Another one bytes the dust

Following the October 2008 shut down of the largest US based host of trojan malware, botnet command and control systems (C&Cs) and DNS changer hosts (pharming), Intercage/Atrivo, another US based network specializing in hosting similar cybercrime has been taken off the Internet.

McColo is a bit different from Intercage/Atrivo in that although the IP addresses were from the North American registry ARIN, were routed in the US, and the company used US postal addresses, the person or persons controlling the operation are based in Moscow, Russia.

After a report by the Washington Post, with evidence from Hostexploit, SecureWorks and other top botnet researchers, McColo's two "upstream" networks Hurricane Electric and Global Crossing shut off all routing on Wednesday, 12 November 2008. McColo quickly tried to get re-connected and on Saturday, 15 November 2008, found a bandwidth reseller (giglinx.com, who we assume amazingly had not heard the news) to connect them to a US node of the European-based Telia network (San Jose, California, where McColo's servers are located). This routing did not last for more than a few hours before the routing was canceled by Telia. During this uptime, the bots controlled by the McColo C&Cs were once again seen sending spam.

A major drop in global spam was seen immediately on Wednesday, 12 November 2008, when McColo and the C&C servers there dropped off the Internet. There have been widely different levels of spam decline reported since McColo went down. The reported declines vary from 5% all the way up to 90%. There can be variations in spam rates from one ISP or anti-spam vendor to another, but not this wide a range. Spamhaus saw about 60% decline in raw spam delivery attempts. Lower percentage numbers probably came from places which measured after spam volume after SMTP connection filtering such as Spamhaus' XBL and/or PBL blocklists at their email server gateways. These Spamhaus blocklists stop the majority of botnet spam all of the time, so any significant drop in botnet spam won't show up in post-filtering statistics. One must measure every blocked connection, too, to calculate the real percentage drop.

We recommend anyone who saw more than a 30% reduction in delivered spam should look into employing some sort of SMTP connection filtering as this drop in botnet spam, nice as it is, will not last. Investigators report that many of the C&C servers at McColo were originally hosted at Intercage/Atrivo. Even now, several of the C&C functions are migrating to hosting closer to the homes of the botmasters: Russia.

Are there any dark linings to this silver cloud? Yes. The first is that the cybercrime botnet and spam gangs will need to infect many more computers with new virus and trojan malware that will not try and connect to C&C servers in the McColo IP address space. This will mean a ramp up in spamming of malware and hacking of websites to insert "drive by" infection code. A second downside, that can only be assumed, is that any law enforcement investigations into the McColo hosted criminals will have been sidelined. Lastly, Spamhaus and others have been waving red flags about McColo for several years, but they were kept online. Only a large concerted effort by multiple players including the press seems to be able to dislodge these pariahs of the internet.

Additional reading:

• Washington Post: A Closer Look at McColo- Washington Post: Host of Internet Spam Groups Is Cut Off- Washington Post: So Much Spam From One Place?- Washington Post: How Does So Much Spam Come From One Place?- CyberCrime & Doing Time: Post McColo Spam - What do we see?- CyberCrime & Doing Time: Unprecedented Drop in Spam- CyberCrime & Doing Time: Internet Landfill: McColo Corporation- CERT-LEXSI: McColo Exposed- Fireeye: McColo shutdown- Arbor Networks: Third "Bad ISP" Disappears -- McColo Gone- Bit-Tech: Huge drop in spam as McColo closes- SANS ISC: McColo Corp alleged spam/malware host knocked offline- IDG News Service: ISP cut off from Internet after security concerns- SearchSecurity: Despite McColo shutdown, expect Spam deluge to resume- Techworld: Spam drop could boost Trojan attacks- Threatexpert: McColo - Who Was Behind It?- Marshal: Huge Decrease in Spam- Sophos: McColo up again, down again- Spamhaus: McColo IP address - range #1 info, range #2 info- CBL: CBL-observed Effects of the McColo Outage- Queen: Another One Bites The Dust