communications media," he says.

One emerging attack on social networks, for example, sends messages to a victim's friends that he has updated his profile photo. When the friends click on a link to the photo, they are then infected, as well, and the cycle continues, according to Risher. He says a few social network vendors attended and participated in the meetings this week.

ISPs traditionally have been hesitant to suspend abused accounts for fear of customer backlash. But some MAAWG members have discussed strategies, such as user reputation programs, where providers would track a user's account activity such that unusual behavior would raise a red flag, for instance. "It used to be that every action was [looked at] in isolation, but that was naive," Risher says. "When you focus on building a reputation and taking an accounting of the good the account is doing, you can give them the benefit of the doubt." When you notice something changes, he adds, you can more easily detect fraud.

One ISP in Thailand, for instance, fires up a "splash screen" with statistics for the user when it detects something unusual with the account, such as bot activity or other fraud. "They've gotten positive customer support calls [about it]," he says. "It used to be [ISPs] worried that users would be resentful if they suspended their accounts." But outcomes like that of the Thai ISP shows otherwise, he says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0485
Published: 2014-09-02
S3QL 1.18.1 and earlier uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object in (1) common.py or (2) local.py in backends/.

CVE-2014-3861
Published: 2014-09-02
Cross-site scripting (XSS) vulnerability in CDA.xsl in HL7 C-CDA 1.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted reference element within a nonXMLBody element.

CVE-2014-3862
Published: 2014-09-02
CDA.xsl in HL7 C-CDA 1.1 and earlier allows remote attackers to discover potentially sensitive URLs via a crafted reference element that triggers creation of an IMG element with an arbitrary URL in its SRC attribute, leading to information disclosure in a Referer log.

CVE-2014-5076
Published: 2014-09-02
The La Banque Postale application before 3.2.6 for Android does not prevent the launching of an activity by a component of another application, which allows attackers to obtain sensitive cached banking information via crafted intents, as demonstrated by the drozer framework.

CVE-2014-5136
Published: 2014-09-02
Cross-site scripting (XSS) vulnerability in Innovative Interfaces Sierra Library Services Platform 1.2_3 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
This episode of Dark Reading Radio looks at infosec security from the big enterprise POV with interviews featuring Ron Plesco, Cyber Investigations, Intelligence & Analytics at KPMG; and Chris Inglis & Chris Bell of Securonix.