SC World Congress: Anatomy of a spam business

Share this article:
In less than nine months in 2007 a botnet-driven spammer network earned $7.5 million for its operators. The team consisted primarily of New Zealand brothers Shane and Lance Atkinson, who are now in federal court after being sued by the Federal Trade Commission (FTC) for deceptive and fraudulent practices.

At a presentation Wednesday at the SC World Congress in New York, called “Web security and malware: Threats, causes and solutions,” Patrick Peterson, vice president of technology at Cisco's IronPort Systems, and Steve Wernikoff, staff attorney with the FTC in Chicago, outlined a study on how botnet affiliates work.

Typically, an operation works like this: A marketer builds up a group of affiliates that run spam botnets, the panelists said. The incentive is money – say 40 percent of all orders placed by spam victims. Often, the marketers grow their affiliate team by placing an ad on a site frequented by potential affiliates that are looking for products with which to scam potential victims. Some of the ads placed by the marketers essentially state that “You send the spam, we'll take care of everything else – billing, fulfillment, credit card charges, back-end communications, etc.”

Wernikoff said the attraction of the business includes the near-zero cost of entering and maintaining the business.

Added Peterson: “The market is global, with very little oversight by local legal systems.”

The exploitable weaknesses that fuel the spammers' success are familiar: social engineering tactics to install botnet malware, vulnerable web browsers, and web-server vulnerabilities that are compromised by cross-site scripting, and increasingly, FTP-password stealing through keyloggers.

But there are law enforcement and regulatory success stories.

In the Atkinson case, the FTC got an injunction against the brothers to freeze their assets, the FBI executed a number of search warrants, and the action prompted some foreign governments to launch investigations into their activities, the panelists said.

Share this article:

Sign up to our newsletters

More in News

Carbon Grabber crimeware kit being distributed in spam campaign

A spam campaign involving the Carbon Grabber crimeware kit is ongoing against the automotive industry in Europe, according to Symantec.

Errors in ZeroLocker means paying ransom may not decrypt files

A piece of ransomware known as ZeroLocker contains various errors that may prevent files from being decrypted even if the ransom is paid.

Rogue AV scammers find success with new tatics

Although the number of rogue anti-virus malware campaigns have decreased overall, the threat isn't totally gone, according to researchers at Microsoft.