Subject: RE: [Asrg] 2a. Analysis - Spam Sample

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 12 Nov 2003 14:42:55 -0800

> However, my concern is whether this is a sign that people 
> will begin to 
> attack spam via spam, kind of like a story a while back where a virus 
> was sent to patch a hole explotiable by another virus.

I try not to voice my concerns in public, they tend to be realised sooner
rather than later.

When I started looking at spam seriously 24 months ago I wrote an internal
report which predicted that spammers would start to use trojan horse
techniques. So the virus problem would quickly become a problem of large
numbers of zombie machines captured by spammers that are then used to
propagate themselves through the spammer sender list instead of the local
address book.

A few months ago we started to see this exact signature, the result being
that instead of receiving a spate of virus infection attempts every few
months I now receive several hundred trojan infection attempts per week.

Viruses are dead, they no longer use the address book to replicate, the
replication list is external and has millions of victims listed. 

A spammer can pick and choose the resources they want, Linux boxes were not
usually targetted by viruses, the population is too thin to allow much
propagation. Now that each machine can launch millions of attacks rather
than a few hundred we are seeing significant numbers of compromised linux
boxes. These tend to be a more interesting target for a spammer or DDoS
cracker since they are more likely to be connected to high capacity pipes
and less likely to be listed on blacklists of residential dialup/cable modem
lines.

One of the consequences of this is that IP addresses are no longer a very
useful identifier. The spammer can create new addresses faster than they are
listed. 

We have to pull this out somehow. SPF/RMX do actually provide us with some
traction here. You can hijack an IP address by hijacking the machine. But
machines hooked up with dns names that resolve to them are a different
issue.

		Phill

		Phill

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Dave Crocker <[email-masked]>
Date: Thu, 13 Nov 2003 06:14:23 -0600

Yakov,

YS>  My question to you is what purpose does this
YS> particular spam serve? We have been receiving some of them at the list,

  The same as as sending worms and virii.  The same as making a prank
  or obscene phone call.

  Spam is not just selling something.

d/
--
 Dave Crocker <dcrocker-at-brandenburg-dot-com>
 Brandenburg InternetWorking <www.brandenburg.com>
 Sunnyvale, CA  USA <tel:+1.408.246.8253>