Trojan compromises email delivery
Published: 15 Oct 2003 10:10 BST
US-based Internet security researchers have confirmed that a worm is behind the sharp jump in spam activity battering Telstra's BigPond and other major global ISPs since early last week.
Symantec's US-based security team said spammers are using a multitude of Windows systems compromised by the worm to send massive amounts of unsolicited email, clogging the messaging systems of major ISPs across the globe.
Symantec believe a variation of the Randex worm first discovered in August has inserted a backdoor Trojan named mprox, discovered on 30 September, into a large number of Windows-based systems.
Windows-based systems infected by mprox provide spammers with an open relay or "proxy server" for sending email and other messages.
"Spammers are using these distributed proxy servers to send out massive amounts of spam and we're seeing this in lots of locations -- we're seeing heavy traffic," said Vincent Weafer, senior director of Symantec Security Response.
Randex attempts to propagate by seeking out systems near its host and attempting to login to them using simple passwords. Each system it annexes is infected with the Trojan.
Most varieties of Randex affect Windows 2000, Windows NT and Windows XP systems, and according to security researchers the worm was designed to be controlled remotely through an Internet Relay Chat (IRC) channel.
According to Weafer, ISPs began reporting the surge in unsolicited email last week, around the same time that Bigpond's email woes began.
"Our initial report on this went out on around the 30th of September but we're definitely continuing to see this occur out there, so I think this is the source of what you're seeing with the Australian ISPs. It would make perfect sense and there was definitely an increase in global traffic," said Weafer.
If Symantec's reasoning is correct, it appears that some of the spam clogging Telstra's email service could be coming from the customer end of its network. It stands to reason that this may be hampering Telstra's spam-filtering software.
While the problem has affected ISPs globally, it appears to have hit Telstra particularly hard. Both Optus and OzEmail customers have reported experiencing email delays in recent days but Bigpond customers report that their email traffic to their inboxes has been slowed to less than one a day.
Telstra now says that it may not be able to restore a regular service level for several weeks and some customer are already demanding financial compensation from Telstra for loss of business.
Did you find this article useful?
78 out of 159 people found this useful
Digg
Slashdot
Del.ici.ous
Stumble
Reddit
