Study: Uptick in spam-sending zombie PCs in September

Compromised computers that send spam as part of their regular botnet activity increased dramatically in September, according to a Symantec study (PDF) released Monday.

The Symantec report follows a study from MessageLabs also illustrating the increased use of automated spam relays.

After seeing a 37 percent drop in botnet-related spam for August, Symantec reported a 101 percent increase in September. The growth appears to be focused in Europe, the Middle East, and Asia, with South Korea experiencing the largest increase at 4,236 percent. It was followed by Kazakhstan (761 percent), Romania (607 percent), Saudi Arabia (555 percent), and Vietnam (540 percent).

Compromised PCs sending spam had been part of the background noise until recently, when their usage surged in September.

(Credit: Symantec)

In looking for a reason behind the one-month increase, Symantec speculated it had something to do with the increase in e-mail with sensationalistic news headlines that included links to downloadable malware. These include malicious spam campaigns emulating e-mail from CNN and MSNBC.

Turkey topped the list of countries hosting spam-sending compromised PCs, responsible for 12 percent of such traffic, according to Symantec. It was followed by Brazil (9 percent), Russia (8 percent), the U.S. (6 percent), India (6 percent), China (6 percent), Germany (5 percent), Argentina (4 percent), Poland (4 percent), and Thailand (3 percent).

[Lerianis]

I swear.... why are people still getting infected by these things? People, here is what you do: Use your e-mail providers online thing. It is almost IMPOSSIBLE to get owned by these things when using the online e-mail reader like Comcast provides.

[SlurmSlurper]

The main SMTP port is TCP port 25, which should be used for mail server to mail server communication only. Clients connect via POP3 (TCP port 125) or IMAP4 (TCP port 143). Credentials do not need to be provided for port 25 so this is often used for for spamming.

Seeing as most residential users do not run their own mail server, why not block it by default and unblock it on request?

This would drastically cut the number of machines that can be turned into zombies. Some ISPs do this but many don't.