SC World Congress: Anatomy of a spam business

Share this article:
In less than nine months in 2007 a botnet-driven spammer network earned $7.5 million for its operators. The team consisted primarily of New Zealand brothers Shane and Lance Atkinson, who are now in federal court after being sued by the Federal Trade Commission (FTC) for deceptive and fraudulent practices.

At a presentation Wednesday at the SC World Congress in New York, called “Web security and malware: Threats, causes and solutions,” Patrick Peterson, vice president of technology at Cisco's IronPort Systems, and Steve Wernikoff, staff attorney with the FTC in Chicago, outlined a study on how botnet affiliates work.

Typically, an operation works like this: A marketer builds up a group of affiliates that run spam botnets, the panelists said. The incentive is money – say 40 percent of all orders placed by spam victims. Often, the marketers grow their affiliate team by placing an ad on a site frequented by potential affiliates that are looking for products with which to scam potential victims. Some of the ads placed by the marketers essentially state that “You send the spam, we'll take care of everything else – billing, fulfillment, credit card charges, back-end communications, etc.”

Wernikoff said the attraction of the business includes the near-zero cost of entering and maintaining the business.

Added Peterson: “The market is global, with very little oversight by local legal systems.”

The exploitable weaknesses that fuel the spammers' success are familiar: social engineering tactics to install botnet malware, vulnerable web browsers, and web-server vulnerabilities that are compromised by cross-site scripting, and increasingly, FTP-password stealing through keyloggers.

But there are law enforcement and regulatory success stories.

In the Atkinson case, the FTC got an injunction against the brothers to freeze their assets, the FBI executed a number of search warrants, and the action prompted some foreign governments to launch investigations into their activities, the panelists said.




Share this article:

Sign up to our newsletters

More in News

In Cisco probe, misuse or compromise spotted on all firms' networks

In Cisco probe, misuse or compromise spotted on ...

Cisco analyzed the business networks of 30 multinational companies last year, and revealed the findings in its 2014 Annual Security Report.

Fareit trojan observed spreading Necurs, Zbot and CryptoLocker

The Necurs and Zbot trojans, as well as CryptoLocker ransomware, has been observed by researchers as being spread through another trojan, known as Fareit.

Post Heartbleed, tech giants join initiative to bolster open source

Post Heartbleed, tech giants join initiative to bolster ...

The newly formed Core Infrastructure Initiative, created to boost under-funded open source projects, will tackle OpenSSL first.