Spam Bot Rivals Commercial SoftwareSpam Bot Rivals Commercial Software
Joe Stewart, senior security researcher at SecureWorks, has posted an <a href="http://www.secureworks.com/analysis/spamthru/" target="_blank">analysis</a> of a Trojan program called SpamThru on his company's Web site. As far as malware goes, it's a marvel.
October 19, 2006
Joe Stewart, senior security researcher at SecureWorks, has posted an analysis of a Trojan program called SpamThru on his company's Web site. As far as malware goes, it's a marvel.SpamThru features a custom P2P protocol to share information with other bot-infected or compromised machines. In the event that the command-and-control server gets shut down, the spammer can redirect the hacked peers to a new master server.
SpamThru defends itself against antivirus software by rewriting the hosts file on the infected machine so virus updates can't be found. It also uses its own antivirus engine to eliminate other resident malware that might compete for resources or expose the compromised machine.
It contains its own template-driven spamming engine that's protected by AES (Rijndael) encryption. And it can generate randomized spam images to defeat pattern-based spam detection methods.
"Although we've seen automated spam networks set up by malware before (Sober, Bobax, Bagle, etc) this is one of the more sophisticated efforts," writes Stewart. "The complexity and scope of the project rivals some commercial software. Clearly the spammers have made quite an investment in infrastructure in order to maintain their level of income."
If the rest of my applications looked after themselves as aggressively as SpamThru does, I'd never have to worry about security again.
About the Author(s)
You May Also Like
Hacking Your Digital Identity: How Cybercriminals Can and Will Get Around Your Authentication MethodsOct 26, 2023
Modern Supply Chain Security: Integrated, Interconnected, and Context-DrivenNov 06, 2023
How to Combat the Latest Cloud Security ThreatsNov 06, 2023
Reducing Cyber Risk in Enterprise Email Systems: It's Not Just Spam and PhishingNov 01, 2023
SecOps & DevSecOps in the CloudNov 06, 2023