I can't seem to find the answer to this question. I read that botnet bots are used as email relays (they have smtp servers installed).
Wikipedia on Open mail relay:
"(...)Internet initiatives to close open relays have ultimately missed their intended purpose because spammers have created distributed botnets of zombie computers that contain malware with mail relaying capability. The number of clients under spammers' control is now so great that previous anti-spam countermeasures that focused on closing open relays are no longer effective."
I also read that botnets are used to cover tracks and bypass black-lists of spam.This brings me many questions:
- Do botnets have email domains compromised?
- How do botnets deliver email with fake source addresses?(without email trusted email servers compromissed)
- Nowadays, it is hard to spam known email companies (like gmail) because they do not accept telnet connections and fake source addresses. It requires authentication. How do botnets and spammers deal with this?
- If bots are relays, don't that mean that they can only deliver spam to other bots. Does this make any sense? This won't even affect users.
- How can botnets bypass domain blacklisting if they need known accounts and therefore domains to send on source addresses?
I also read a pdf from this link: https://www.damballa.com/downloads/r_pubs/WP_Botnet_Communications_Primer.pdf
It states this about domain flux:
Domain Wildcarding abuses native DNS functionality to wildcard (e.g., *) a higher domain such that all FQDN’s point to the same IP address. For example, *.damballa.com could encapsulate both mypc.atl.damballa.com and myserver.damballa.com. This technique is most commonly associated with botnets that deliver spam and phishing content – whereby the wildcarded information that appears random (e.g. “asdkjlkwer” of asdkjlkwer.atl.damballa) is used by the botnet operator to uniquely identify a victim, track success using various delivery techniques, and bypass anti-spam technologies.
Can anyone explain me the bold sentences? Who is the victim? The compromised machine or the spam target? Ho does domain wildcarding help on spam and phishing?