Deprecated: Function create_function() is deprecated in /home/hidefide/public_html/blog/wp-content/plugins/wr-pagebuilder/core/core.php on line 127
{"id":419,"date":"2012-08-19T15:12:28","date_gmt":"2012-08-19T15:12:28","guid":{"rendered":"https:\/\/icaruspressblog.wordpress.com\/?p=419"},"modified":"2019-04-17T11:47:32","modified_gmt":"2019-04-17T11:47:32","slug":"spamhaus-grum-dead-festi-alive-and-well","status":"publish","type":"post","link":"https:\/\/hidefideas.com\/blog\/2012\/08\/19\/spamhaus-grum-dead-festi-alive-and-well\/","title":{"rendered":"Spamhaus: Grum Dead, Festi Alive and Well"},"content":{"rendered":"

$\"homer\"$ In July, the Grum botnet was shuttered thanks to the hard work of security firm FireEye, along with help from other organizations. The story garnered a lot of attention, and even a little confusion<\/a> over exactly how big Grum was. Most agreed that Grum was responsible for a third of the world\u2019s email spam and that the number was around 17 percent, and the world\u2019s inboxes had a little bit of reprieve for a time.<\/p>\n

Spamhaus<\/a> participated in Grum\u2019s demise by contacting the ISPs that were hosting Grum\u2019s command and control servers. As the C&C servers came down, Grum\u2019s operators attempted to re-establish new ones, but FireEye and Spamhaus were able to take these down too, and Grum was all but expired. This from Spamhaus: \u201cSince the takedowns Spamhaus has continued to monitor the Grum botnet, which at present consists of only 150 to 500 active (spam sending) IP addresses per day. Hence, one month later we can consider the Grum botnet dead.\u201d<\/p>\n

Maybe even more notable than the timely death of Grum, Atif Mushtaq, a senior scientist at FireEye made some bold statements<\/a> about the future of spam, stating that taking down a few more botnets would be \u201cenough for a rapid and permanent decline in worldwide spam level[s].\u201d Nobody can blame Mr. Mushtaq for his enthusiasm and optimism, especially after he just ended a spate of emails pushing fake Viagra; but his statements were also the stuff that eyebrow raising is made of.<\/p>\n

A month later, it seems that his optimism was a tad premature, because Spamhaus has reported that while Grum is dead for good, another misbehaved little child has taken its place in the sandbox. A few weeks before the action on Grum, Spamhaus noticed \u201ca huge increase in spam activities from another spam botnet, called Festi or Spamnost by some Antivirus vendors.\u201d In June, the number of spamming IP addresses identified as Festi was still relatively small, compared to Grum. But that changed quickly, and by the end of June Spamhaus saw a dramatic increase in this new botnet\u2019s activity.<\/p>\n

\u201cSince July,\u201d Spamhaus reports, \u201cthe Spamhaus XBL has seen a huge increase in Festi spamming activities. At the peak, during one 24-hour period the XBL detected nearly 300,000 IP addresses that were infected with Festi, out of a total of 1 million that were infected with some sort of spam-sending bot. The sheer volume of Festi spam overwhelmed spam detection [processes] at some security organizations.\u201d (See the chart above)<\/p>\n

In fact, Festi is now competing with Cutwail, the world\u2019s number one spamming botnet, for supremacy. The numbers recorded by Spamhaus suggest that, as of August 13, Festi has overtaken Cutwail slightly, with both botnets controlling more than a quarter of a million active spamming IP addresses.<\/p>\n

Takeaways<\/strong><\/h2>\n
Hoo-ray. Often, a coup d\u2019\u00e9tat is nothing more than an attempt at taking down a dictator so another can take his place, and the rise of this new botnet seems to illustrate this adage. The hard work of FireEye, Spamhaus and others are laudable and they should be recognized for their tireless efforts. But if we\u2019ve learned anything about cybercrooks, it is that they are tenacious, they don\u2019t like being poked with a sharp stick, and they adapt far quicker than the good guys.<\/p>\n
The dream of a spam-free world is a noble one, and Mr. Atif Mushtaq of FireEye should be applauded for daring to dream. But spam isn\u2019t going anywhere. In fact, it\u2019s spreading, to webmail, social media, mobile phones and tablets, and anywhere else that cybercriminals see an opportunity to make a buck. It\u2019s even found its way to our landlines. Hell, one cannot blink today without facing the threat of financial ruination, data compromise, and all-out embarrassment.<\/p>\n
No, spam\u2019s not going away. It\u2019s here to stay, and as long as people are naive enough to click a link that promises unimaginable wealth and success, it\u2019s something we have to deal with. So where does that leave us?<\/p>\n
Exactly where we started. With vigilance, education, anti-spam technologies and a modicum of common sense. Does it mean that we should stop taking down botnets? Of course not. Look, it\u2019s a bit of a conundrum, but even though we cannot seem to gain an inch, it doesn\u2019t mean we should lie down and take it. So hats off to FireEye, Spamhaus, and all the other vigilant heroes who fight this stuff every day.<\/p>\n
And now, back to getting that pesky spam out of our inboxes.<\/p>\n","protected":false},"excerpt":{"rendered":"
In July, the Grum botnet was shuttered thanks to the hard work of security firm FireEye, along with help from other organizations. The story garnered… <\/p>\n","protected":false},"author":3,"featured_media":169,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[15,16,13,14],"tags":[11,9,10,8,7],"class_list":["post-419","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-bot","category-botnet","category-security","category-spam","tag-allspammedup","tag-bot","tag-botnet","tag-malware","tag-spam","jsn-master"],"_links":{"self":[{"href":"https:\/\/hidefideas.com\/blog\/wp-json\/wp\/v2\/posts\/419","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hidefideas.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hidefideas.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hidefideas.com\/blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/hidefideas.com\/blog\/wp-json\/wp\/v2\/comments?post=419"}],"version-history":[{"count":3,"href":"https:\/\/hidefideas.com\/blog\/wp-json\/wp\/v2\/posts\/419\/revisions"}],"predecessor-version":[{"id":1794,"href":"https:\/\/hidefideas.com\/blog\/wp-json\/wp\/v2\/posts\/419\/revisions\/1794"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/hidefideas.com\/blog\/wp-json\/wp\/v2\/media\/169"}],"wp:attachment":[{"href":"https:\/\/hidefideas.com\/blog\/wp-json\/wp\/v2\/media?parent=419"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hidefideas.com\/blog\/wp-json\/wp\/v2\/categories?post=419"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hidefideas.com\/blog\/wp-json\/wp\/v2\/tags?post=419"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}