Efficient response to malware

Aug 31, 2007 06:49 GMT  ·  By

This is the year of the bot, that's for sure - spam-sending botnets are all over, plaguing us with all sorts of unwanted messages. This being a fact, many people have started taking spam seriously and have started fighting it. Some security experts have built filters, others have blacklists, while only a few try to rout out spam by wacking the very sites it comes from. In any case, there is no method that keeps your e-mail 100% clean, but there are some pretty good ways to take down spam.

For instance, I read on NetworkWorld that BD-BrandProtect, which is a Canadian online threat protection company is using a combination of automated helpmates like spiders and honeypots as well as human analysis to fight spam. This is a sort of three edged blade - no matter how you hit malware with it, it's going to make it "bleed".

I guess there is no need to explain how human analysis works, but I am going to tell you about spiders and honey pots. This company keeps track of Internet traffic 24 hours a day, seven days per week and their spiders "scour" the Internet, looking for data. The spider can flag images so that it knows they are part of spam campaigns, so when a site sends all those bogus cards, they are already marked and are considered spam. This is great for fighting dangerous e-cards malware.

Then we have honeypots. Those are computers that do absolutely nothing but are attached to a certain company's network. Nobody in the company uses them in any way and they are not solicited by anyone outside the firm, either, because they are useless. So, if anyone tries to connect to such a computer it is clear that it is a hacker, since no one would have any use for it. That way, they can get the IP of the aggressor and put him on a blacklist, so that he may never connect to that network again. Not only these honeypots are good to see what vulnerabilities you have, but in the case of this Canadian firm, they also collect a lot of spam e-mail cards. Of course these will be flagged as spam and analyzed.

So, the basic idea behind all of these tactics is: know you enemy so that you can fight it better!