Security researchers take out botnet responsible for 18 billion spam emails a day
The four year old botnet - known as Grum - is believed to have been responsible for around 18% of the world's spam emails
Thursday 19 July 2012
Related articles
If you're a fan of fake Rolex watches and cheap Viagra look away now.
A huge spam botnet responsible for an estimated 18 billion messages a day has been taken out by security researchers.
The four year old botnet - known as Grum - is believed to have been responsible for around 18% of the world's spam emails.
A botnet is a cluster of infected computers used by cybercriminals to send a variety of spam emails - often offering cheap Viagra, fake watches or unusual dating solutions.
The cluster of computers are usually infected using malware.
Security company FireEye and spam-tracking service SpamHaus worked with ISPs to shut down the illegal network.
The control servers for Grum were found to be mainly based in Ukraine, Russia and Panama.
FireEye security has been monitoring Grum since 2008 working in combination with the Russia Computer Security Incident Response Team and the Spamhaus Project.
Spamhaus estimated that up to 120,000 IP addresses were used to send spam each day, but that following the takedown the number reduced to around 21,000.
Writing on the FireEye blog Atif Mushtaq, a security researcher with FireEye said, "Grum's takedown resulted from the efforts of many individuals."
"This collaboration is sending a strong message to all the spammers: Stop sending us spam. We don't need your cheap Viagra or fake Rolex."
Experts anticipate that the takedown should result in a significantly reduced level of junk mail.
On Monday a Dutch server involved in Grum was shut down.
On Tuesday command and control servers based out of Panama were also shut.
"With the shutdown of the Panamanian server, a complete segment was dead forever", says Mushtaq.
However, the good news didn't last long as the bot herders - who scan networks to find weak or vulnerable systems to install their bot program - started pointing the command and control servers to secondary servers located in Ukraine.
Mushtaq says that in the past Ukraine had been something of a 'safe haven' for bot herders and that shutting down servers there had "never been easy."
Around 20,000 computers are thought to be still part of the botnet but are now ineffective without active control and command servers.
In recent years there has been a concerted effort to take down some of the largest botnets.
According to Atif Mushtaq global spam volume is at a record low thanks to the research community's effort against spammers.
Mushtaq is however clear about the scale of the problems involved in taking down botnets: "The research community needs to maintain this pressure until we reach a point where the bad guys start thinking that becoming a spammer is not worth the risk. If I were to rank Grum's takedown difficulty level from one to five where five is the most difficult, I would give Grum a two.
"When the appropriate channels are used, even ISPs within Russia and Ukraine can be pressured to end their cooperation with bot herders. There are no longer any safe havens."
FireEye Grum Takedown Q&A
How significant is the takedown of Grum?
Identifying the control servers quick enough so they can be shutdown is significant as it shows that the right personnel with the right tools can win.
How did FireEye bring down Grum? (in the simplest terms possible!)
FireEye identifies command and control malware call-backs without prior signatures or URLs, by tracking the servers real time even when they move the teams were able to close in and shut them down.
Will people notice a reduction in the amount of spam they receive?
Absolutely. Time will always tell, but removing the command and control for the third largest botnet that was generating spam can only be a good thing.
What advice would you give people to avoid getting a deluge of spam emails?
Your email address is very personal and should be treated as such.
Do your best to make sure it's not published on a website for all the world to see, protect yourself from malware and don't open or reply to emails that don't make sense – even if they appear to be from people that you know.
Life & Style blogs
London renters are getting poorer and moving further out
Plus, do energy saving measures boost house prices?
London Collections: Men – Sporting, suiting, and the great in-between
The spring menswear season has only just begun, but I've already started to get deep and meaningful....
Travel Shop
- 1 Diary of Second World War German teenager reveals young lives untroubled by Nazi Holocaust in wartime Berlin
- 2 'Jail reckless bankers': Report urges the Government to introduce new criminal offence for reckless management
- 3 Breaking the Silence: In the reality of occupation, there are no Palestinian civilians – only potential terrorists
- 4 Uri Geller psychic spy? The spoon-bender's secret life as a Mossad and CIA agent revealed
- 5 Vice pulls 'breathtakingly tasteless' fashion shoot glorifying the suicides of famous female authors from Sylvia Plath to Virginia Woolf
Get your summer started with British Military Fitness
BMF is the UK’s biggest and best loved outdoor fitness classes
How will you make today delicious?
Tell us how you plan to make today delicious and you could win a £50 M&S gift card.
Learn a new language
Add another string to your bow with Rosetta Stone, whether it's Spanish, Italian or Mandarin...
Making reading fun for kids
Nook is donating eReaders to volunteers at high-need schools and participating in exclusive events throughout the campaign.
Introducing the 'Get Reading' campaign
Get the latest on The Evening Standard's campaign to get London's children reading.
Enter the latest Independent competitions
Win anything from gadgets to five-star holidays on our competitions and offers page.
Business videos from commercial thought leaders
Watch the best in the business world give their insights into the world of business.
iJobs Gadgets & Tech
Java Developer
£200 - £250 per day: Progressive Recruitment: Java Developer - Urgent Requirem...
SAP Consultant MM/WM
£40000 - £47000 per annum + BENEFITS : Progressive Recruitment: Sap Consultant...
SAP PP
£45000 - £60000 per annum: Progressive Recruitment: SAP PP functional consulta...
Change Manager,Hampshire,Telecomms,SC Clear,£200PD
Negotiable: Orgtel: Change Manager, Hampshire, Telecomms, SC Cleared, £200 per...
First night: The Cripple of Inishmaan
Scandi-geeks descend on Nordicana for fan-convention
Female aristocrats battle to inherit the title








Comments