.

Botnets and Spam

<<

Data_Raid

User avatar

Full Member
Full Member

Posts: 165

Joined: Fri Nov 09, 2007 5:55 am

Post Thu Oct 01, 2009 5:11 am

Botnets and Spam

After reading an article on Botnets (Botnets now account for 87.9 per cent of all spam sent as new senders are detected.) it got me thinking ... just how do Botnets really send spam. Do bots make use of open email relays like spammers used to do or do bots use another method to send spam to their victims? I've searched and can't find any details on how botnets send spam.

TIA
All men by nature desire knowledge.

Aristotle
<<

KrisTeason

User avatar

Hero Member
Hero Member

Posts: 515

Joined: Sat Sep 08, 2007 7:48 pm

Location: /dev/null

Post Thu Oct 01, 2009 7:46 pm

Re: Botnets and Spam

For more information, you may want to watch some of these videos :

Botnets Part 1:
http://www.youtube.com/watch?v=pAiWnKRiotI

Botnets Part 2:
http://www.youtube.com/watch?v=cDjsm-dTFyA&feature=related

How to Steal a Botnet and What Can Happen When You Do
http://www.youtube.com/watch?v=2GdqoQJa6r4

It's useful stuff. If that doesnt answer your question you could always take to google!
Last edited by KrisTeason on Thu Oct 01, 2009 7:49 pm, edited 1 time in total.
eCPPT (Silver/Gold), eWPT, GSEC, GISP, GCIH, OSCP, OSWP
<<

Data_Raid

User avatar

Full Member
Full Member

Posts: 165

Joined: Fri Nov 09, 2007 5:55 am

Post Fri Oct 02, 2009 9:27 am

Re: Botnets and Spam

xXxKrisxXx wrote:For more information, you may want to watch some of these videos :

Botnets Part 1:
http://www.youtube.com/watch?v=pAiWnKRiotI

Botnets Part 2:
http://www.youtube.com/watch?v=cDjsm-dTFyA&feature=related

How to Steal a Botnet and What Can Happen When You Do
http://www.youtube.com/watch?v=2GdqoQJa6r4

It's useful stuff. If that doesnt answer your question you could always take to google!


xXxKrisxXx,

I watched those vids on YouTube yesterday as well as the others from SecuManiaOrg regarding botnets and they are pretty good. But they don't explain exactly how spam is sent via a botnet. Google hasn't provided details either. I'm wondering if the command to bots to send spam have an open email relay address in the command instructions or some other method. But then I thought that you'd hope that open mail relays are blocked, or blacklisted etc..
All men by nature desire knowledge.

Aristotle
<<

Ketchup

User avatar

Hero Member
Hero Member

Posts: 1021

Joined: Fri Jul 04, 2008 7:44 pm

Location: Philadelphia, PA

Post Fri Oct 02, 2009 9:42 am

Re: Botnets and Spam

I haven't studied botnets much.  If I was doing it, I would put a small SMTP program on my zombies and write a master control program that would read a list of address and distribute the load across the the zombies.  Unless I am missing something, this seems like a fairly easy piece of code to write.

It would be difficult to blacklist all of my zombies since they would be using the IPs given to them by their ISPs.  I would have issues with Reverse DNS look ups though. 
~~~~~~~~~~~~~~
Ketchup
<<

rattis

User avatar

Hero Member
Hero Member

Posts: 1172

Joined: Mon Jul 27, 2009 1:25 pm

Post Fri Oct 02, 2009 10:58 am

Re: Botnets and Spam

Ketchup wrote:If I was doing it, I would put a small SMTP program on my zombies and write a master control program that would read a list of address and distribute the load across the the zombies.   Unless I am missing something, this seems like a fairly easy piece of code to write.



Thing you're missing there, some providers are blocking port 25 access to their customers. Mine does. When I was using my home connection to test my work sever for an open relay (we were on an RBL), I couldn't connect to port 25 on the mail server for work.

From what I was told by my provider, AT&T, it's becoming more of a standard practice to block the SMTP traffic for the users. I was able to get mine unblocked because I have a static ip address for home. Otherwise they wouldn't unblock it. It would also make having a bot net with and SMTP server on the zombie a little more ineffective.
Last edited by rattis on Fri Oct 02, 2009 11:03 am, edited 1 time in total.
OSWP, Sec+
<<

Ketchup

User avatar

Hero Member
Hero Member

Posts: 1021

Joined: Fri Jul 04, 2008 7:44 pm

Location: Philadelphia, PA

Post Fri Oct 02, 2009 11:36 am

Re: Botnets and Spam

Chris, I don't see how an ISP can block outbound communication from a host going out to port 25.  That would make sending email difficult.  Yes, an ISP can force users to go to a non-standard or SSL wrapped port, but most email services don't do that.  If my ISP were to block me, they wouldn't get a very friendly customer support phone call.

Besides, I doubt that bot networks have to have 100% zombie host reliability.  I can easily incorporate a test that would mark the zombie as able to connect outbound on port 25, or not.  If I had a bot network of 1000 hosts and 200 of them could connect outbound on port 25, I can still do quite a bit of spamming.
~~~~~~~~~~~~~~
Ketchup
<<

rattis

User avatar

Hero Member
Hero Member

Posts: 1172

Joined: Mon Jul 27, 2009 1:25 pm

Post Fri Oct 02, 2009 2:17 pm

Re: Botnets and Spam

Ketchup,
the way it was explained to me, was users that required dhcp (Home Users for the most part since their business clients got statics) have port 25 blocked where it goes out of the uverse network. They also push the web based email model. They did say that their reason to do it was to cut down on bots on their network.

When I called, it wasn't a very friendly customer service call (since I'm paying extra for a static ip address).

I don't know what other ISPs are doing this, but AT&T said they were not the only one.

While 800 spam bots would still send out a lot of data, it's effectively killed 200, and if the practice spreads, it could kill more.
OSWP, Sec+
<<

impelse

Hero Member
Hero Member

Posts: 585

Joined: Mon Feb 16, 2009 3:40 pm

Post Fri Oct 02, 2009 10:10 pm

Re: Botnets and Spam

Yes, I have some users that can not use port 25 for email using Outlook. (If I am not wrong is in this case Comcast).
CCNA, Security+, 70-290, 70-291
CCNA Security
Taking Hackingdojo training

Website: http://blog.thehost1.com/
<<

Data_Raid

User avatar

Full Member
Full Member

Posts: 165

Joined: Fri Nov 09, 2007 5:55 am

Post Sat Oct 03, 2009 1:37 pm

Re: Botnets and Spam

Found some info that explains more detail about bots sending spam:

Bot herders love to use the SOCKS proxy to spam. A bot master simply enables the SOCKS proxy on one of his bots, then redirects his SOCKS-compatible, mass emailing program to the IP address of that bot. This causes the email program to send email using that bot as a relay. If an anti-spam program blacklists the bot's IP address, the herder activates the SOCKS proxy on another bot, and his spam seems to originate from a new, clean IP address.

Furthermore, the bot herder can use a SOCKS proxy to anonymize just about any network traffic. And in Rxbot, for instance, activating the SOCKS proxy is simple: one six-letter command initiates all those anonymizing benefits.

Source: http://www.doraz.net/uni/sicurezza/2_In ... ttacks.htm
All men by nature desire knowledge.

Aristotle

Return to Malware

Who is online

Users browsing this forum: No registered users and 0 guests

.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software