SC World Congress: Anatomy of a spam business
In less than nine months in 2007 a botnet-driven spammer network earned $7.5 million for its operators. The team consisted primarily of New Zealand brothers Shane and Lance Atkinson, who are now in federal court after being sued by the Federal Trade Commission (FTC) for deceptive and fraudulent practices.At a presentation Wednesday at the SC World Congress in New York, called “Web security and malware: Threats, causes and solutions,” Patrick Peterson, vice president of technology at Cisco's IronPort Systems, and Steve Wernikoff, staff attorney with the FTC in Chicago, outlined a study on how botnet affiliates work.
Typically, an operation works like this: A marketer builds up a group of affiliates that run spam botnets, the panelists said. The incentive is money – say 40 percent of all orders placed by spam victims. Often, the marketers grow their affiliate team by placing an ad on a site frequented by potential affiliates that are looking for products with which to scam potential victims. Some of the ads placed by the marketers essentially state that “You send the spam, we'll take care of everything else – billing, fulfillment, credit card charges, back-end communications, etc.”
Wernikoff said the attraction of the business includes the near-zero cost of entering and maintaining the business.
Added Peterson: “The market is global, with very little oversight by local legal systems.”
The exploitable weaknesses that fuel the spammers' success are familiar: social engineering tactics to install botnet malware, vulnerable web browsers, and web-server vulnerabilities that are compromised by cross-site scripting, and increasingly, FTP-password stealing through keyloggers.
But there are law enforcement and regulatory success stories.
In the Atkinson case, the FTC got an injunction against the brothers to freeze their assets, the FBI executed a number of search warrants, and the action prompted some foreign governments to launch investigations into their activities, the panelists said.
