0

I have just been reading an report that analyzed the Mega-D Botnet, but what I haven't fully understood is how they are used to send spam?

What email address is the mail sent from? Does each bot send the spam through an SMTP server? Does each bot have an SMTP server installed on it?

Can any one clear this up for me as no article that I have read seemed to shed any light on this.

|improve this question|||||
1

From what I could find out about it in a few minutes of googling, Mega-D/Ozdok is a pretty typical smabot: It implements the STMP protocol internally and do handles retries to work around greylisting.

The email address used in the "from" part of the mail depends on the exact template that was sent to the bot. If you look at the fortigate description of the bot, you'll see what options could be used to built it and some samples. It doesn't seem to be using anything from the bot client's machine but it seems to often use the recipient's email in the from field (which means you can protect against these spam using SPF or DKIM).

The bots WILL send their mail through a SMTP server but that will be the recipient's SMTP server: what is referenced in the MX DNS record of their mail domain (or the A record if there is no MX but there is an A).

If you want an analogy to the real world, it's as if, instead of sending (regular) mail to your home through the postal system the spammer hired a lot of strangers to deliver it directly into your home's mail box.

As for whether each spambot has a SMTP server installed, the closer to an answer is: no, there is no SMTP server installed on the client that will accept and relay mail. However, it will accept spam templates from the CC servers as well as "job lists" containing the target email address and then act as a SMTP client to send these mails directly to the recipient's SMTP server.

|improve this answer|||||
  • So each bot includes code that would set up an SMTP server on each computer to send out spam? – user12054 Oct 2 '13 at 12:48
  • No. SMTP is the name of the protocol and "server" means it will accept connections from client using that protocol. In that sens,e the bots do not do that. They act as SMTP clients (they connects to servers using SMTP) and uses a different protocol to receive their instructions (proprietary to the bot). – Stephane Oct 2 '13 at 12:52
  • What SMTP servers do they connect to? If they are connecting to the Gmail SMTP server then they obviously have to have accounts for those to be able to send out messages – user12054 Oct 2 '13 at 12:58
  • Read my explanation again and check the links I included: it uses MX DNS record of the target mail domain to find what SMTP server to connect to. It's the recipient's email address, not any relay. – Stephane Oct 2 '13 at 13:33
-2

Personal email addresses, and things like it, are not involved. All you need to send email is a cooperative server to act as your forwarding agent.

Some botnets use compromised machines to sent spam through their primary ISP, and most ISPs are not alarmed when one of their regular customers start sending zillions of emails. Originating email this way doesn't require any authentication beyond the fact that a machine is connected to the ISP's network. The contents are not their concern, as long as the customer keeps paying his bills.

Others rent servers (very cheap to do so) and use them to send spam wholesale. Once again, not a concern for the folks who supplied the server, as long as the customer's check's don't bounce.

Even if the ISPs want to be good citizens (and are willing to deprive themselves of revenue) it's strictly a game of whack-a-mole. Fundamentally, email protocols were designed when the internet have 5 nodes, and all of them were friendly.

|improve this answer|||||
  • This is incorrect. Very few (if any) spambot will use a relay server to send their spam. That's the reason why spammers use botnets to send their mails: because otherwise it is pretty easy to shut them down through IP blocking and blacklists. Using the user's ISP server isn't good either since, contrary to what you say, most ISP to monitor the amount of message you sent through them and do care about their SMTP server's reputation. – Stephane Oct 2 '13 at 7:52
  • I do not mean a relay server - they are essentially extinct as you say. I mean renting a server and using it to pump out spam directly. – ddyer Oct 2 '13 at 23:43
  • They are still not doing this. They do rent servers from "friendly" providers but that's mostly for C&C servers. – Stephane Oct 3 '13 at 7:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy