Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I have just been reading an report that analyzed the Mega-D Botnet, but what I haven't fully understood is how they are used to send spam?
What email address is the mail sent from? Does each bot send the spam through an SMTP server? Does each bot have an SMTP server installed on it?
Can any one clear this up for me as no article that I have read seemed to shed any light on this.
From what I could find out about it in a few minutes of googling, Mega-D/Ozdok is a pretty typical smabot: It implements the STMP protocol internally and do handles retries to work around greylisting.
The email address used in the "from" part of the mail depends on the exact template that was sent to the bot. If you look at the fortigate description of the bot, you'll see what options could be used to built it and some samples. It doesn't seem to be using anything from the bot client's machine but it seems to often use the recipient's email in the from field (which means you can protect against these spam using SPF or DKIM).
The bots WILL send their mail through a SMTP server but that will be the recipient's SMTP server: what is referenced in the MX DNS record of their mail domain (or the A record if there is no MX but there is an A).
If you want an analogy to the real world, it's as if, instead of sending (regular) mail to your home through the postal system the spammer hired a lot of strangers to deliver it directly into your home's mail box.
As for whether each spambot has a SMTP server installed, the closer to an answer is: no, there is no SMTP server installed on the client that will accept and relay mail. However, it will accept spam templates from the CC servers as well as "job lists" containing the target email address and then act as a SMTP client to send these mails directly to the recipient's SMTP server.
Personal email addresses, and things like it, are not involved. All you need to send email is a cooperative server to act as your forwarding agent.
Some botnets use compromised machines to sent spam through their primary ISP, and most ISPs are not alarmed when one of their regular customers start sending zillions of emails. Originating email this way doesn't require any authentication beyond the fact that a machine is connected to the ISP's network. The contents are not their concern, as long as the customer keeps paying his bills.
Others rent servers (very cheap to do so) and use them to send spam wholesale. Once again, not a concern for the folks who supplied the server, as long as the customer's check's don't bounce.
Even if the ISPs want to be good citizens (and are willing to deprive themselves of revenue) it's strictly a game of whack-a-mole. Fundamentally, email protocols were designed when the internet have 5 nodes, and all of them were friendly.
