US researchers penetrate spam network
p2pnet news view Advertising | Security:- When a team of University of California, Berkeley and UC, San Diego (UCSD) computer scientists hijacked a spam network, this year, they found its owners were getting only one response for every 12,500,000 emails.
But even so, it was still worth the effort.
By penetrating an existing botnet’s infrastructure, the team analyzed a spam campaign designed to spread a malware trojan, and another marketing online pharmaceuticals, says their study, Spamalytics: An Empirical Analysis of Spam Marketing Conversion.
Led by assistant professor Stefan Savage from UCSD, the team gained control of almost 76,000 hijacked machines and ran what they say was the first large-scale quantitative study of spam conversion.
Anyone clicking on the fakes was taken to replica web sites under their control.
“Using this methodology we instrumented almost 500 million spam messages, comprising three major campaigns, and quantitatively characterized both the delivery processand the conversion rate,” they say in their conclusions, adding »»»
After 26 days, and almost 350 million e-mail messages, only 28 sales resulted — a conversion rate of well under 0.00001%. Of these, all but one were for male-enhancement products and the average purchase price was close to $100. Taken together, these conversions would have resulted in revenues of $2,731.88 — a bit over $100 a day for the measurement period or $140 per day for periods when the campaign was active. However, our study interposed on only a small fraction of the overall Storm network — we estimate roughly 1.5 percent based on the fraction of worker bots we proxy. Thus, the total daily revenue attributable to Storm’s pharmacy campaign is likely closer to $7000 (or $9500 during periods of campaign activity). By the same logic, we estimate that Storm self-propagation campaigns can produce between 3500 and 8500 new bots per day.
Under the assumption that our measurements are representative over time (an admittedly dangerous assumption when dealing with such small samples), we can extrapolate that, were it sent continuously at the same rate, Storm-generated pharmaceutical spam would produce roughly 3.5 million dollars of revenue in a year.
This number could be even higher if spam-advertised pharmacies experience repeat business. A bit less than “millions of dollars every day”, but certainly a healthy enterprise.
The next obvious question is, “How much of this revenue is profit”? Here things are even murkier. First, we must consider how much of the gross revenue is actually recovered on a sale. Assuming the pharmacy campaign drives traffic to an affiliate program (and there are very strong anecdotal reasons to believe this is so) then the gross revenue is likely split between the affiliate and the program (a annual net revenue of $1.75M using our previous estimate).
Next, we must subtract business costs. These include a number of incidental expenses (domain registration, bullet-proof hosting fees, etc) that are basically fixed sunk costs, and the cost to distribute the spam itself.
Anecdotal reports place the retail price of spam delivery at a bit under $80 per million [22]. This cost is an order of magnitude less than what legitimate commercial mailers charge, but is still a significant overhead; sending 350M e-mails would cost more than $25,000. Indeed, given the net revenues we estimate, retail spam delivery would only make sense if it were 20 times cheaper still
And yet, Storm continues to distribute pharmacy spam — suggesting that it is in fact profitable. One explanation is that Storm’s masters are vertically integrated and the purveyors of Storm’s pharmacy spam are none other than the operators of Storm itself (i.e., that Storm does not deliver these spams for a third-part in exchange for a fee). There is some evidence for this, since the distribution of target e-mail domain names between the self-propagation and pharmacy campaigns is virtually identical. Since the self-propagation campaigns fundamentally must be run by the botnet’s owners, this suggests the purveyor of the pharmacy spam is one and the same.
A similar observation can be made in the harvesting of e-mail addresses from the local hard drives of Storm hosts. These e-mail addresses subsequently appear in the target address lists of the pharmacy campaign and self-propagation campaigns alike. Moreover, neither of these behaviors is found in any of the other (smaller) campaigns distributed by Storm (suggesting that these may in fact be fee-for-service distribution arrangements). If true, then the cost of distribution is largely that of the labor used in the development and maintenance of the botnet software itself. While we are unable to provide any meaningful estimates of this cost (since we do not know which labor market Storm is developed in), we surmise that it is roughly the cost of two or three good programmers.
If true, say Chris Kanich, Christian Kreibich, Kirill Levchenko, Brandon Enright, Geoffrey M. Voelker, Vern Paxson and Savage, “this hypothesis is heartening since it suggests that the third-party retail market for spam distribution has not grown large or efficient enough to produce competitive pricing and thus, that profitable spam campaigns require organizations that can assemble complete ’soup-to-nuts’ teams.
“Put another way, the profit margin for spam (at least for this one pharmacy campaign) may be meagerenough that spammers must be sensitive to the details of how their campaigns are run and are economically susceptible to new defenses.
News 1130 – , November , 2008
Use free p2pnet newsfeeds for your site. It’s really easy!Subscribe to p2pnet.net | | rss feed: http://p2pnet.net/p2p.rss | | Mobile – http://p2pnet.net/index-wml.php
Net access blocked by government restrictions? Use Psiphon from the Citizen Lab at the University of Toronto. Go here for details.
November 11th, 2008 at 6:17 am
About the costs, they are way below $80 per million mentioned in the research. This is a wrong estimate.
To professional spammers, The cost to send spam is $1 – $2 per million, sometimes less. $80 / mil is if you want to hire someone less professional to send spam, these deals are very rare. most people just send gazilions of spams to replica, pharmacy, soft or stocks… because it makes BIG money, compared to finding an idiot prepared to pay $80/mil
November 11th, 2008 at 4:01 pm
What is needed is a way to kill the botnets…
November 11th, 2008 at 5:51 pm
“What is needed is a way to kill the botnets”
No, botnet eradication would obviously hurt “national security” according to the US military, because they are developing their own botnets to be used for launching DDoD attacks.
http://blog.wired.com/27bstroke6/2008/05/air-force-col-w.html