Botnets winning spam wars

The world's anti-spam systems are fighting a furious but hopeless battle against botnet spam, a new threat analysis from Commtouch has claimed.

According to the U.S. company's zombie monitor, by the time that reputation and source analysis systems have identified compromised PCs and servers responsible for sending the spam that floods the Internet every day, most botnets will have shifted to using new machines.

Given that the company reports there being an average of 10 million botnet 'zombies' active on any one day in the second quarter of 2008, the only way to of stem the spam tide is to filter it out in a reactive way using costly technologies at the ISP or gateway level.

ISPs, meanwhile, are struggling to deal with the silent flow of outbound spam from their subscribers, leaving some at risk of having their IP address ranges blacklisted by other providers. This appears to be more of a problem for ISPs in developing countries, though two ISPs, telecomitalia.it, and Verizon, were identified by Commtouch as having, respectively, over 1.2 million, and 500,000 active zombies on their networks over a 30-day period.

"Many technologies attempt to identify and block email from senders known for sending malicious content, but they are not updated rapidly enough to keep up," said Commtouch's Amir Lev. "By the time these lists are updated the threat has shifted to another set of zombies, leaving customers unprotected."

Commtouch's own anti-bot system claims to be able to react to the ever-changing address ranges by detecting them as they occur using proprietary profiles.

If the volume of spam being sent by compromised hosts shows no sign of slowing, botnets have continued to evolve in other ways. In the last month, Turkey has claimed the number one spot for having the most zombies between April and June of this year, followed by Brazil, Russia, Italy, and India.

The U.S. is some way down the field in ninth place, a reflection of the fact that users there now have better protection against malware, with the U.K. for once not registering a separate entry in the top 20.

Commtouch's statistics also attest to the remarkable staying power of Pharmaceutical and Viagra spam, which, years after it first appeared as an inbox staple, still accounts for 40 percent of all such messages sent.

Techworld is an InfoWorld affiliate.