Segmenting and Localizing Spam Campaigns

One-to-many or one-to-one communication channel? That's the questions from a spammer's perspective. Given that spammers have long embraced basic segmentation in their harvested email databases, enforcing localization in each of their multinational campaigns, thereby increasing the probability for a higher response, was a logical trend to come, one that we're currently witnessing on a large scale. Outsourcing the localization process by using translation services on demand, for anything starting from phishing emails and spam, and going to malware campaigns, is starting to accelerate, due to the fact that these parties now know about the email address than they used to in the past.

A Chinese user will never receive a spam message in German, and exactly the opposite, as spammers are getting more ROI conscious in everything they do, and therefore in the long term, the emphasis on the processing of sending the spam, may in fact shift to higher expectations from bother masters with spammers requiring hosts with clean IP reputations in the very same fashion spammers want email databases of emails that still haven't been spammed - well at least by them.

And just like in any other market out there, the managed spamming appliance providers would inevitably vertically integrate to start offering database filtering and verification of delivery services. With so many malware infected hosts, spamming is getting cheaper, given the increasing number of market participants each of them consciously or subconsciously engaging in permanent penetration pricing to end up undercutting those positioning spamming as a exclusive service. And when the process of sending, and providing huge lists of harvested emails is already a commodity, the competitions is shifting to the quality of the campaign.

The attached screenshot represents a spamming provider's "inventory" of emails per country, and price for a number of already harvested emails, clearly demonstrating that when competition increases even in the underground market, the serious sellers start differentiating their propositions, taking spam in general a step beyond.

Testing Signature-based Antivirus Products Contest

This is both interesting, yet irrelevant and outdated as well :

"The Race to Zero contest is being held during Defcon 16 at the Riviera Hotel in Las Vegas, 8-10 August 2008. The event involves contestants being given a sample set of viruses and malcode to modify and upload through the contest portal. The portal passes the modified samples through a number of antivirus engines and determines if the sample is a known threat. The first team or individual to pass their sample past all antivirus engines undetected wins that round. Each round increases in complexity as the contest progresses."

What are the reactions of security vendors, AVs in particular? The best remark - "Security vendors began panning it immediately, saying it will simply help the bad guys learn some new tricks."

The bad guys will learn new tricks from the good guys modifying binaries to prove that anti virus signature scanning isn't working? There's no shortage of creativity and innovation on behalf of malware authors, and in reality,the good guys are supposed to learn from the bad guys in the sense of the techniques, tools and tactics they use to achieve such a high-level degree of now automated polymorphism. Moreover, the only thing the bad guys can learn from the good guys are the techniques the good guys use to make the bad guys' living a pain, in fact obtain the tools and see their malware through the eyes of a good guy.

Moreover, as I've already pointed out in a previous post, undetected malware or malware with the lowest possible detection rate is no longer created, it's being generated thanks to :

"DIY nature of malware building, the managed undetected binaries as a service coming with the purchase of proprietary malware tools, the fact that malware is tested against all the anti virus vendors and the most popular personal firewalls before it starts participating in a campaign, and is also getting benchmarked and optimized against the objectives set for its lifecycle."

Nowadays, even a script kiddies' favorite Remote Administration Tool is empowered with such advanced point'n'click DIY type of features such as anti-sandboxing and anti-reverse engineering, either through the use of built-in such features, or outsourcing the process to someone who's excelling at the process. Undetected malware isn't just coming as a product these days, it's also getting pitched as a managed service on a per obfuscated binary basis.

Thankfully, signature based malware scanning is slowly becoming just one of the many other alternative malware and behaviour detection approaches available within antivirus solutions these days, given the possibilities for artificially messing up the industry's count for malware variants.