McColo shutdown won't stop spam, malware

By Dennis Fisher, Executive Editor | Nov 14, 2008

0 comments

Facebook

LinkedIn

Digg

For years, security experts, antispam activists and law enforcement agencies have known where to find the Internet's worst spammers and malware distributors, but there was little they could do with that knowledge. The patchwork of international laws governing computer crime, along with the reluctance of some Internet service providers to pull the plug on customers accused of wrongdoing, have contributed in keeping many of these illegitimate businesses operating.

But now the tide is beginning to turn. First came the news that ICANN had decided to de-accredit EstDomains, an ISP notorious in the security community for serving as a haven for malware authors and spammers. Then earlier this week, the upstream providers for McColo Corp. killed their connections to the hosting provider, which has been known in security circles as another home base for malware and spammers, as well as alleged child pornographers. This effectively cut McColo off from the Internet, resulting in a significant drop in global spam levels. Symantec Corp. said on Thursday that it had seen spam levels decline 65% since Tuesday, and other messaging security providers reported similar drop-offs.

These are rare success stories in the fight against spam and malware, but security experts have no illusions that this is the beginning of the end of spam and malware, or that the drop-off will even last more than a few days.

"There are a lot of different issues involved. The folks involved in spam gave up on whack-a-mole model, where as soon as you take an ISP down and malware hosting and command and control along with it, then they move to another network," said Danny McPherson, vice president and chief security officer at Arbor Networks Inc. "Everyone understands where they are for a while and then they move somewhere else. They just take their address space and announce it elsewhere and they're back in business."

SearchSecurity radio:

In fact, McPherson said that some of the people involved with McColo, which is based in San Jose, Calif., are trying to get their address space announced somewhere else on the Internet right now.

"When that happens, they'll be right back at it," he said.

McPherson, who has been studying the spam and botnet problem, along with his colleague at Arbor, Jose Nazario, said that part of the reason there have been a string of wins recently against spammers and botnet operators is the increase in cooperation among security researchers, ISPs and others interested in stopping the problem. There has always been a loose-knit community of activists working to take down phishing sites and spammers whenever possible, but the level of cooperation by ISPs and law enforcement has been spotty, for a variety of reasons.

For ISPs, the problems arise from the contracts they have with their customers. Simply pulling the plug on a suspected spammer or malware-hosting service is not usually an option; the ISPs need solid proof. And gathering that proof takes time and effort, which many service providers don't have the resources to handle.

0 comments

Facebook

LinkedIn

Digg