« Small Company Drowning in Spam—For Years | Main | Amazon.com--Phish or Phor Real? »

July 07, 2007

The number of what I rate as "dictionary attacks" was consistently high this week, peaking at 11,125 attempts on one day, July 5, 2007. While I don't meticulously pore over each day's logs, I was curious to see if, as has happened in the past, this high level was due to a particular attacker. A couple of years ago, for example, there was a 10,000+ attack that reached my server in less than a minute from a Canadian IP address. A few months ago, I noticed that such attacks were more widely distributed across IP addresses, each attack consisting of, say, ten attempts at finding a valid username—presumably to avoid detection by servers smart enough to recognize the older, more massive type of attack.

So, I started looking through the log for the 11,125 attack day. Instead of finding big blocks of multiple username attempts with each connection, I found that by far most attempts involved a single username from a single connection from a single IP address, spread throughout the 24-hour period. There were often multiple attempts on the same user name from separate IP addresses.

This is clearly a sign of bot-net activity. To escape being singled out as a spam machine, the bots are instructed to try just one username at a domain at a time, and not too frequently at that. Instructing multiple bots to give it a go means that more than one zombie may try the same username. Thus, spread across a one-hour period, there were 55 attempts to send to the username (pulled at random from the log) veneersprolix from hijacked computers at 55 IP addresses from around the world.

Two points strike me about this observed behavior.

First, I have in this one day's log file, the IP addresses of thousands of compromised computers. If only there were the mechanisms and wills of ISPs to force the owners of these computers to start ridding their machines of their infections, I'd report them in an instant. As things stand, however, it's a waste of time. That makes me sad.

Second, the amount of Internet traffic spent on this type of botnet activity—in search of new, valid email addresses to spam, and then possibly infect their owners' machines—must be an enormous drain on the globe's Internet bandwidth resources. Although the criminals behind this activity aren't paying for that bandwidth, somebody is. Ultimately, it's you and me. And that makes me mad.