Re: Countering Botnets to Reduce Spam

On 12-12-14 12:44 PM, Rich Kulawiec wrote:
> On Fri, Dec 14, 2012 at 10:08:48AM -0500, Chris Lewis wrote:
>> Compromised Linux machines (mostly servers) are now responsible for ~40%
>> of all spam.
>>
>> The actual _count_ of compromised Linux machines is indeed quite low.
>> Say 62K out of 8.6M observed compromised machines.  About .72%. Two 9's ;-)
> 
> I believe you.

Would I lie to you Rich? ;-)

Let me remind you of what you said:

>> - Linux systems are not a significant component of botnets.  I've been
>> doing passive OS fingerprinting for most of a decade, and they're in
>> the noise floor.  It's still true now, as it was years ago, that
>> bot-originated spam comes from Windows systems to about six 9's.

You made two assertions there.  I'm more or less agreeing with the
former (linux botnet infections are rare compared to Windows), but
disagreeing with the second - 40% of all spam right now is from that
small number of Linux botnet infections.

> And to clarify further:
> I classify a system as a bot if it meets a set of criteria that includes
> more than sending spam: I may also classify it as a bot if it's doing
> brute-force SSH/FTP/IMAP/etc. attacks, if it's doing port scans, etc.

The term "botnet" is somewhat nebulous.  It's perhaps best that you
consider it to be an infection of some sort that does things via
"network initiated" command&control.

And do remember I was specifically addressing an assertion about _spam_.
 Not other botish things.

The "tame" linux spambot I have periodically fetches commands from
somewhere in the Ukraine, and spams based on those commands.

The traditional darkmailer infection is more of a cgi that's accessible
via the infectee's web server, and is either manually or automatically
controlled.

> Do you think #2 explains the difference in our numbers, or do I have
> to make a LOT of coffee and dig into #1?

We're comparing apples to oranges and apples.  Forget about the oranges
bit ;-)