Botnets and Spam

The biggest threat to botmasters is the unrecoverable loss of their botnets. International cooperation in policing spam, malware, child exploitation, and illegal pills has made that loss a reality for many major botnets over the past few years, and will continue to threaten the proliferation of botnets. When the largest botnets get taken down, then the next largest botnets become the new targets. Botmasters have already reacted to this activity by subdividing botnets and increasing the costs associated with activities that are easily detectable (such as DDoS and spam). It is only a matter of time before botmasters implement fail-safes to reestablish command of a botnet that has lost all of the control servers it usually reports to.

In many cases botnets are temporarily hijacked by whitehat security researchers. Due to possible negative side effects, however, these takeovers do not lead to new commands reaching the infected hosts. There is a massive liability issue associated with the unauthorized remote operation of systems, even with the best of intentions. Pushing new commands to an old Windows machine serving a hospital could turn the PC into a brick and lead to incorrect care or even the death of a patient. Botmasters will take advantage of this reluctance by the good guys to meddle by hard wiring their botnets to reestablish control after a take down.

“Snowshoe” spam will continue to increase
When a shady marketing company approaches your marketing people and tells them that they have a list of email addresses that have already opted into receiving whatever advertising you want to send them, it should set off alarm bells. Unfortunately those bells don’t ring often enough. Well known companies selling products from cell phones to cigars to language-learning software to satellite TV to medical supplies have all signed on with these shady advertisers. The shady companies blast out millions and millions of blatantly illegal spam messages every day from newly rented hosts in hosting companies until they get evicted from their subnets or move on after they have turned those addresses, and sometimes the subnets, into permanently blacklisted wastelands. Recipients have their in boxes bombarded with these spam messages and are unable to opt out of them.

Because this sort of activity is not as malicious as the most newsworthy hacks and malware, this area has been mostly ignored by the authorities. Nonetheless, this practice of snowshoe spamming has exploded during the past two years and is currently one of the biggest problems in the spam world. Attempts by researchers to expose this sort of activity have resulted in threats of defamation lawsuits by the companies using these shady marketers. In that environment, this sort of activity will only continue to increase at the breakneck pace that we have seen.

SMS spam from infected phones
Cell phone providers are working to prevent SMS spam. Their primary method of receiving reports from consumers is for the latter to forward messages to SPAM (7726) on their phones and report the messages so that they can be blocked. An infected phone can also send spam text messages; then the victims face the problem of having their accounts closed by the providers.