The Rise of the Selfish Bot: How Spam and Target Attacks are Becoming the New Attack Vehicle

No ratings

Presented at AUScert 2007 by

Mark Sunner

The 'selfish bot' is the next stage in the evolution of spam. Towards the end of 2006 spam, virus and botnet activity seemed to reach a plateau. Botnet sizes had been shrinking over the past year, and gradually becoming more agile as the criminals worked on staying below the radar. Similarly, attacks have become more targeted, profiling the victims into well organised cross-sections of society, based on their online habits, banking facilities and other demographics. During this time, the attack profile seemed to be fairly well understood and countermeasures were continually being deployed and upgraded to counter them. However, from August through to October 2006 everything changed. August saw the introduction of the dropper trojan called "Warezov," only to increase in intensity by October. The latest strain of the "SpamTru" trojan also started to take hold. Because of the way both of these work, suddenly large botnets were back on the scene with increased levels of sophistication that would make them a serious challenge to the viability of email in the future. SpamThru is the Cookoo's Egg of the botnet world. MessageLabs has dissected these new trojans and has examined how they resulted in a 70% rise in spam volumes in one month alone. MessageLabs understands the underlying factors behind these next generation botnets and asks, "is this only the thin end of the wedge?"