Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

10/27/2009
03:28 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

MAAWG's Mission Evolving As Botnets, Web Threats Intensify

ISP group is starting to look at more than just email abuse as attacks span Websites, social networks

MESSAGING ANTI-ABUSE WORKING GROUP (MAAWG) GENERAL MEETING -- PHILADELPHIA -- ISPs and vendors here at the mostly closed-door Messaging Anti-Abuse Working Group (MAAWG) meeting this week shared data and research on more than just email abuse -- botnets, Web-borne attacks, social neworks, and wireless threats were also among the topics for ISPs and email providers.

Spam and malicious email have been gradually declining as more stealthy and efficient Web-borne attacks have become a popular choice for the bad guys. MAAWG ISPs and vendors yesterday reported slight drops in email abuse, but it's still steady at around 90 percent of all email traffic.

"Email [abuse] will remain substantial," says Michael O'Reirdan, chairman of MAAWG and distinguished engineer in national engineering and technical operations at a major U.S. ISP. Even so, O'Reirdan says he'd like for MAAWG to change its name to more than a messaging title to better reflect the evolving threats to ISPs and their users.

Other MAAWG members, such as Cisco, note that malware distribution via email has become less of a threat in developed countries. "Email as a malware distribution [vector] is somewhat dead except in emerging economies," says Henry Stern, senior security researcher for Cisco's IronPort team. G-20 countries are now sending anywhere from 20 to 40 percent less spam this year than last, he says.

That's, in turn, pushing spamming botnets out of the U.S. to lesser-developed countries with emerging broadband infrastructures. "It's more lucrative for them to go outside the U.S. There's a migration away from old email spam here" and to other methods, such as attacks on social networks, for instance, says Patrick Peterson, a Cisco fellow.

MAAWG's O'Reirdan says the shift is all about economics. "The ROI of attacking us [in the U.S.] is high. But the ROI of bots in the U.S. is low," he says.

A U.S. bot goes for 13 cents, whereas a bot in Vietnam or another developing Asian nation is only about one-quarter of a penny, according to Cisco.

"In the developed economy, Web as an infection vector has eclipsed email," Cisco's Peterson says. But those machines infected via the Web suffer the same fate as those via email: They typically become members of a botnet to continue the infection cycle, he notes.

MAAWG members say the organization's mission is already becoming more than just messaging abuse. "The charter is expanding beyond messaging," says Mark Risher, senior director of product management and spam czar for Yahoo, a MAAWG member. "People [here] are talking about instant messaging spam, smishing, [and other threats]."

Risher says the bad guys are basically applying some of their same messaging attack tactics to other vectors. "They are spamming to different communications media," he says.

One emerging attack on social networks, for example, sends messages to a victim's friends that he has updated his profile photo. When the friends click on a link to the photo, they are then infected, as well, and the cycle continues, according to Risher. He says a few social network vendors attended and participated in the meetings this week.

ISPs traditionally have been hesitant to suspend abused accounts for fear of customer backlash. But some MAAWG members have discussed strategies, such as user reputation programs, where providers would track a user's account activity such that unusual behavior would raise a red flag, for instance. "It used to be that every action was [looked at] in isolation, but that was naive," Risher says. "When you focus on building a reputation and taking an accounting of the good the account is doing, you can give them the benefit of the doubt." When you notice something changes, he adds, you can more easily detect fraud.

One ISP in Thailand, for instance, fires up a "splash screen" with statistics for the user when it detects something unusual with the account, such as bot activity or other fraud. "They've gotten positive customer support calls [about it]," he says. "It used to be [ISPs] worried that users would be resentful if they suspended their accounts." But outcomes like that of the Thai ISP shows otherwise, he says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-30480
PUBLISHED: 2021-04-09
Zoom Chat through 2021-04-09 on Windows and macOS allows certain remote authenticated attackers to execute arbitrary code without user interaction. An attacker must be within the same organization, or an external party who has been accepted as a contact. NOTE: this is specific to the Zoom Chat softw...
CVE-2021-21194
PUBLISHED: 2021-04-09
Use after free in screen sharing in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2021-21195
PUBLISHED: 2021-04-09
Use after free in V8 in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2021-21196
PUBLISHED: 2021-04-09
Heap buffer overflow in TabStrip in Google Chrome on Windows prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2021-21197
PUBLISHED: 2021-04-09
Heap buffer overflow in TabStrip in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.