Credit processors targeted in fight against spam

Follow the money


Computer scientists are advocating the targeting of card-processing middlemen as a way of clamping down on spam.

Improving spam filters and takedown efforts against botnets, the main source of the vast majority of junk mail, have been among the main focus of spam fighters of late. Computer researchers at the University of California, San Diego and University of California, Berkeley are taking a slightly different tack in the fight against junk mail, targeting the small number of firms prepared to handle credit card transactions for spamvertised websites.

The researchers have discovered that the vast majority (95 per cent) of the credit card payments to unlicensed pharmaceutical sites are handled by just three payment processing firms – based in Azerbaijan, Denmark and Nevis, in the West Indies, respectively.

By putting the squeeze on these firms it might be possible to choke the flow of money to spammers, making spam less profitable and, hopefully, less prevalent. Pharmacy spam levels fluctuate but the class of junk mail has long been the biggest single category of spam.

The findings came after three months of analysing spam data, broad crawling of naming and hosting infrastructures, and over 100 purchases from spam-advertised sites. The study discovered that payment-processing for replica and software products advertised through spam was also monetised using merchant services from just a handful of banks.

Spam makes up 74.8 per cent of all email messages, compared to 90 per cent last year, according to the latest statistics from Symantec, published last week. The net security efforts credits botnet takedown efforts, most notably against the infamous Rustock botnet, for the decrease.

A paper on the California University research, entitled Click Trajectories: End-to-End Analysis of the Spam Value Chain, which presents an interesting overview of the business models behind the junk mail that curses all our inboxes, can be found here (16-page pdf/2.3MB).

Over the years, a highly sophisticated business network has evolved around the delivery of junk mail messages. Components of the spam ecosystem include "bulletproof hosting", order fulfilment and payment processing, among many others, as explained in much greater depth in the paper. ®

Similar topics

Broader topics


Other stories you might like

  • Elon Musk says Twitter buy 'cannot move forward' until spam stats spat settled
    A stunning surprise to no one in this Solar System

    Elon Musk said his bid to acquire and privatize Twitter "cannot move forward" until the social network proves its claim that fake bot accounts make up less than five per cent of all users.

    The world's richest meme lord formally launched efforts to take over Twitter last month after buying a 9.2 per cent stake in the biz. He declined an offer to join the board of directors, only to return asking if he could buy the social media platform outright at $54.20 per share. Twitter's board resisted Musk's plans at first, installing a "poison pill" to hamper a hostile takeover before accepting the deal, worth over $44 billion.

    But then it appears Musk spotted something in Twitter's latest filing to America's financial watchdog, the SEC. The paperwork asserted that "fewer than five percent" of Twitter's monetizable daily active users (mDAUs) in the first quarter of 2022 were fake or spammer accounts, which Musk objected to: he felt that figure should be a lot higher. He had earlier proclaimed that ridding Twitter of spam bots was a priority for him, post-takeover.

    Continue reading
  • Enemybot botnet uses Gafgyt source code with a sprinkling of Mirai
    Keksec malware used for DDoS attacks, may spread to cryptomining, Fortinet says

    A prolific threat group known for deploying distributed denial-of-service (DDoS) and cryptomining attacks is running a new botnet that is built using the Linux-based Gafgyt source code along with some code from the Mirai botnet malware.

    The group Keksec (also known as Nero and Freakout) is using the fast-evolving Enemybot to target routers from vendors like Seowon Intech and D-Link and is exploiting a remote code execution (RCE) vulnerability (CVE-2022-27226) discovered last month in iRZ mobile routers, according to a report this week by Fortinet's FortiGuard Labs team.

    Keksec is using the Enemybot malware as a classic botnet, rolling up compromised Internet of Things (IoT) devices into a larger botnet that can be used to launch DDoS attacks.

    Continue reading
  • Emotet reestablishes itself at the top of the malware world
    Botnet infrastructure shut down last year, now central to a fast-spreading email scam, researchers say

    More than a year after essentially being shut down, the notorious Emotet malware operation is showing a strong resurgence.

    In a March threat index, Check Point researchers put the Windows software nasty at the top of its list as the most widely deployed malware, menacing or infecting as much as 10 percent of organizations around the globe during the month – a seemingly unbelievable estimate, and apparently double that of February.

    Now Kaspersky Labs says a rapidly accelerating and complex spam email campaign is enticing marks with fraudulent messages designed to trick one into unpacking and installing Emotet or Qbot malware that can steal information, collect data on a compromised corporate network, and move laterally through the network and install ransomware or other trojans on networked devices.

    Continue reading
  • Microsoft-led move takes down ZLoader botnet domains
    That should keep the criminals offline for, well, weeks probably

    Microsoft has announced a months-long effort to take control of 65 domains that the ZLoader criminal botnet gang has been using to spread the remote-control malware and orchestrate infected machines.

    The tech giant's Digital Crimes Unit obtained a court order from a US federal judge in Georgia to take down the domains, which are now directed to a Microsoft-controlled sinkhole so they can't be used by the malware's masterminds to communicate with their botnet of commandeered Windows computers.

    From what we can tell from the filings submitted by Microsoft to the courts, its justification for the seizure is that ZLoader used the domains to injure the Windows giant as well as residents of the US state and commit computer fraud, infringement of Microsoft trademarks, and other illegal activity. The trademark infringement being that at least one of the domains was used for a website that featured Microsoft trademarks in an attempt to masquerade as a legit Redmond site, and also references in phishing emails to Microsoft-trademarked programs, such as Excel.

    Continue reading

Biting the hand that feeds IT © 1998–2022