ComputerSecure Blog

photo credit: problemboard

I saw it, out of the corner my eye, on the TV news.
Then I saw it in the Washington Post. (Links are below.)
A web hosting company has been cut off. A company that (allegedly - nothing proved in court yet) has been helping to send millions of spam emails.
You will see, if you read the article, that some spam ‘watchdogs’ estimated that about 75% of all the current spam was connected to this company.
“Researchers have found that on any given day, about half of all spam sent through the top botnets are ads for male enhancement products and other knockoff designer drugs…”
Ah yes, I know the ones. I get those spams.
Flavour of the year for 2008 has been the suggestion that I might do better in “the bed games” or get help with my “men’s libido”.
Personally, I don’t like to filter spam emails. I prefer to get them all and read them all. That way I get an impression about how many there are, what they are trying to do and how they mean to do it.

Why worry about spam?

So we get some spam emails. That shouldn’t worry us too much. Should it?
What we should worry about is all the other associated nastiness, like botnets and Trojans.
Why? See our easy glossary of computer security terms - referring to botnets and zombies.
What is a Botnet?
What is a Zombie Computer?
In a nutshell, the spammers seem to find that it is a simple matter to invade and control the computers of other people such as users of the web, users of email, chat, social sites etc.
How do they DO that? With Trojans of course.
What’s a Trojan? See our page about viruses, worms and trojan horses.
The Washington Post article says: “…cyber criminals… push out new versions of the “Torpig,” or “Sinowal” Trojan horse program, which is widely considered one of the stealthiest and most sophisticated families of malicious software in existence today.”
And “…a single cyber crime group has used the Torpig Trojan to steal more than a half million bank, credit and debit card accounts from infected PCs over the past two-and-a-half years.”

So, you get the picture here: spam email is only the thin edge of the wedge - the ‘foot-in-the-door’.
If you could see the place from whence spam comes you would see that it’s just a bad internet neighbourhood. Where there’s smoke there’s fire: and where there’s spam there’s invasion of PCs, botnets, identity theft and counterfeit drugs.
Also, as the Washington Post report indicates, the kind of web host that can turn a blind eye to all that crime is exactly the kind of web host that would help people to spread child pornography.

Here’s another thing that interests me about all this.
The offending web host was not raided by any law enforcement authorities. Rather, other companies, who provide internet connections for web hosts, decided to disconnect the spammers.
They did this after getting reports from those security ‘watchdogs’.
I hate using such terms as ’security watchdogs’ - it’s uninformative and sounds like bad-journalism-nonsense-shortcut-terms. Not much better than ‘top scientists say…’.
Who are these watchdogs? I can’t explain right now. Suffice to say that credible computer security firms take a great interest in all the virus, spam and spyware activity on the web: they watch closely where it comes from and what it is trying to do.
But I like to note anything that can be thought of as ‘good news about computer security’.
In this case the good news was that spam was stopped instantly. No police, lawyers or government branches had to be involved. No legal cases had to be worked out.
It remains to be seen whether there will be any prosecutions.
Read the Washington Post articles here and here.

This entry was posted on Monday, November 17th, 2008 at 12:49 pm and is filed under Computer Security, Identity Theft, Phishing. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.