November 12th, 2008
Spam rates massively down on shutdown of rogue ISP
Several major news outlets are reporting that the shutdown of a rogue ISP in the Bay Area has lead to a massive drop in the global amount of spam. While this is “good thing”, this event is not an end of spam, nor is it even the beginning of the end of spam; it is merely a temporary lull.
Thanks in no small part to evidence gathered by Brian Krebs, The San Jose based McColo was dropped from the Internet yesterday resulting in a massive decline in spam rates around the globe. The common consensus right now is that the takedown resulted in a 35% to 50% drop in inbound spam sending attempts.
The shutdown has removed pieces of infrastructure critical for the operation of several spammers, but this does not mean they cannot adapt. We have seen that command and control servers can be eliminated by using distributed control algorithms, and storefronts can be hidden across compromised websites. The spammers may even regroup by recreating the services provided by McColo somewhere in Eastern Europe.
While many people would like to declare this event as the first step in the end to spam, I can pretty much guarantee you that it isn’t. Over the next few weeks, spammers will further decentralize their operation, turn the botnets back on, and restart their barrage.
Adam J. O'Donnell, Ph.D. is an R&D engineer who has focused on computer security since 2000. He currently is the Director of Emerging Technologies at Cloudmark, a messaging security company located in San Francisco. See his full profile and disclosure of his industry affiliations.
Subscribe to Zero Day via Email alerts or RSS.
