Spam more profitable than extortion?
Spam sent directly from botnets is rising and the use of botnets to perform denial of service extortion is declining, according to a blog article posted last week by Symantec.
According to Symantec there was “a pretty sharp decline in the daily number of denial of service attacks” during the second half last year, possibly because DoS attacks are too noisy… using a botnet to flood a web site offline results in traffic that gets noticed, possibly resulting in the compromised machines getting cleaned. If investigators trace the bots back to the command and control machines, the entire botnet can be lost or, worst case, the bot herder may even wind up in jail.
Denial of service has been difficult to defend against. Anyone in control of a few thousand bots can sustain a denial of service attack long enough to destroy most small web-based businesses. Many companies threatened with an attack just pay the criminals to go away rather than risk being forced offline.
Most extortion targets have been online gambling and porn sites, which law enforcement may not be eager to help (the classic story is the excellent 2003 article published in CSOnline “How a bookmaker and a whiz kid took on an extortionist – and won“). More “legitimate” businesses are targets too… Internet Provider “Cloud Nine” closed permanently after sustained DoS attacks in 2002 and countless other businesses have been extorted and not reported it to authorities.
Using bots to send spam is less likely to be noticed by the computer owner or ISP and, unlike denial of service attacks, spam is rarely reported back to the originating ISP. Since it looks like no amount of end-user education will ever stop people buying the crap advertised via spam or stop businesses from hiring spammers to flood inboxes, I guess it makes sense that spamming is a less risky way for criminals profit from the 150 million compromised machines under their control.
Interesting that right now several government web sites in Estonia are being DDoS’d, apparently due to a political dispute.
Related posts: