MAAWG's Mission Evolving As Botnets, Web Threats Intensify

MESSAGING ANTI-ABUSE WORKING GROUP (MAAWG) GENERAL MEETING -- PHILADELPHIA -- ISPs and vendors here at the mostly closed-door Messaging Anti-Abuse Working Group (MAAWG) meeting this week shared data and research on more than just email abuse -- botnets, Web-borne attacks, social neworks, and wireless threats were also among the topics for ISPs and email providers.

Spam and malicious email have been gradually declining as more stealthy and efficient Web-borne attacks have become a popular choice for the bad guys. MAAWG ISPs and vendors yesterday reported slight drops in email abuse, but it's still steady at around 90 percent of all email traffic.

"Email [abuse] will remain substantial," says Michael O'Reirdan, chairman of MAAWG and distinguished engineer in national engineering and technical operations at a major U.S. ISP. Even so, O'Reirdan says he'd like for MAAWG to change its name to more than a messaging title to better reflect the evolving threats to ISPs and their users.

Other MAAWG members, such as Cisco, note that malware distribution via email has become less of a threat in developed countries. "Email as a malware distribution [vector] is somewhat dead except in emerging economies," says Henry Stern, senior security researcher for Cisco's IronPort team. G-20 countries are now sending anywhere from 20 to 40 percent less spam this year than last, he says.

That's, in turn, pushing spamming botnets out of the U.S. to lesser-developed countries with emerging broadband infrastructures. "It's more lucrative for them to go outside the U.S. There's a migration away from old email spam here" and to other methods, such as attacks on social networks, for instance, says Patrick Peterson, a Cisco fellow.

MAAWG's O'Reirdan says the shift is all about economics. "The ROI of attacking us [in the U.S.] is high. But the ROI of bots in the U.S. is low," he says.

A U.S. bot goes for 13 cents, whereas a bot in Vietnam or another developing Asian nation is only about one-quarter of a penny, according to Cisco.

"In the developed economy, Web as an infection vector has eclipsed email," Cisco's Peterson says. But those machines infected via the Web suffer the same fate as those via email: They typically become members of a botnet to continue the infection cycle, he notes.

MAAWG members say the organization's mission is already becoming more than just messaging abuse. "The charter is expanding beyond messaging," says Mark Risher, senior director of product management and spam czar for Yahoo, a MAAWG member. "People [here] are talking about instant messaging spam, smishing, [and other threats]."

Risher says the bad guys are basically applying some of their same messaging attack tactics to other vectors. "They are spamming to different communications media," he says.

One emerging attack on social networks, for example, sends messages to a victim's friends that he has updated his profile photo. When the friends click on a link to the photo, they are then infected, as well, and the cycle continues, according to Risher. He says a few social network vendors attended and participated in the meetings this week.

ISPs traditionally have been hesitant to suspend abused accounts for fear of customer backlash. But some MAAWG members have discussed strategies, such as user reputation programs, where providers would track a user's account activity such that unusual behavior would raise a red flag, for instance. "It used to be that every action was [looked at] in isolation, but that was naive," Risher says. "When you focus on building a reputation and taking an accounting of the good the account is doing, you can give them the benefit of the doubt." When you notice something changes, he adds, you can more easily detect fraud.

One ISP in Thailand, for instance, fires up a "splash screen" with statistics for the user when it detects something unusual with the account, such as bot activity or other fraud. "They've gotten positive customer support calls [about it]," he says. "It used to be [ISPs] worried that users would be resentful if they suspended their accounts." But outcomes like that of the Thai ISP shows otherwise, he says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.