6 Botnets = 85% of Spam

Six botnets churning out 85 percent of all spam - Ars Technica

Been interested in botnets since Storm (and it's sneaky ways) came on the scene. But things have changed a lot since those days...

Quote:

---

Srizbi is not alone in the post-Storm botnet world. Marshal estimates that six botnets account for 85 percent of the total spam sent world-wide. Srizbi is currently in the lead, with 39 percent of the "market," followed by Rustock at 20 percent, Mega-D at 11 percent, Hacktool.Spammer at seven percent, Pushdo (6 percent), and Storm (two percent).

---

Poor Storm :(

WOW. Only 6.

I must still do some research on botnets.

I wonder if the demise of Storm is due to its architecture?

In the old days you would kill a botnet by taking down the command centre(s). I keep reading that the latest ones have some kind of cellular, peer-to-peer, onion ring like structure? This means that there is no central point to attack them at :(

Ever played whack-a-mole?

I recall reading somewhere where someone was comparing taking down parts of botnets to playing whack-a-mole. Take down one control node and another one pops up in its place. From using peer-to-peer networks, to encryption, to DNS control lists; taking down any of these botnets is a long, tedious, non-rewarding experience. Tracking them is much easier. No outside intervention is going to be enough to destroy them. It needs to happen from the inside. Someone needs to gain control with the main credentials--can't do that from the outside.


For those of you who continue to try to take them down from the outside, I have one question.


Wanna play whack-a-mole?

Yes,

It is rather like conventional military operations and insurgency. Conventional military methods have very limited effectiveness against insurgents because they lack a discrete infrastructure to target.

Botnets have gone "distributed processing" as well :D

This refers to e-mail spam bots, but right now 90% of forum spam is being done by one bot. One of Russian origin.