• On GameSpot: First month of Xbox Live now $1
October 6, 2008 2:25 PM PDT

Study: Uptick in spam-sending zombie PCs in September

by Robert Vamosi

Compromised computers that send spam as part of their regular botnet activity increased dramatically in September, according to a Symantec study (PDF) released Monday.

The Symantec report follows a study from MessageLabs also illustrating the increased use of automated spam relays.

After seeing a 37 percent drop in botnet-related spam for August, Symantec reported a 101 percent increase in September. The growth appears to be focused in Europe, the Middle East, and Asia, with South Korea experiencing the largest increase at 4,236 percent. It was followed by Kazakhstan (761 percent), Romania (607 percent), Saudi Arabia (555 percent), and Vietnam (540 percent).

Compromised PCs sending spam had been part of the background noise until recently, when their usage surged in September.

(Credit: Symantec)

In looking for a reason behind the one-month increase, Symantec speculated it had something to do with the increase in e-mail with sensationalistic news headlines that included links to downloadable malware. These include malicious spam campaigns emulating e-mail from CNN and MSNBC.

Turkey topped the list of countries hosting spam-sending compromised PCs, responsible for 12 percent of such traffic, according to Symantec. It was followed by Brazil (9 percent), Russia (8 percent), the U.S. (6 percent), India (6 percent), China (6 percent), Germany (5 percent), Argentina (4 percent), Poland (4 percent), and Thailand (3 percent).

As CNET's resident security expert, Robert Vamosi has been interviewed on the BBC, CNN, MSNBC, and other outlets to share his knowledge about the latest online threats and to offer advice on personal and corporate security. Listen to his podcast at securitybites.cnet.com or e-mail Robert with your questions and comments.
advertisement
Click here!
Recent posts from Security
Symantec's Ramzan on solving the antivirus puzzle
Apple fixing iPhone SMS security hole
Waledac worm targeting July 4 spam offensive
ATM vendor gets security talk pulled from conferences
Postini: Google's take on e-mail security
Botnets lead the way for spam
Stallman warns of Mono 'risk'
China delays rule for Net-screening software
Add a Comment (Log in or register)
by Lerianis October 7, 2008 6:48 AM PDT
I swear.... why are people still getting infected by these things? People, here is what you do: Use your e-mail providers online thing. It is almost IMPOSSIBLE to get owned by these things when using the online e-mail reader like Comcast provides.
Reply to this comment
by SlurmSlurper October 8, 2008 12:58 AM PDT
The main SMTP port is TCP port 25, which should be used for mail server to mail server communication only. Clients connect via POP3 (TCP port 125) or IMAP4 (TCP port 143). Credentials do not need to be provided for port 25 so this is often used for for spamming.

Seeing as most residential users do not run their own mail server, why not block it by default and unblock it on request?

This would drastically cut the number of machines that can be turned into zombies. Some ISPs do this but many don't.
Reply to this comment
advertisement

Most Popular

Making sense of Windows 7 upgrades

faq The basics and the fine print on Microsoft's options for those eyeing the next operating system from Redmond.
• Full Windows 7 coverage

Road Trip 2009: Big Sky Country

CNET News reporter Daniel Terdiman takes his car full of gadgets to the Rockies and the Great Plains in search of tech, science, nature, and more.
• America's Fortress: Cheyenne Mountain

About Security

Online security is threatened by more than hacking and phishing attempts. Check here for the latest updates on software vulnerabilities, data leaks, and rapidly spreading viruses--and learn how to protect your systems.

Add this feed to your online news reader

Security topics

advertisement
advertisement

Inside CNET News

Scroll Left Scroll Right