Skip Links

Network World

  • Social Web 
  • Email 
  • Close

Ron Paul spam traced to Ukrainian botnet

By Robert McMillan , IDG News Service , 12/05/2007

Ron Paul is not a botmaster.

Security researchers have shut down a network of computers responsible for sending out nearly 200 million spam messages supporting the U.S. presidential candidate last month, and after analyzing the server's software, it's clear that there is no such thing as a Ron Paul botnet, according to Joe Stewart, a senior security researcher with SecureWorks. "It probably wasn't even set up by a Ron Paul supporter," he said. "This whole system has been around since 2004. This [spam] somehow just landed in this underground spam economy."

When spam first surfaced, trumpeting Paul as the winner of a recent Republican presidential debate, the fact that it was being sent via illegally infected machines raised eyebrows. The spam messages have never been directly linked to the Ron Paul campaign, which has denied any involvement in the incident.

The Texas congressman is considered a long-shot contender for the Republican presidential nomination, but he has a strong Internet presence. His videos are popular on YouTube, and Ron Paul fundraisers recently were able to raise more than $4 million in a 24-hour period.

Stewart published an analysis of the botnet on Tuesday, connecting it to an Eastern European spammer known as "spm," whose company, Elphisoft, sends unsolicited e-mail using a network of about 3,000 infected "botnet" PCs. Stewart believes that spm, and many of the people involved in his operation, are located in the Ukraine.

The botnet server used to manage the Ron Paul spam was located in the U.S. and shut down in mid-November, giving researchers a chance to examine the software on the machine, Stewart explained.

Apparently spm rented out his botnet to a middleman, a spammer calling himself "nenastnyj," who has also sent out messages promoting pornography, online gambling, and male enhancement technology. He probably paid spm between $100 and $1,000 to send out the Ron Paul mailing, Stewart said.

It is nearly impossible to figure out who nenastnyj really is, but Stewart made a few guesses, based on his previous spam jobs stored on the server. "Nenastnyj appears just to be a small-time spammer who doesn't write the spam software," he said. "Basically he just makes money by finding sponsors and then becoming a mailer for them and using someone else's mail service to send it."

Partner Content

Brilliantly simple security and control solutions for email, web and endpoint

www.sophos.com

Stopping data leakage

Learn how to exploit your current security investment to control the information that flows into, through and out of your network.

Download the white paper.

Why detection rates aren't enough

Evaluating endpoint security products is a time-consuming and daunting task. Learn the six critical questions you need to ask to prospective vendors to get the right endpoint solution.

Download the white paper.

Unauthorized applications: Taking back control

Employees installing and using unauthorized applications like IM, VoIP, games and peer-to-peer file-sharing applications cause many businesses serious concern. How do you control these applications?

Download the white paper.

Comment
Login
Forgot your account info?
Add comment
Anonymous comments subject to approval. Register here for member benefits.
Have a NetworkWorld account? Log in here. Register now for a free account.

Videos

rssRss Feed
Get instant email notification when white papers, webcasts, executive guides are added to our library. Stay informed and up-to-date with the latest on IT Technologies with Network World's Resource Alerts.

Whitepapers

Advancing the Economics of Networking

Aging network systems and old habits have dictated how businesses spend their IT budgets. As a...

Implementing HA at the Enterprise Data Center Edge to Connect to a Large Number of Branch Offices

This paper reviews the problem of creating a network where the dynamic availability of services is...

Enterprise Data Center Network Reference Architecture

Using a High Performance Network Backbone to Meet the Requirements of the Modern Enterprise Data...

Webcasts

PoE Plus: Impact on the PoE Market

The standard for Power over Ethernet (PoE), IEEE Std. 802.3af(tm)-2003, advanced networking,...

Harnessing the power of communications to increase workplace performance

Due to the convergence of IT and telecommunications technologies, the business workplace has been...

Stay out of the headlines: Detecting and preventing network intrusions

How do YOU stay out of the headlines? There is no denying that risk exists in our computer-driven...

Special Reports

The Evolution of Network Security

We have so many holes punched in our firewalls today that many industry insiders question the value...

IP address management in 2008 - six things to know

Read this Network World Special Brief to learn how Enterprise IT managers must update their...

The self-managed network

We aren't there yet, but advances in network and systems management tools are making it possible to...