Security researchers take out botnet responsible for 18 billion spam emails a day

The four year old botnet - known as Grum - is believed to have been responsible for around 18% of the world's spam emails

If you're a fan of fake Rolex watches and cheap Viagra look away now.

A huge spam botnet responsible for an estimated 18 billion messages a day has been taken out by security researchers.

The four year old botnet - known as Grum - is believed to have been responsible for around 18% of the world's spam emails.

A botnet is a cluster of infected computers used by cybercriminals to send a variety of spam emails - often offering cheap Viagra, fake watches or unusual dating solutions.

The cluster of computers are usually infected using malware.

Security company FireEye and spam-tracking service SpamHaus worked with ISPs to shut down the illegal network.

The control servers for Grum were found to be mainly based in Ukraine, Russia and Panama.

FireEye security has been monitoring Grum since 2008 working in combination with the Russia Computer Security Incident Response Team and the Spamhaus Project.

Spamhaus estimated that up to 120,000 IP addresses were used to send spam each day, but that following the takedown the number reduced to around 21,000.

Writing on the FireEye blog Atif Mushtaq, a security researcher with FireEye said, "Grum's takedown resulted from the efforts of many individuals."

"This collaboration is sending a strong message to all the spammers: Stop sending us spam. We don't need your cheap Viagra or fake Rolex."

Experts anticipate that the takedown should result in a significantly reduced level of junk mail.

On Monday a Dutch server involved in Grum was shut down.

On Tuesday command and control servers based out of Panama were also shut.

"With the shutdown of the Panamanian server, a complete segment was dead forever", says Mushtaq.

However, the good news didn't last long as the bot herders - who scan networks to find weak or vulnerable systems to install their bot program - started pointing the command and control servers to secondary servers located in Ukraine.

Mushtaq says that in the past Ukraine had been something of a 'safe haven' for bot herders and that shutting down servers there had "never been easy."

Around 20,000 computers are thought to be still part of the botnet but are now ineffective without active control and command servers.

In recent years there has been a concerted effort to take down some of the largest botnets.

According to Atif Mushtaq global spam volume is at a record low thanks to the research community's effort against spammers.

Mushtaq is however clear about the scale of the problems involved in taking down botnets: "The research community needs to maintain this pressure until we reach a point where the bad guys start thinking that becoming a spammer is not worth the risk. If I were to rank Grum's takedown difficulty level from one to five where five is the most difficult, I would give Grum a two.

"When the appropriate channels are used, even ISPs within Russia and Ukraine can be pressured to end their cooperation with bot herders. There are no longer any safe havens."

FireEye Grum Takedown Q&A

How significant is the takedown of Grum?

Identifying the control servers quick enough so they can be shutdown is significant as it shows that the right personnel with the right tools can win.

How did FireEye bring down Grum?  (in the simplest terms possible!)

FireEye identifies command and control malware call-backs without prior signatures or URLs, by tracking the servers real time even when they move the teams were able to close in and shut them down.

Will people notice a reduction in the amount of spam they receive?

Absolutely. Time will always tell, but removing the command and control for the third largest botnet that was generating spam can only be a good thing.

What advice would you give people to avoid getting a deluge of spam emails?

Your email address is very personal and should be treated as such.

Do your best to make sure it's not published on a website for all the world to see, protect yourself from malware and don't open or reply to emails that don't make sense – even if they appear to be from people that you know.

Independent Comment
blog comments powered by Disqus
News in pictures
World news in pictures
Life & Style blogs

It’s National Work From Home Day today

Plus live in a folly tower and Towcester growth

Where have property prices been reduced most in the UK?

Plus how much you need to earn to rent in London, and new homes figures

Is Rushcliffe the best place for families to live?

Plus where The Apprentices live, house price growth outside London, and househunter numbers

       
Independent
Travel Shop
South Africa
15 nights from only £1,899pp Find out more
Paris and the Cote d’Azur city break
Seven nights from £579pp Find out more
Seville, Granada and Malaga break
Seven nights from £549pp Find out more

ES Rentals

    iJobs Job Widget
    iJobs Gadgets & Tech

    SAP FI-CA Consultant - up to £58k

    £50000 - £58000 per annum + Benefits and Bonus: Progressive Recruitment: SAP F...

    WPF Developer (C#, VB.Net) - North East - 6 Months

    £240 - £260 per day: Progressive Recruitment: WPF Developer (C#, VB.Net) North...

    UAT

    Negotiable: Progressive Recruitment: Windows 7 upgrade UAT Application Testing...

    Perl Developer - £55k - Havant

    £50000 - £55000 per annum: Progressive Recruitment: An experienced Perl Develo...

    Day In a Page

    The price of pacifism: Refusing to go to war is finally being recognised as a brave act

    The price of pacifism

    From the Second World War refusenik to the 19-year-old Israeli, Holly Williams talks to five people who risked shame and suffering to take a stand as conscientious objector.
    'It was mass hysteria': Jason Isaacs on groupies, theatre bores and snogging James Bond

    Jason Isaacs: Groupies, theatre bores and James Bond

    To millions, Jason Isaacs is one of Harry Potter's arch enemies – but his wife prefers him as a Scottish TV detective.
    Notes from a small island: Is Sealand an independent 'micronation' or an illegal fortress?

    Sealand: 'Micronation' or illegal fortress?

    Thomas Hodgkinson spent a week at the tiny platform off the Suffolk coast to find out.
    Not a bad bone: Mark Hix cooks with cutlets and ribs

    Mark Hix cooks with cutlets and ribs

    If you ignore cutlets and ribs, you'll risk missing out on some delicious and easy meals, says our chef.
    The experts' guide to summer: From getting fit for the beach to recreating that Olympic buzz

    The experts' guide to summer

    From getting fit for the beach to recreating that Olympic buzz
    Sex, drugs and fast cars: The legend of James Hunt has set Hollywood hearts racing

    Legend of James Hunt has set Hollywood hearts racing

    Early glimpses of Ron Howard's film Rush suggest it will portray Hunt as a high-living lothario, with an insatiable appetite for partying.
    Macklemore: 'I don't have moderation when using drugs and alcohol. It was hurting my life'

    Macklemore: 'I don't have moderation'

    The next Vanilla Ice or the next Eminem? Macklemore doesn't have a record contract – but he does have the UK's biggest-selling single of the year.
    Don't be shy: Bill Granger's Sri Lankan recipes

    Don't be shy: Bill Granger's Sri Lankan recipes

    Sri Lankan cuisine is light, sunny, wonderfully spiced – and so easy to cook from scratch. Just as soon as you've broken into the coconut, that is.
    Sir James Dyson’s latest project: Cleaning up hospitals

    Sir James Dyson’s latest project: Cleaning up hospitals

    Doctors are hailing the revamp of a Bath neonatal unit, where babies sleep more and feed better, as the model for patient care
    One man returns to Argentina's town that drowned

    One man returns to Argentina's town that drowned

    Epecuen was submerged under 10 metres of water in 1985. Now the floods have gone – and 83-year-old Pablo Novak has moved back in
    The real thing? Historian publishes Coca Cola's 'secret formula'

    The real thing?

    Historian publishes Coca Cola's 'secret formula'
    Gordon Ramsey's worst nightmare: A restaurant he cannot save

    Gordon Ramsay's worst nightmare: A restaurant he cannot save

    The pugnacious chef finally met a shambolic restaurant he couldn't save. John Walsh on when TV makover refuseniks fight back
    Join Ryanair! See the world! But we're only paying you for nine months a year

    Join Ryanair! See the world! But we're only paying you for nine months a year

    Glamorous myth of the flight attendant lifestyle undermined by angry employee's claims of 'exploitation'
    Braising saddles: Did the recent furore scupper sales of horse meat? Neigh, far from it!

    Braising saddles: How to cook horse meat

    Did the recent furore scupper sales of horse meat? Neigh, far from it! Will Coldwell hoofs it to the kitchen.
    Why bitters are back on the bar: A few little drops pack a big punch in cocktails

    Why bitters are back on the bar

    A few little drops pack a big punch in cocktails. No wonder we're learning to love them again...