• On MovieTome: First Look: Jessica Alba in 'Machete'!
The Download Blog
advertisement
October 6, 2008 2:25 PM PDT

Study: Uptick in spam-sending zombie PCs in September

by Robert Vamosi
  • Font size
  • Print
  • 2 comments

Compromised computers that send spam as part of their regular botnet activity increased dramatically in September, according to a Symantec study (PDF) released Monday.

The Symantec report follows a study from MessageLabs also illustrating the increased use of automated spam relays.

After seeing a 37 percent drop in botnet-related spam for August, Symantec reported a 101 percent increase in September. The growth appears to be focused in Europe, the Middle East, and Asia, with South Korea experiencing the largest increase at 4,236 percent. It was followed by Kazakhstan (761 percent), Romania (607 percent), Saudi Arabia (555 percent), and Vietnam (540 percent).

Compromised PCs sending spam had been part of the background noise until recently, when their usage surged in September.

(Credit: Symantec)

In looking for a reason behind the one-month increase, Symantec speculated it had something to do with the increase in e-mail with sensationalistic news headlines that included links to downloadable malware. These include malicious spam campaigns emulating e-mail from CNN and MSNBC.

Turkey topped the list of countries hosting spam-sending compromised PCs, responsible for 12 percent of such traffic, according to Symantec. It was followed by Brazil (9 percent), Russia (8 percent), the U.S. (6 percent), India (6 percent), China (6 percent), Germany (5 percent), Argentina (4 percent), Poland (4 percent), and Thailand (3 percent).

Originally posted at Security
As CNET's resident security expert, Robert Vamosi has been interviewed on the BBC, CNN, MSNBC, and other outlets to share his knowledge about the latest online threats and to offer advice on personal and corporate security. Listen to his podcast at securitybites.cnet.com or e-mail Robert with your questions and comments.
Recent posts from The Download Blog
Google plans Chrome Mac beta for December
Mozilla releases second Firefox 3.6 beta
Google cuts Picasa photo storage prices
Is Mozilla's contributions program working?
Panda's Cloud Antivirus leaves beta behind
Sneak peek: Xobni e-mail app for BlackBerry
Louvre iPhone app: Quelle horreur!
Apple plugs holes for domain spoofing, other attacks
Add a Comment (Log in or register)
by Lerianis October 7, 2008 6:48 AM PDT
I swear.... why are people still getting infected by these things? People, here is what you do: Use your e-mail providers online thing. It is almost IMPOSSIBLE to get owned by these things when using the online e-mail reader like Comcast provides.
Reply to this comment
by SlurmSlurper October 8, 2008 12:58 AM PDT
The main SMTP port is TCP port 25, which should be used for mail server to mail server communication only. Clients connect via POP3 (TCP port 125) or IMAP4 (TCP port 143). Credentials do not need to be provided for port 25 so this is often used for for spamming.

Seeing as most residential users do not run their own mail server, why not block it by default and unblock it on request?

This would drastically cut the number of machines that can be turned into zombies. Some ISPs do this but many don't.
Reply to this comment

Search Download Blog posts

About The Download Blog

Download.com editors cover the world of downloadable software and beyond.

Add this feed to your online news reader

The Download Blog topics