Spam volume expected to increase with Botnet coming back to life news
27 November 2008

The volume of spam email over the internet is expected to rise manifold in the coming days as one of the world's largest networks of compromised computers comes back online after being shut down only days ago.

The network, called the `Srizbi' botnet, which is basically a collection of over half a million `zombie' or hacked personal computers used as drones to relay 40 per cent of global spam had been shut off two weeks ago as a result of pressure from the computer security community.

Servers that controlled the Srizbi botnet were disconnected from the world wide web on 11 November after a web hosting firm identified by security experts as a major host for organizations engaged in spamming was shut down by internet service providers (ISPs).

It is now being realised that Srizbi's authors had anticipated the scenario, and had, therefore, built in to each bot a fail-safe mechanism that would kick in if the master control servers were unavailable.

The mechanism is said to be something of a mathematical algorithm that generates a random or unique website domain name, and checks for new instructions and software updates. This allows malware authors to resurrect their bots by merely registering a website or domain name which the bots try an visit, and placing their code there.

Computer security firm FireEye, which is based out of Milpitas, California is reported to have tracked the botnet's activity to a number of these ''rescue domains'' registered a few days ago.

Reports said that at least 50,000 of Srizbi-infected machines were redirected to these new domains to receive fresh instructions and updates of malware from servers that were located in Estonia.

Accordingly, it is now a matter of time for spam levels to grow back to levels that were seen prior to the 11 November shutdown of Srizbi.


 search domain-b
  go
 
Spam volume expected to increase with Botnet coming back to life