IT security, vunerabilities, bugs, fixes, flaws, RSA conference and Infosec.
A blog from V3.co.uk

« Sun and RIM release critical patches | Main | VeriSign secures Azure »

Researchers take down spam botnet

Researchers from security firm FireEye have been able to effectively take down the prolific Mega-D spamming botnet, causing inboxes everywhere to release a thankful sigh of relief.

The researchers apparently did what they do best, and studied Mega-D and its behaviour. By doing this they were able to to identify its control structure and other features, and the bot herders back where it hurts. Late last week they brushed some dirt off their white coats, starting ringing around ISPs, disabling control servers, de-registering any of the bots' used domains, and registering any unused fallback ones. In short they threw a whopping great spanner directly into Mega-D's works.

According to M86 Security labs Mega-D was responsible for almost a third of all spam last year, while over the weekend it slowed to just a trickle, and yesterday had stopped altogether. Current suggestions are that before it was taken down, Mega-D was pumping out some 15,000 messages per hour, which is a lot of junk emails

The actions also let them get a better understanding of the bots, such as the fact that they used hard-coded DNS servers, domain generation algorithms and fallover domains. Regardless of this, anyone with an inbox should be glad that it is over, at least for now.

November 10, 2009 |

Comments

Post a comment







Site credentials: About | Privacy policy | Terms & conditions | Top of the page
© Incisive Media Investments Limited 2010, Published by Incisive Financial Publishing Limited, Haymarket House, 28-29 Haymarket, London SW1Y 4RX, are companies registered in England and Wales with company registration numbers 04252091 & 04252093