2

I can't seem to find the answer to this question. I read that botnet bots are used as email relays (they have smtp servers installed).

Wikipedia on Open mail relay:

"(...)Internet initiatives to close open relays have ultimately missed their intended purpose because spammers have created distributed botnets of zombie computers that contain malware with mail relaying capability. The number of clients under spammers' control is now so great that previous anti-spam countermeasures that focused on closing open relays are no longer effective."

I also read that botnets are used to cover tracks and bypass black-lists of spam.This brings me many questions:

  1. Do botnets have email domains compromised?
  2. How do botnets deliver email with fake source addresses?(without email trusted email servers compromissed)
  3. Nowadays, it is hard to spam known email companies (like gmail) because they do not accept telnet connections and fake source addresses. It requires authentication. How do botnets and spammers deal with this?
  4. If bots are relays, don't that mean that they can only deliver spam to other bots. Does this make any sense? This won't even affect users.
  5. How can botnets bypass domain blacklisting if they need known accounts and therefore domains to send on source addresses?

I also read a pdf from this link: https://www.damballa.com/downloads/r_pubs/WP_Botnet_Communications_Primer.pdf

It states this about domain flux:

Domain Wildcarding abuses native DNS functionality to wildcard (e.g., *) a higher domain such that all FQDN’s point to the same IP address. For example, *.damballa.com could encapsulate both mypc.atl.damballa.com and myserver.damballa.com. This technique is most commonly associated with botnets that deliver spam and phishing content – whereby the wildcarded information that appears random (e.g. “asdkjlkwer” of asdkjlkwer.atl.damballa) is used by the botnet operator to uniquely identify a victim, track success using various delivery techniques, and bypass anti-spam technologies.

Can anyone explain me the bold sentences? Who is the victim? The compromised machine or the spam target? Ho does domain wildcarding help on spam and phishing?

closed as too broad by AJ Henderson, Xander, Steve, Iszi, Adi Jul 8 '14 at 14:58

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

9

First, some background information about how email works. The basic issue is that server-to-server contacts using SMTP are unauthenticated: all a server knows about the computer contacting it is

  1. The IP address
  2. Who the computer wants to send the email to
  3. Who the computer claims they are
  4. Who the computer claims the email is from

Note that the last two items are not authenticated: the sending computer can lie freely about them.

Ordinary email works as follows (simplified somewhat):

  1. Email client makes a connection to the sending server using authenticated SMTP or IMAP.
  2. Sending server makes an unauthenticated SMTP connection to the receiving server and hands off the email.
  3. Recipient makes an authenticated POP3 or IMAP connection to the receiving server and requests the email.

A spammer's botnet instead does the following:

  1. Spammer contacts botnet, tells it to send spam
  2. Botnet computer acts as SMTP server, makes unauthenticated SMTP connection to receiving server and hands off the email.
  3. Recipient makes an authenticated POP3 or IMAP connection to the receiving server and requests the email.

To answer your questions:

  1. Generally, no.

  2. By lying. The "from" address on an email is trivial to forge (as easy as forging it on a piece of physical mail). There are various techniques to combat this: DomainKeys Identified Mail and Sender Policy Framework are ways to limit which IP addresses are permitted to send email for a given domain name; an older technique was a simple reverse address lookup to see if the IP address resolved to the domain, but this has reliability issues.

  3. By being careful about their lies. If a spammer is careful about who they claim the email is from (eg. using a "from" domain that doesn't provide DKIM or SPF information), they can lie without being caught.

  4. An SMTP server can accept email for local delivery, or for sending on to another server. An SMTP server that doesn't require authentication when accepting email to send onwards is an open relay. By this definition, bots aren't open relays -- they act more like traditional email servers, with the spammer as the only authorized user.

  5. It's unclear what you're asking here. Botnets mostly don't need known accounts to send spam.

  6. This is irrelevant to spamming. It's a technique for hiding botnet infrastructure that lets multiple domain names resolve to a single IP address.

  • Thanks you for your help but here you are assuming that the servers receiving spam are open relays without authentication.In 5 i talked about accounts because if you don't have a gmail account, you cannot connect to gmail server and deliver spam.So a question remains: in a scenario where there are no open relays whatsoever the only way for a spammer to deliver spam is by getting a fake account on a email provider right? – BrunoMCBraga Jul 7 '14 at 12:13
  • Your basic premise is wrong: any SMTP server will accept email for local delivery without authentication. If it worked any other way, a person without a gmail account would be unable to send email to a gmail user. – Mark Jul 7 '14 at 19:14
  • Can you tell me how to deliver an email to a local gmail account trough an ssh connection? – BrunoMCBraga Jul 7 '14 at 19:37
  • No, because SSH is the wrong tool for the job. I can show you how to do it by speaking SMTP using telnet (replace xxxxxxxxxxxxx with the domain you want to send from, and yyyyyyyyyyyy with the Gmail user you want to send to): pastebin.com/LgJ6a2jv – Mark Jul 7 '14 at 19:47
  • It does not work. That is what i am trying to say. Gmail demands ssh. Telnet does not work anymore – BrunoMCBraga Jul 7 '14 at 19:52

Not the answer you're looking for? Browse other questions tagged or ask your own question.