Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Researchers Hijack Storm Worm To Track Profits

Soulskill posted more than 5 years ago | from the storm-chasers dept.

Worms 128

An anonymous reader points out a story in the Washington Post, which begins: "A single response from 12 million e-mails is all it takes for spammers to turn annual profits of millions of dollars promoting knockoff pharmaceuticals, according to an unprecedented new study on the economics of spam. Over a period of about a month in the Spring of 2008, researchers at the University of California, San Diego and UC Berkeley sought to measure the conversion rate of spam by quietly infiltrating the Storm worm botnet, a vast collection of compromised computers once responsible for sending an estimated 20 percent of all spam." The academic paper (PDF) is also available. We've previously discussed another group of researchers who were able to infiltrate the botnet for a different purpose.

cancel ×

128 comments

Sorry! There are no comments related to the filter you selected.

HMM... (0)

Anonymous Coward | more than 5 years ago | (#25687511)

Looks like spammers are the smart ones.

Re:HMM... (5, Funny)

HexaByte (817350) | more than 5 years ago | (#25687591)

They must be really smart. After all, how are they able to figure out how it is that I'm in need of a bigger schlong, can't get it up w/o viagra and need a new Rolex at bargain prices and I'm looking for a Russian wife. I mean, what kind of research have they been doing to target me perfectly?

Re:HMM... (5, Funny)

aaron alderman (1136207) | more than 5 years ago | (#25687651)

You post on Slashdot?

Re:HMM... (2, Funny)

emlyncorrin (818871) | more than 5 years ago | (#25688465)

Speak for yourself.

oh wait...

Re:HMM... (1)

BrokenHalo (565198) | more than 5 years ago | (#25687751)

I mean, what kind of research have they been doing to target me perfectly?

I don't know, but if the stats are as the submission suggests, it would seem that the only recourse must be a series of extremely messy object lessons.

I might suggest burning "THOU SHALT NOT SPAM" into their backs with an oxy torch. If anyone can suggest an improvement on this, feel free...

Re:HMM... (2, Funny)

Kandenshi (832555) | more than 5 years ago | (#25687795)

Suggest an improvement?
Make them write lines.

No, before you roll your eyes so hard you sprain something, hear me out.
Try to get an estimate for how prolific this particular spammer is, and then make them legibly write out every e-mail they have ever sent by hand, using crappy 5 cent pens that splutter and run dry frequently.

They get released when they're done.

Re:HMM... (4, Interesting)

zappepcs (820751) | more than 5 years ago | (#25687959)

Actually, I'd rather they be made to pick up a piece of litter for every spam email they sent, or some other such public service that equates piece for piece to the amount of spam they have sent.

Repaint a house for someone = 100 spam messages
Clean up a city block of litter = 100 spam messages

Well you get the point. Force them to wear bright yellow spandex jumpsuits with the spam logo on it until they have fully atoned.

Whatever the punishment, it should be public, and only mildly degrading.

Something that lets us all remember what they did, and what it costs in reparations.

Re:HMM... (1)

symes (835608) | more than 5 years ago | (#25688977)

Think yourself lucky - I get targetted by ads for diet pills and hair restorer.

Re:HMM... (2, Funny)

Whiteox (919863) | more than 5 years ago | (#25690595)

Damn it! You're right.
Out of all the spam I've gotten in recent years, I've only got 1 from a Russian bride-to-be:

Hello! My name is Nataliya, me of 26 years, I the intellectual, nice, sexual girl which at present searches for serious attitudes - I shall tell more search for the man for marriage!
I only, that have read through your questionnaire and it has very much interested me, I wish to continue to learn you.
So we can have dialogue!

Please reply only my personal e-mail: iriska640@yahoo.com

I look forward to your prompt answer :)
Nataliya.

As I'm already married ('nuff said), I can't take advantage of this incredible offer, so you can have her.
BTW She's blond, petite, late 20's.
Good Luck

Holy Shit (0)

Anonymous Coward | more than 5 years ago | (#25687515)

I thought everybody must be buying Viagra.

get some priorities! (-1, Flamebait)

Anonymous Coward | more than 5 years ago | (#25687525)

not 5 days ago, we made history by electing the first nigger president and you want to talk about worms? get some priorities! Everything is going to change! Messiah President Barack will pay for our mortgages and cars by farting rainbows.

Re:get some priorities! (0)

Anonymous Coward | more than 5 years ago | (#25690233)

Actually, it's quite on-topic. Barach H Obama may very well have worms.

Double standards? (5, Interesting)

Anonymous Coward | more than 5 years ago | (#25687533)

How come they don't track down the IP addresses of infected computers and inform the users their computer is compromised? It seems these researchers also are getting a kick out of the botnet at the cost of the victims.

Re:Double standards? (5, Insightful)

darkside_al (702437) | more than 5 years ago | (#25687569)

Because it's useless, most probably, that user in one hour will enter another p0rn site and get infected again. The big problem in securing home computers is user behavior, doesn't matter that you put a lot of warnings, he will hit install in a sec if is searching for pr0n.

Re:Double standards? (1, Insightful)

Anonymous Coward | more than 5 years ago | (#25687617)

Ergo, it is ethical to use the botnet for research. Oh, wait...

Re:Double standards? (4, Insightful)

X0563511 (793323) | more than 5 years ago | (#25688487)

Imagine this scenario:

You have Bob. Bob has a thing about catching STDs. No matter how many times he gets cleaned up, he turns around and does something stupid and gets a new one, and in turn passes them on.

Is it unethical to study his infections? The subject won't stop getting the infections, nor will he stop spreading them. However, we can use what we learn from studying the subject further on down the line.

Not quite so black and white is it? I side with the researchers. The botnet will be there either way, and if we actively destroy it a new one will be made in it's place (and possibly improved, preventing study). Might as well learn what we can from it before making a move.

Re:Double standards? (0)

Anonymous Coward | more than 5 years ago | (#25689921)

So therefore it's perfectly fine to go into Bob's house to study his STDs while he's asleep just because he left his doors unlocked?

Re:Double standards? (1)

MisterBlueSky (1213526) | more than 5 years ago | (#25691065)

Is it unethical to study his infections?

No. But not telling him about his infections is unethical.

Re:Double standards? (1)

cbiltcliffe (186293) | more than 5 years ago | (#25692143)

Researcher: Your computer is infected.
User: My computer's working fine.
Researcher: But you have a virus. You're sending spam.
User: I've never sent spam!!
Researcher: Not you....your computer.
User: My computer's working fine.
Researcher: Fsck it.

Now repeat this half a million times.

Re:Double standards? (1)

uvajed_ekil (914487) | more than 5 years ago | (#25692383)

You have Bob. Bob has a thing about catching STDs. No matter how many times he gets cleaned up, he turns around and does something stupid and gets a new one, and in turn passes them on. Is it unethical to study his infections? The subject won't stop getting the infections, nor will he stop spreading them. However, we can use what we learn from studying the subject further on down the line.
Yes, if you propose to examine or diagnose Bob against his will, it would be medically unethical. He has a right to privacy, even if he is a douchebag. Even if he doesn't know you are studying him (say you set up surveillance on him or drug him and kidnap him) it is unethical to study him directly without his knowledge or permission. Studying trends or the people he infects, or how diseases spread in general, is a different story, and none of his business. I'm not sure this is a fair analogy anyway though, especially since one's privacy has already been compromised if a computer is infected by a botnet, and the professional standards are not the same. Apples to oranges, and I don't really have a problem with infiltrating botnets, though I have a hard time articulating why. I guess opening one's computer up to the internet isn't the same to me as contracting a disease or getting medical care.

Which leaves two possible solutions. (3, Insightful)

khasim (1285) | more than 5 years ago | (#25688231)

#1. The ISP blocks all outgoing port 25 connections. We've been over this one before. It means more expenses for the ISP so they're not going to do it unless they are forced to do it through law.

#2. The vigilante approach of writing a "virus" that identifies and infects infected computers ... and then removes the existing infection, downloads updates, installs a silent anti-virus app and checks back in at regular intervals for updates. The problem with that is that the people who do it become "criminals" under US law.

Re:Which leaves two possible solutions. (3, Insightful)

Intron (870560) | more than 5 years ago | (#25688521)

I wondered about #1, also. My ISP blocks *inbound* port 25 but not outbound. They don't want to let me run a server on a dynamic home IP address because they want to charge me for a business use. They also block inbound port 80.

It turns out the reason they don't block outbound 25 is because that would force the spammers to email out through the ISP mail servers which would get them blacklisted. They are fine with letting the home users send spam and get blacklisted. It doesn't cost them anything.

Re:Which leaves two possible solutions. (3, Insightful)

aztektum (170569) | more than 5 years ago | (#25689101)

Wouldn't they get blacklisted if a users IP is attached to a block assigned to that ISP?

Re:Which leaves two possible solutions. (0)

Anonymous Coward | more than 5 years ago | (#25691701)

That's just your ISP. My cable modem ISP blocks inbound and outbound on port 25.

It's pretty annoying actually because it makes it hard for me to test my mail servers but I understand the need to pinch spammers as much as possible.

Re:Which leaves two possible solutions. (0)

Anonymous Coward | more than 5 years ago | (#25693009)

Your argument is a little too simple. The main reason NOT to block outbound port 25 would be because a lot of software (too much) uses direct SMTP for legitimate purposes (bug reports, activation etc), or because some users (like myself) want to use other mail servers (and *some* software only supports port 25, or at least requires reconfiguration). If one percent of your customers complains about that, you have a problem. On the other hand the main purpose of blocking inbound port 25 is to protect the net stupid idiots who *believe* that they are smart enough to set up a mail server from creating open relays. I guess of the *standard end user* DSL lines less than 0.01 percent have an real interest in running mail server (beyond just trying it). If you want to set up a server, get an appropriate contract (not for end-users).

Re:Which leaves two possible solutions. (1)

mortonda (5175) | more than 5 years ago | (#25689317)

My ISP, Cable One, does in fact block outbound port 25. Makes it hard to test remote mail servers. :(

But they do allow inbound port 25, so I can run my own mail server and just set their SMTP server as a smarthost in my own postfix config.

Re:Which leaves two possible solutions. (1)

techno-vampire (666512) | more than 5 years ago | (#25691997)

Earthlink Network started blocking outbound Port 25 about ten years ago, and AFAIK still does. If you're an Earthlink customer, either you use their SMTP servers or you don't use Port 25. I don't know how much good it does anymore, but at the time, it helped keep down the amount of spam coming out of them because having to use their servers makes it much easier to trace back and prove. Now, of course, they probably just use 587 to reach some foreign server that's set up to relay for them.

Re:Double standards? (0)

Anonymous Coward | more than 5 years ago | (#25688553)

How can I tell if my machine is infected?

Re:Double standards? (0)

Anonymous Coward | more than 5 years ago | (#25688973)

Are you using Windows?

You might be infected if ... (1)

Smallpond (221300) | more than 5 years ago | (#25690581)

Files in Windows System folder:
  wincom32.sys
  peers.ini
  wincom32.ini

Registry key:
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wincom32

Re:Double standards? (2, Interesting)

mixmatch (957776) | more than 5 years ago | (#25688827)

Maybe we should popularize free, safe sites like youporn, porntube, and xtube and this can all go away?

Re:Double standards? (0)

Anonymous Coward | more than 5 years ago | (#25690607)

best answer for a problem ever!
but it IS a possible solution

Re:Double standards? (5, Funny)

Erikderzweite (1146485) | more than 5 years ago | (#25687599)

Or they could change the worm to format hard disks on infected machines -- once done, a PC cannot send spam till reinstall. And this time, the user will be a bit more careful about PC security.
Problemo solved!

Re:Double standards? (4, Interesting)

Seth Kriticos (1227934) | more than 5 years ago | (#25687779)

That is a bit harsh, but the basic idea is not that wrong. Users don't care about security because it is a bigger inconviniance than the not doing it. The botnets are quiet and Joe Sixpack can't relate insecure OS / config with spam (don't cares).

Maybe someone should introduce some inconviniance for spam infected bandwitch usage (i.e. charge money for the potnet traffic)? If people have to pay for compromized systems, then maybe they will get up their ass*s. Just a thought.

And yes, I know, the idea must be elaborated and gives a whole set of new issues.. Just ment as starting point for a discussion.

Re:Double standards? (3, Interesting)

wvmarle (1070040) | more than 5 years ago | (#25688033)

It sure is a point that back in the day, the end user was really inconvenienced by viruses. Internet didn't exist yet for end-users, and software was transfered by floppy or over BBSes. Spamming hadn't been invented.

The first virus I encountered was relatively benign: displaying fake cursors on your screen, something like that. Irritating enough to realise you're infected and figure out what's wrong and doing something about it.

At the time many viruses were also designed to wipe/corrupt data - something that keeps you on the edge. That risk is much more direct, and much more costly that a slightly slower computer that tries to send out a lot of e-mail.

Nowadays I do have to admit being less concerned about these viruses, except where it comes to keyloggers and so. That want to steal your banking data. However considering the profilation of fishing (recently I get dozens of mails for "update your Google AdWords payment information") even that seems to be a low risk issue.

Besides I'm not using Windows... OS/X and Linux only... and I know not to click on links in spam, and browsing with non-IE browsers blocks 99.9% of the drive-by downloads but not all: I have got some requests for where to save a .exe file to; automatic download function. At least not hidden.

Re:Double standards? (1)

Seth Kriticos (1227934) | more than 5 years ago | (#25688081)

I don't realy get, how you relate to my previous post. I'm on Linux too and have no problems with this issue (except the spam sent to me).

I was actually talking about the smuck next door, that does have no clue about it and also don't want to have it, neighter seeks help from someone how does.

Re:Double standards? (1)

denmarkw00t (892627) | more than 5 years ago | (#25689127)

I don't know that I agree with your spam-tax, primarily because you are going to see a lot of upset customers - A LOT - who will feel as if their ISP has shafted them with shady "you didn't know it but we're charging you for having an infected computer" practices. BUT, it wouldn't hurt ISPs to require user systems to pass a set of tests before getting online. Of course, that also raises questions and concerns - my reply would be "I paid for it now let me online!" ISPs hate it when you get irate - they hate it even more when you threaten to cancel service (could save you $60~$100 a year!)

Re:Double standards? (1)

uvajed_ekil (914487) | more than 5 years ago | (#25692457)

That is a bit harsh, but the basic idea is not that wrong. Users don't care about security because it is a bigger inconviniance than the not doing it. The botnets are quiet and Joe Sixpack can't relate insecure OS / config with spam (don't cares).

What about Joe the Plumber? Some regular Joes understand a bit about how these maverick programs run in the background to do nefarious things. Do these people come to me all the time for help, because they think something may be amiss but aren't sure exactly what is wrong or how to fix it? You betcha. I think average folks are poorly informed on topics like this, but the success of the anti-virus/anti-spam/anti-malware/bloated firewall/anti-pop-up software industry is indicative of some level of awareness.

Or maybe I'm wrong and people spend tons of money on expensive software they really don't need for the same reasons they respond to spam - ignorance and a feeling of a need to act on everything.

Re:Double standards? (3, Insightful)

Bokononist (1355095) | more than 5 years ago | (#25687661)

The best they could really do with the addresses would be to track down the ISPs of the users. The ISPs would then be faced with spending time (== money) to link an IP and time-window to an actual user, and then inform that user.

Their reward for this effort would be to have one of their technical support people spend an hour on the phone explaining to a clueless and scared someone that they needed to reinstall their XP & applications. This, they ultimately would not do.

Re:Double standards? (2, Insightful)

Seth Kriticos (1227934) | more than 5 years ago | (#25687825)

Informing users? How? Most of them don't get how to use a door bell, not to mention complex computer concepts.

How about some countermesures? I mean, if they can infiltrate the botnet, then is it not possible to track it's traffic? I mean, if the ISP's would do that, then they could block it (the control packages) and the spam clients may loose the spam to send out and idle around?

Well, they probaby also must replicate and send a "Shut up" command to the clients.

Messing with the users is mostly bad (no option), because they are a) mostly technically illiterate (dumb) + don't care and b) there is a whole lot of liability issues (see Sony rootkit).

Re:Double standards? (1)

zblack_eagle (971870) | more than 5 years ago | (#25690379)

Educate them. You don't need to teach them advanced computer concepts, just teach them safe browsing habits and a healthy paranoia of the vectors used for social engineering attacks. Users may still get worms and such from not having up-to-date systems, but user misaction is a bigger cause of problems than user inaction.

There's enough people needing said education that you could run basic one hour classes for them. And the regularly spurted 'cost to the economy' figures for the fruits of stupid behaviour could easily justify making it free for them if they want to continue to have an internet connection

Re:Double standards? (1)

cbiltcliffe (186293) | more than 5 years ago | (#25692181)

User: A free basic computer class? I don't have the time. Besides, I know how to download my pr0n, and my computer's running fine.
ISP: But you're sending spam.
User: No I'm not. I don't even use email.
etc.etc.

Much better solution (1)

Colin Smith (2679) | more than 5 years ago | (#25687715)

Zap the partition table.

 

Re:Double standards? (1)

mapkinase (958129) | more than 5 years ago | (#25687841)

I anticipate legal problems for researchers. By some kind of exotic formulation of the Murphy's law, the first ones among those who break a law are the most innocent ones.

Re:Double standards? (2)

qkan (89307) | more than 5 years ago | (#25687855)

As some smart, responsible and otherwise nice people learned the hard way, one of the possible outcomes of reporting a security issue to the affected entity is being sued for illegal activity, reported to the feds etc. by the said entity. After reading some of these horror stories (and seeing no change in the trend over the last decades), I can say for myself that the only situation where I would report a security issue is to my employer since this is, well, my duty as a loyal employee. Or to a "known sane" party, of course, but we're speaking about contacting total strangers in this particular case.

Re:Double standards? (1)

plover (150551) | more than 5 years ago | (#25688195)

How come they don't track down the IP addresses of infected computers and inform the users their computer is compromised? It seems these researchers also are getting a kick out of the botnet at the cost of the victims.

I think that would have been a responsible end to the study, but there was no mention in their paper of a "cleanup" phase. They did, however, take great care to follow an ethical code and "strictly reduce harm". To them, that meant: do not send victims actual malware, do not send victims to actual spammer sites, and do not collect credit card information. The spammers' victims were never "worse off" for having participated in the campaign.

Of course, contacting these people saying "you were identified in a spam campaign" would likely lead to thousands of lawsuits. The victims might have claimed "why didn't you stop me?" It's a messed up legal situation already.

Re:Double standards? (1)

slashqwerty (1099091) | more than 5 years ago | (#25689105)

This is what the study had to say on ethics:

4.5 Measurement ethics

We have been careful to design experiments that we believe are
both consistent with current U.S. legal doctrine and are fundamen-
tally ethical as well. While it is beyond the scope of this paper to
fully describe the complex legal landscape in which active security
measurements operate, we believe the ethical basis for our work
is far easier to explain: we strictly reduce harm. First, our instru-
mented proxy bots do not create any new harm. That is, absent
our involvement, the same set of users would receive the same set
of spam e-mails sent by the same worker bots. Storm is a large
self-organizing system and when a proxy fails its worker bots au-
tomatically switch to other idle proxies (indeed, when our proxies
fail we see workers quickly switch away). Second, our proxies are
passive actors and do not themselves engage in any behavior that
is intrinsically objectionable; they do not send spam e-mail, they
do not compromise hosts, nor do they even contact worker bots
asynchronously. Indeed, their only function is to provide a conduit
between worker bots making requests and master servers providing
responses. Finally, where we do modify C&C messages in transit,
these actions themselves strictly reduce harm. Users who click on
spam altered by these changes will be directed to one of our innocu-
ous doppelganger Web sites. Unlike the sites normally advertised
by Storm, our sites do not infect users with malware and do not col-
lect user credit card information. Thus, no user should receive more
spam due to our involvement, but some users will receive spam that
is less dangerous that it would otherwise be.

Spam protection (4, Interesting)

Andr T. (1006215) | more than 5 years ago | (#25687609)

I don't have any data to back this up, but it seems to me that people are migrating from small provider companies to big internet provider companies - and their e-mail is going together. And it also seems to me that all those big companies have good e-mail filters (or they're getting one that will be good in a small period of time). If that's true, spam will face a dead end pretty soon.

Even if you stay with a small provider company with your personal e-mail, there are many good solutions to avoid spam. I used Popfile [getpopfile.org] for a long time and it worked pretty well.

Either way, if people will go to their spam box and click that viagra ad, it will be their problem. It doesn't affect me anymore.

Re:Spam protection (2, Insightful)

lysergic.acid (845423) | more than 5 years ago | (#25688277)

that's a good point. i'm guessing part of the reason why Gmail has such a good spam filter is because they implement collective filtering by allowing users to easily mark spam messages, and also because with such a large user-base they can implement statistical filtering techniques much more effectively.

what i don't get is why ISPs big and small don't just cooperate with each other and trade/pool information needed to fight spam. it would improve everyone's quality of service, so why not work together to achieve common ends. combating spam is one situation where different businesses don't need to compete with one another because they have shared interests.

even if you're just a small ISP with only a few thousand users, if you work with 10-20 different similar sized ISPs to collectively implement a shared spam-filter, you would achieve much better results than what each ISP could obtain on their own. not only are there more e-mails to perform statistical analysis and Bayesian filtering on, but there are also more users to identify/catch the spam messages that slip past the filters. that way the job of catching stray spam e-mails is distributed across a much wider user-base. instead of each user having to mark 10 spam messages a day, perhaps they only have to mark 10 messages a month.

Re:Spam protection (0)

Anonymous Coward | more than 5 years ago | (#25688815)

that's a good point. i'm guessing part of the reason why Gmail has such a good spam filter is because they implement collective filtering by allowing users to easily mark spam messages, and also because with such a large user-base they can implement statistical filtering techniques much more effectively.

And they fail at it. Because for the last few weeks I have been receiving email on my gmail-account SENT FROM THAT SAME GMAIL-ACCOUNT!

Posting AC because of modpoints.

Jerry S.

Please clean up keyboard, the shift-key is not working properly.

Re:Spam protection (1)

Vlad_the_Inhaler (32958) | more than 5 years ago | (#25693071)

My email provider has good spam filters, so why do I have them turned off?

I am on a mailing list. I had the mailing list domain on my whitelist and had the setting activated to 'block spam and send me a summary every 24 hours'.

They sent me a summary every 24 hours listing a couple mails they were apparently not sure about and silently ate the rest - including all list traffic. Thank you guys. Now I am back to 25 spams a day.

That was gmx.net in Germany.

Re:Spam protection (1)

houghi (78078) | more than 5 years ago | (#25693097)

The summery talks about 1 single response makes spam profittable. As long as that is happening, you pay for spam. Many people think that if they have a good filter that they have solved the spam problem. That is not true.

Spam is solved if we don't need a filter anymore. A filter takes away the symptoms, not the desease itself. Better filters will change the 12 million to a higher number. So instead of 12 million, they send out 24 million spams.

The best bet to actualy solve it will be to abandon SMTP completely and replace it with something different. No, I have no idea what, otherwise it would already be available. The problem with ditching SMTP is that finding a replacement is hard and costs money and at this moment nobody that is importand really suffers. Also it needs to be done worldwide and everybody has to agree.

And I do mean something completely different. This will require new servers, new clients and new standards. This is not just a technical problem, it is also a poitical, social AND economical problem to solve.

The providers need to up their traffic and pay people to filter spam? Charge the customer. It is cost of doing business. No loss for them. The only person who suffers is the end users and who really cares about him? From the different groups, only the end user has problems. So convincing all the others to change will be extremely hard.

Untill that is solved, spam will excist.

Seems bogus (0)

Anonymous Coward | more than 5 years ago | (#25687783)

So I send 12 million e-mails, I receive one response, and somehow I get not just millions of dollars, but millions of dollars a year? What kind of response could do that? A billionnaire replies saying he wants all of the viagra I'm selling, and he doesn't mind keeping me as a high-margin middleman for years?

Re:Seems bogus (1)

GospelHead821 (466923) | more than 5 years ago | (#25687861)

The way I read it, they only need one response for every 12 million emails that they send. They send many more than that and they might get more than the one response per 12 million necessary to make a profit. It's more a testimony to the low cost of sending those 12 million emails.

Re:Seems bogus (1)

Jeremy Erwin (2054) | more than 5 years ago | (#25687873)

No. If you send 12 million emails, you can expect to get one order for $100 pills. To sell a million dollars worth of product, you would have to send 120 billion emails.

Re:Seems bogus (1)

Flibberdy (780254) | more than 5 years ago | (#25688001)

Given that they sent 350Million emails that linked to the researcher's websites in a month, and that they estimate they redirected 1.5% of the botnet's total spam. 1 in 12Million over however many billions of emails they send a month == profit

Storm Worm (4, Funny)

phazux (752351) | more than 5 years ago | (#25687821)

Oh, Spam... right.

When I first read the title, I was thinking more along the lines of:

Bless the Maker and His water.
Bless the coming and going of Him,
may His passage cleanse the world,
may He keep the world for His people.

-- Frank Herbert

Re:Storm Worm (1)

Hoi Polloi (522990) | more than 5 years ago | (#25688719)

May the maker produce a spiced canned meat
Bless the coming of him and curse his going for it is unpleasant

Fuck?! (-1, Troll)

Anonymous Coward | more than 5 years ago | (#25687823)

the most. LLok at

Time for some draconian penalty? (1)

Seth Kriticos (1227934) | more than 5 years ago | (#25687857)

How about just raising the penalty for guilty spammers. You know, forcing them to read spam for 8 hours / 7 days a week for several years. Maybe that would help?

Re:Time for some draconian penalty? (0)

Anonymous Coward | more than 5 years ago | (#25688017)

One minute in prison for each spam mail sent. Or even, one second; still works out to a lot.

Re:Time for some draconian penalty? (1)

Lead Butthead (321013) | more than 5 years ago | (#25688061)

How about just raising the penalty for guilty spammers. You know, forcing them to read spam for 8 hours / 7 days a week for several years. Maybe that would help?

That however does nothing to rehabilitate the spammer nor does it prevent relapse (See Spamford Wallace). I propose that we go directly to the death penalty and kill two birds with one stone.

the vigilante approach (4, Interesting)

v1 (525388) | more than 5 years ago | (#25687875)

I realize this will either be wildly popular with you or you'll hate it, but what I'd like to see someone do is infiltrate the botnet somehow (either by vulnerability or crack their key or whatever) and send a command to the herd to zero the boot sector and shut down their host. (the zombies, not the herder's machines)

Nothing enough to cause data loss, but enough to force the naive owners to take their machines to someone to get them fixed/cleaned up. I'm tired of being a victim of computer neglect en masse.

Not saying there's just one botnet out there, so I'd be greatly entertained to see them fall one by one. Should make a nice spectacle. Wouldn't it be entertaining to get up tomorrow and read front page stories all over the place the likes of which we got with Code Red, that a sizeable chunk of zombies just dropped off the grid and there were long lines at the PC repair shops this morning? Stories of entire businesses being brought to a halt because 95% of the machines in their office were owned? Sorry, but "serves them right", and thank you have a nice day while I go check my mail and see 80% fewer medications for sale.

Re:the vigilante approach (3, Interesting)

mdmkolbe (944892) | more than 5 years ago | (#25687931)

No need to zero the boot sector, just pop-up a window that says "you have been infected by the Storm worm" every two minutes. The machine is still functional so it is easier to fix, but recovery is easier and less likely to result in data loss.

(This all is based on the assumption that doing so would be ethical which I don't think it is, but thought experiments don't hurt.)

Re:the vigilante approach (3, Insightful)

Anpheus (908711) | more than 5 years ago | (#25688253)

And so next time when malware like that damn Antivirus 2009 trojan is installed, they'll be more likely to follow the instructions: "Your computer is infected, click here to scan your computer."

Re:the vigilante approach (1)

mdmkolbe (944892) | more than 5 years ago | (#25690317)

Ok, so maybe we say "All your base are belong to us" and display I nice big red skull and cross bones along with the sound of a menacing laugh in the background. Like you say we don't want a "click here to fix", but all we need is to increase the visibility of the virus to the user. Once discovered viruses get removed (one way or another), the biggest problem is getting them noticed.

Re:the vigilante approach (1)

LoztInSpace (593234) | more than 5 years ago | (#25693331)

How about sending all their recently used URLs to everyone in the address book cc themselves? That should raise the profile a bit and send most people scurrying off to the nearest AV software.

Re:the vigilante approach (0)

Anonymous Coward | more than 5 years ago | (#25691811)

No need to zero the boot sector, just pop-up a window that says "you have been infected by the Storm worm" every two minutes.

A legit message must be locale neutral and quick. It seems enough lusers actually try to follow them:
"You have been infected by the Storm worm. Please take this computer to your local repair shop"

Even legit nerds would understand that nobody is trying to make a quick buck with a hyperlink scam to fake antivirus software... instead of paying cash to be scammed facelessly, you'd be paying to be informed at a brick and mortar store.

Re:the vigilante approach (1)

Repossessed (1117929) | more than 5 years ago | (#25691917)

Either is likely to result in data loss. Most people do not have the resources or the knowledge to handle a virus not caught by their scanner. And of the handful of technical support providers who support the software at all, I don't know any who will help with viruses beyond wiping and starting over.

Re:the vigilante approach (3, Interesting)

kvezach (1199717) | more than 5 years ago | (#25688045)

How about turning the machines on them? As far as I understood from the scientific paper, the proxy hosts are contacted by the botmasters (through servers run on bulletproof hosting). Thus it would seem pretty easy to just substitute the send spam command (when the workers ask) with a "DDoS this target" command, where the target is the botmaster server you got the original spam command from. The stronger the botnet, the harder it falls, and while bulletproof hosting servers may scoff at threats of police action, they sure won't like being DDoSed up the wazoo.

Re:the vigilante approach (2, Informative)

v1 (525388) | more than 5 years ago | (#25690873)

The problem is most of them are "fast flux" - the C&C servers move around daily. There's no stationary target to hit. Even if you go after a host channel somewhere etc, they just move to a different IP and change domain name records.

Re:the vigilante approach (2, Interesting)

russotto (537200) | more than 5 years ago | (#25688537)

I realize this will either be wildly popular with you or you'll hate it, but what I'd like to see someone do is infiltrate the botnet somehow (either by vulnerability or crack their key or whatever) and send a command to the herd to zero the boot sector and shut down their host. (the zombies, not the herder's machines)

All that will do is get law enforcement after the vigilantes. Law enforcement is much more concerned with effective competition than they are with ordinary lawbreakers, so they won't stop botnet-building spammers but they will come down hard on vigilantes.

So, don't do that. Instead of shutting down the machines, take them over. And take precautions against anyone taking them back. Set up Bittorrent seeds for pirated films on them, if you like, and watch the MPAA go after the zombie owners. If you just look like another criminal, you probably won't get much attention from law enforcement.

(disclaimer: the above is a hypothetical scenario. Actually trying to pull it off may result in arrest, hospital time, or death depending on who gets to you first).

Remove the tcpip stack (3, Insightful)

Colin Smith (2679) | more than 5 years ago | (#25688595)

Consider it a form of quarantine.
 

Because of stealing (1)

Britz (170620) | more than 5 years ago | (#25687901)

Only because the botnet operators steal resources in such a large manner they can turn a "profit". Whatever that may be. How do you calculate a script kiddies costs anyways?

The much more interesting information was the US$ 2700 for about 350 Million Spam messages received and (an estimated) four times as much sent.

Rounded up that is a dollar earned for every 10 Million messages received and 40 Million messages sent (and caught as spam early on). Not counting that: "Still, the researchers acknowledge their figures don't take into account perhaps the most profitable aspect of the pharma spam business: The repeat customer who comes back time and again to purchase refills."

I would like to see that figure (10 Million for 1 Dollar) put against the resources lost/spent fighting Spam. How much damage do they do in order to make money. Do they steal 1 Dollar for every Cent they make? 10 Dollars? 100 Dollars? How much does it hurt the economy?

And maybe it is finally time to do something serious about Spam.

And the answer is . . . (1, Interesting)

Anonymous Coward | more than 5 years ago | (#25687905)

A single response in 12 million emails ? So someone orders $50 of 'GetHard' or whatever.

Then introduce micropayments on all emails. $50/12,000,000 or about 0.5 millicents an email. No normal operation would suffer, and spammers can't make a profit. Job done.

The spammers aren't using their own machines. (1)

khasim (1285) | more than 5 years ago | (#25688193)

So your plan would result in Joe Sixpack getting a bill for email that he claims he didn't send.

And he would be correct. He would not have sent it. His machine would have. While it was a zombie.

Re:The spammers aren't using their own machines. (1)

maxume (22995) | more than 5 years ago | (#25688501)

This is only sort of a problem; it would at least get their attention.

Re:The spammers aren't using their own machines. (1)

cbiltcliffe (186293) | more than 5 years ago | (#25692321)

No, they'd just get pissed at their ISP for billing them for something they didn't do, and rightfully so.
And when the ISP didn't budge, they'd go to a new one, if they're anywhere other than monopoly-fascist USA, with no broadband competition.
No matter how many times this happened, it would always be the ISPs fault, according to the customer.

I've previously been ridiculed for (1)

Vadim Makarov (529622) | more than 5 years ago | (#25687933)

proposing refundable microcharge for sending email [vad1.com] (which is NOT fully refunded ONLY when the recipient subsequently marks incoming email as spam). Obviously my idea might be flawed, but those who have critiqued it never formulated why. At the present conversion rates, a refundable cent per email will do wonders. Possibly it will kill spam, or at least change its quality and quantity very considerably.

Re:I've previously been ridiculed for (2, Informative)

TheLink (130905) | more than 5 years ago | (#25688183)

How do you pay?

So far it's hard to pay random people on the internet. For instance if I want to pay you USD1, it'll cost me more than USD1 in time and money to do so.

Re:I've previously been ridiculed for (1, Informative)

Anonymous Coward | more than 5 years ago | (#25688371)

Joe Dumbass signs up for Bass Fisher Extreme News letter.

Bass Fisher Extreme sending him his weekly email.

Joe Dumbass forgets he signed up for this and hits the 'Report SPAM' link instead of the 'unsubscribe' link.

Bass Fisher Extreme loses money.

Re:I've previously been ridiculed for (1)

Yvan256 (722131) | more than 5 years ago | (#25688821)

Bass Fisher Extreme should monitor the bounced/spam-tagged emails on their list to stop sending them to these people.

Total cost: 1 cent per Joe Dumbass user. And if micropayments exist to do that, then they also exist to require micropayments from subscribers. At 1 email per week, it cost someone 52 cents per year to receive the newsletter, which is half the 99 cents threshold for impulse purchases.

Re:I've previously been ridiculed for (1)

mixmatch (957776) | more than 5 years ago | (#25688941)

Bass Fisher Extreme sees the list of charged emails and removes them from their system.

Re:I've previously been ridiculed for (1, Insightful)

Anonymous Coward | more than 5 years ago | (#25688619)

Your post advocates a

( ) technical ( ) legislative (x) market-based ( ) vigilante

approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)

( ) Spammers can easily use it to harvest email addresses
(x) Mailing lists and other legitimate email uses would be affected
(x) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
(x) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
(x) Requires immediate total cooperation from everybody at once
(x) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
(x) Anyone could anonymously destroy anyone else's career or business

Specifically, your plan fails to account for

( ) Laws expressly prohibiting it
(x) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
( ) Asshats
( ) Jurisdictional problems
( ) Unpopularity of weird new taxes
(x) Public reluctance to accept weird new forms of money
(x) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
( ) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
(x) Extreme profitability of spam
(x) Joe jobs and/or identity theft
( ) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
( ) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook

and the following philosophical objections may also apply:

(x) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
(x) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough

Furthermore, this is what I think about you:

( ) Sorry dude, but I don't think it would work.
(x) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your
house down!

Re:I've previously been ridiculed for (0)

Anonymous Coward | more than 5 years ago | (#25689745)

So, you have proposed a technical and administrative approach who requires collaboration from everyone at once (including spammers, since you'll need to know how to charge them), a migration to a new protocol that doesn't improve the older one, even when IPv6, a serious improvement over IPv4, has not been adopted widely, and a new supranational authority that will have to distribute in a fair way the profits earned from spam. WTF!?

Obligatory (-1)

Anonymous Coward | more than 5 years ago | (#25687947)

Okay gotta do it:

1.Write a Botnet program
2.Infect computers
3.????
4.Profit!

Ethics of the study (3, Insightful)

slashdotmsiriv (922939) | more than 5 years ago | (#25688035)

the researchers seem to take the legality of their actions under serious consideration. From TFA:

"Measurement Ethics:
We have been careful to design experiments that we believe are both consistent with current U.S. legal doctrine and are fundamentally ethical as well. While it is beyond the scope of this paper to fully describe the complex legal landscape in which active security measurements operate, we believe the ethical basis for our work is far easier to explain: we strictly reduce harm. First, our instrumented proxy bots do not create any new harm. That is, absent our involvement, the same set of users would receive the same set of spam e-mails sent by the same worker bots. Storm is a large self-organizing system and when a proxy fails its worker bots automatically switch to other idle proxies (indeed, when our proxies fail we see workers quickly switch away). Second, our proxies are passive actors and do not themselves engage in any behavior that is intrinsically objectionable; they do not send spam e-mail, they do not compromise hosts, nor do they even contact worker bots asynchronously. Indeed, their only function is to provide a conduit between worker bots making requests and master servers providing responses. Finally, where we do modify C&C messages in transit, these actions themselves strictly reduce harm. Users who click on spam altered by these changes will be directed to one of our innocuous doppelganger Web sites. Unlike the sites normally advertised
by Storm, our sites do not infect users with malware and do not collect user credit card information. Thus, no user should receive more
spam due to our involvement, but some users will receive spam that is less dangerous that it would otherwise be."

However, their premise of "reducing harm" is questionable. How can we be sure that a person who decided to purchase these drugs (against all warnings) really believes that not buying them is the best thing for him? What if this person really wants to purchase a drug that he thinks will enlarge him? Who gives the researchers the right to decide what other people should spend their money on? Under several legal interpretations, forcing a person not to buy something perceived as harmful is not legal: denying to sell cigarettes to a person of legal age may be illegal, under discrimination laws.

The bottom line is that the researchers have a good point regarding the ethics of their study, however this issue is not 100% resolved.

Re:Ethics of the study (2, Informative)

jonbwhite (1402901) | more than 5 years ago | (#25689011)

However, their premise of "reducing harm" is questionable. How can we be sure that a person who decided to purchase these drugs (against all warnings) really believes that not buying them is the best thing for him? What if this person really wants to purchase a drug that he thinks will enlarge him? Who gives the researchers the right to decide what other people should spend their money on? Under several legal interpretations, forcing a person not to buy something perceived as harmful is not legal: denying to sell cigarettes to a person of legal age may be illegal, under discrimination laws.

The site that the spam normally points to actually sends placebos or mislabled painkillers instead of the actual drugs, so I don't think this is really an ethical issue. However, even if the site did send the real drugs, it is *not* difficult to find an alternative website willing to sell the same items. Not to mention the fact that the sending of the spam was illegal in the first place.

how to get suggestive phrases into a journal. (2, Funny)

jmhoule314 (921571) | more than 5 years ago | (#25688133)

I can now die happy having seen the phrase, "Excellent Hardness is Easy!" in an academic paper.

The scope of the problem (0)

Anonymous Coward | more than 5 years ago | (#25688285)

The scope isn't limited to only windows machines with worms (maybe strictly for this study it is, but not the overall spam problem). The problem goes to insecure servers running a myriad of OSs. It could be anything from BSD to Fedora to Gentoo to Windows Server 2003. There are vulnerable web servers out there and I constantly get spam from too many different domains.

I've also been (sadly) responsible for contributing. My server was hacked a year ago or so and sent out spam emails at an incredible rate for about 6 hours before I or my provider realized. I responded quickly but I've seen too many hosts that have a setup page for some CMS or blog system as their default page. This screams "STEAL ME!" especially if there's a known vulnerability in the CMS they're installing. This page will also remain up for months for God knows what reason. We don't have responsible enough Server Administrators, ISPs, or end users.

RE: Botnets. (1)

Chris Tucker (302549) | more than 5 years ago | (#25688375)

"Botnets. Spammers Botnets.
What kind of boxes are on botnets?

Compaq, HP, Dell & Sony, true!
Gateway, Packard Bell, maybe even Asus, too!

Are boxes, found on botnets, all running Windows, FOO!"

Why is it that TFAs almost never mention the OS of all the computers that make up these botnets?

Perhaps it's just one of those things that EVERYBODY knows, and as such, doesn't really need to be mentioned.

Re: Botnets. (1)

bobbonomo (997543) | more than 5 years ago | (#25688925)

You are probably right about the *indows machine in the botnet. The brand is irrelevant.

What is never mentioned is how many servers are infected (websites) with malware (or participate in it) because of errors in the apps running on them. I would say most of these are running *nix. I don't see IIS that much.

I think we are converting a botnet (spam) problem into a religious OS thingy.

Hygrade frankfurts are fresher because more people eat them or do more people eat them because they are fresher?

There are more *doze PCs out there so more of them will be infected.

Anyone have stats on percentages (with a link)?

Re: Botnets. (0, Flamebait)

justinlee37 (993373) | more than 5 years ago | (#25689987)

If Linux had the greatest market share, it would have the most viruses. Windows is just a big target. Think about it -- if you wrote a virus, would you rather design it to attack 90% of the OSes in the wild, or 2%?

The smugness of the "windows has viruses because it sucks" position is a really poorly thought-out one.

This is not true. (1)

symbolset (646467) | more than 5 years ago | (#25690111)

Just keep saying it though. Maybe eventually people will believe you.

Re: Botnets. (1)

Chris Tucker (302549) | more than 5 years ago | (#25690815)

People write viruses & trojans & worms to infect Windows because Windows is so easy to 0wn.

Solution (0)

Anonymous Coward | more than 5 years ago | (#25690315)

1: Get some Chinese "v1agr4" laced with toxic chemicals
2: Spam
3: Profit!!!
4: Idiots who buy pills though spam die
5: With no dumb ass customers left, and the rest too scared to buy pills online, SPAM is unprofitable.

Problem fixed for trade off in short term increase in Spam :-)

6: Use profits to immigrate to a country that has a nice climate and wont expedite you home to face charges of mass murder.

Re:Solution (0)

Anonymous Coward | more than 5 years ago | (#25691209)

Except that;

1) There may be collateral from killing off Joe Dumbass - S/he may be an idiot, but perhaps they were the breadwinner in their family, or great philanthropists (hey, we already know they aren't tight with their money), or had other useful qualities
2) v1agr4 spam scams are only one of many - it would be naive to think that people would investigate or be informed of social engineering vectors after this specific poison-pill plan - likely they would continue falling prey to other scams (phishing, botnetting, identity theft, etc)
3) There's a new idiot born at least every minute.
4) People would soon forget about the incident, and continue to answer spam (remember, spammers would still be operating, since there's no ongoing costs so no reason to stop).

100% solution follows: (1)

C18H27NO3 (1282172) | more than 5 years ago | (#25690437)

Unsolicited spam email Subject lines _MUST_ contain the phrase, "this is an unsolicited email". I think that would pretty much cover it. (The word Spam isn't used so there isn't any gray area with that processed meat product). I know that there have been attempts at this before and it has been shot down but I don't understand why. Obviously the purpose of this would be to have these in email filters to block the crap all of the time so why doesn't it pass? Someone in the gubment think it unfair to all of the people sending ILLEGAL emails?

Re:100% solution follows: (1)

Waccoon (1186667) | more than 5 years ago | (#25692389)

I recall an article about the "Spam King" where he clearly rejected the idea of putting such markers on his e-mails. Legal or not, he said he wouldn't.

There's no such thing as enforcement when faced with billions of messages every single day. You're on your own to protect yourself, bub.

Load More Comments
Slashdot Login

Need an Account?

Forgot your password?

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>