Rustock Uses TLS Technique to Send Spam

MessageLabs Intelligence, an Internet security company, has lately found an increase in spam mails from the Rustock botnet that utilized the Transport Layer Security (TLS) method. This is a method used in dispatching e-mail via an encrypted medium.

In the 2nd week of March 2010, MessageLabs division of Symantec said that it had noticed huge amounts of spam utilizing TLS. During that time, Rustock encrypted around 35% of spam with TLS. The firm states that the percentage has now risen a good 77% of the botnet's total activity in March 2010.

Along with TLS spam messages; there is a massive hike in the total outgoing traffic too. According to MessageLabs, the reason is that TLS needs huge volumes of outgoing e-mails for settling coded protocols.

Notably, it isn't merely MessageLabs hosted messaging vendor that detected Rustock using TLS. When the firm issued its first alert of Rustock, Terry Zink (researcher at the Forefront Online Security unit of Microsoft) reported a same kind of problem with Rustock along with the botnet's utilization of the TLS protocol, as reported by TechWorld on March 25, 2010.

Zink showed that the entire volume of e-mail dispatched with the help of TLS was 50 Million, while the entire volume of spam dispatched with TLS amounted to 19.5 Million. That means 39% of all e-mail dispatched using TLS were junk messages. More investigation disclosed that Rustock contributed 34% of it in comparison to all other botnets.

According to a prediction by the security specialists, the volume of spam based on TLS and sent by botnet will increase in the near future. Thus, Paul Wood (Senior Analyst at MessageLabs Intelligence) says that it'll be necessary for organizations to assess their resources that deal with TLS spam, as reported by GSN on March 25, 2010.

Wood further says that since corporate servers are pressed for dealing with these costly yet essential TLS connections, it transpires into a terrible outcome. He adds that while the expenditure for processing one TLS spam message may seem trifle, when it comes to huge quantities, the impact is likely to be extensive.

Related article: Rustock Become The World’s Largest Spam Botnet

» SPAMfighter News - 4/5/2010