Spam Bot Rivals Commercial Software

Joe Stewart, senior security researcher at SecureWorks, has posted an analysis of a Trojan program called SpamThru on his company's Web site. As far as malware goes, it's a marvel.SpamThru features a custom P2P protocol to share information with other bot-infected or compromised machines. In the event that the command-and-control server gets shut down, the spammer can redirect the hacked peers to a new master server.

SpamThru defends itself against antivirus software by rewriting the hosts file on the infected machine so virus updates can't be found. It also uses its own antivirus engine to eliminate other resident malware that might compete for resources or expose the compromised machine.

It contains its own template-driven spamming engine that's protected by AES (Rijndael) encryption. And it can generate randomized spam images to defeat pattern-based spam detection methods.

"Although we've seen automated spam networks set up by malware before (Sober, Bobax, Bagle, etc) this is one of the more sophisticated efforts," writes Stewart. "The complexity and scope of the project rivals some commercial software. Clearly the spammers have made quite an investment in infrastructure in order to maintain their level of income."

If the rest of my applications looked after themselves as aggressively as SpamThru does, I'd never have to worry about security again.