The harvester, the botmaster, and the spammer: on the relations between the different actors in the spam landscape

ABSTRACT

A spammer needs three elements to run a spam operation: a list of victim email addresses, content to be sent, and a botnet to send it. Each of these three elements are critical for the success of the spam operation: a good email list should be composed of valid email addresses, a good email content should be both convincing to the reader and evades anti-spam filters, and a good botnet should efficiently sent spam. Given how critical these three elements are, figures specialized on one of these elements have emerged in the spam ecosystem. Email harvesters crawl the web and compile email lists, botmasters infect victim computers and maintain efficient botnets for spam dissemination, and spammers rent botnets and buy email lists to run spam campaigns. Previous research suggested that email harvesters and botmasters sell their services to spammers in a prosperous underground economy. No rigorous research has been performed, however, on understanding the relations between these three actors. This paper aims to shed some light on the relations between harvesters, botmasters, and spammers. By disseminating email addresses on the Internet, fingerprinting the botnets that contact these addresses, and looking at the content of these emails, we can infer the relations between the actors involved in the spam ecosystem. Our observations can be used by researchers to develop more effective anti-spam systems.

References

1. RFC 821: Simple Mail Transfer Protocol. http://tools.ietf.org/html/rfc821.
2. U. Bayer, A. Moser, C. Kruegel, and E. Kirda. Dynamic analysis of malicious code. Journal in Computer Virology, 2(1):67--77, 2006.
3. J. Caballero, C. Grier, C. Kreibich, and V. Paxson. Measuring Pay-per-Install: The Commoditization of Malware Distribution. In USENIX Security Symposium, 2011.
4. J. Caballero, P. Poosankam, C. Kreibich, and D. Song. Dispatcher: Enabling Active Botnet Infiltration Using Automatic Protocol Reverse-Engineering. In ACM Conference on Computer and Communications Security (CCS), 2009.
5. C. Cho, J. Caballero, C. Grier, V. Paxson, and D. Song. Insights from the Inside: A View of Botnet Management from Infiltration. In USENIX Workshop on Large-Scale Exploits and Emergent Threats (LEET), 2010.
6. eMarkSofts. Fast email harvester 1.2. http://fast-email-harvester.smartcode.com/info.html, 2009.
7. G. Gu, R. Perdisci, J. Zhang, and W. Lee. BotMiner: Clustering Analysis of Network Traffic for Protocol- and Structure-independent Botnet Detection. In USENIX Security Symposium, 2008.
8. S. Hao, N. A. Syed, N. Feamster, A. G. Gray, and S. Krasser. Detecting Spammers with SNARE: Spatio-temporal Network-level Automatic Reputation Engine. In USENIX Security Symposium, 2009.
9. O. Hohlfeld, T. Graf, and F. Ciucu. Longtime Behavior of Harvesting Spam Bots. In ACM SIGCOMM Conference on Internet Measurement, 2012.
10. J. Iedemska, G. Stringhini, R. Kemmerer, C. Kruegel, and G. Vigna. The Tricks of the Trade: What Makes Spam Campaigns Successful? In International Workshop on Cyber Crime, 2014.
11. C. Kanich, C. Kreibich, K. Levchenko, B. Enright, G. Voelker, V. Paxson, and S. Savage. Spamalytics: An Empirical Analysis of Spam Marketing Conversion. In ACM Conference on Computer and Communications Security (CCS), 2008.
12. C. Kanich, N. Weaver, D. McCoy, T. Halvorson, C. Kreibich, K. Levchenko, V. Paxson, G. Voelker, and S. Savage. Show Me the Money: Characterizing Spam-advertised Revenue. USENIX Security Symposium, 2011.
13. C. Kreibich, C. Kanich, K. Levchenko, B. Enright, G. M. Voelker, V. Paxson, and S. Savage. On the Spam Campaign Trail. In USENIX Workshop on Large-Scale Exploits and Emergent Threats (LEET), 2008.
14. C. Kreibich, C. Kanich, K. Levchenko, B. Enright, G. M. Voelker, V. Paxson, and S. Savage. Spamcraft: An Inside Look at Spam Campaign Orchestration. In USENIX Workshop on Large-Scale Exploits and Emergent Threats (LEET), 2009.
15. K. Levchenko, A. Pitsillidis, N. Chachra, B. Enright, M. Félegyházi, C. Grier, T. Halvorson, C. Kanich, C. Kreibich, H. Liu, et al. Click trajectories: End-to-end analysis of the spam value chain. In IEEE Symposium on Security and Privacy, 2011.
16. MaxMind. GeoIP. http://www.maxmind.com/app/ip-location.
17. Northworks Solutions Ltd. Ecrawl v2.63. http://www.northworks.biz/software.html, 2012.
18. C. Nunnery, G. Sinclair, and B. B. Kang. Tumbling Down the Rabbit Hole: Exploring the Idiosyncrasies of Botmaster Systems in a Multi-Tier Botnet Infrastructure. In USENIX Workshop on Large-Scale Exploits and Emergent Threats (LEET), 2010.
19. A. Pitsillidis, K. Levchenko, C. Kreibich, C. Kanich, G. M. Voelker, V. Paxson, N. Weaver, and S. Savage. botnet Judo: Fighting Spam with Itself. In Symposium on Network and Distributed System Security (NDSS), 2010.
20. M. Prince, B. Dahl, L. Holloway, A. Keller, and E. Langheinrich. Understanding how spammers steal your e-mail address: An analysis of the first six months of data from project honey pot. In Collaboration, Electronic messaging, Anti-Abuse and Spam Conference (CEAS), 2005.
21. B. Stone-Gross, T. Holz, G. Stringhini, and G. Vigna. The Underground Economy of Spam: A Botmaster's Perspective of Coordinating Large-Scale Spam Campaigns. In USENIX Workshop on Large-Scale Exploits and Emergent Threats (LEET), 2011.
22. G. Stringhini, M. Egele, A. Zarras, T. Holz, C. Kruegel, and G. Vigna. B@BEL: Leveraging Email Delivery for Spam Mitigation. In USENIX Security Symposium, 2012.
23. G. Stringhini, T. Holz, B. Stone-Gross, C. Kruegel, and G. Vigna. BotMagnifier: Locating Spammers on the Internet. In USENIX Security Symposium, 2011.
24. Symantec Corp. State of spam & phishing report. http://www.symantec.com/content/en/us/enterprise/other_resources/b-intelligence_report_02--2013.en-us.pdf?om_ext_cid=biz_socmed_AR_pv_180313_scom_socialmedia_SIRFeb13, 2013.
25. VirusTotal. Free Online Virus, Malware and URL Scanner. https://www.virustotal.com/.
26. P. Wurzinger, L. Bilge, T. Holz, J. Goebel, C. Kruegel, and E. Kirda. Automatically Generating Models for Botnet Detection. In European Symposium on Research in Computer Security (ESORICS), 2009.
27. Y. Xie, F. Yu, K. Achan, R. Panigrahy, G. Hulten, and I. Osipkov. Spamming Botnets: Signatures and Characteristics. SIGCOMM Comput. Commun. Rev., 38, August 2008.

Index Terms

• Social and professional topics

  • Computing / technology policy

    • Computer crime