Red Condor Zeros In on Fast-Flux Spam

Red Condor says its has developed a new algorithm that can help thwart fast-flux e-mail spam campaigns.

E-mail security provider Red Condor hopes its new technology will serve as a stop sign for "fast-flux" e-mail spam campaigns and will beat spammers at their own game.

The company announced the technology, which it calls Zombie Harvester Robot, Oct. 3. The robot does more than simply look at URLs embedded inside e-mails to determine whether it is malicious or not based on blacklist information. Instead, the technology watches for changes and patterns that indicate potential threats.

With fast-flux, spammers continually change the URL in the e-mail to counter filtering efforts. The constant change requires a corresponding defense that recognizes those changes as they occur, Red Condor officials said.

Fast-flux botnets turn IP addresses against anti-spammers. Using a large number of servers, fast-flux DNS uses a compromised PC as a proxy, frustrating investigators. In its September intelligence report, MessageLabs counted fast-flux DNS techniques as one of the key reasons botnets are hard to shut down. The MySpace worm that compromised thousands of MySpace users sites earlier this year utilized fast-flux techniques.

Resource Library:

Click here to read how spam was used to launch the Storm worm attack.

It is into this environment that Red Condor, which provides both a hosted spam-filtering service and a number of network appliances, is launching Zombie Harvester Robot. Red Condor uses up-to-the-minute security threat information from its worldwide sensor network and then applies defensive measures in real time to protect the companys client base, said officials of the Rohnert Park, Calif., company.

 

"Our system watches for particular patterns among spammers and fast-flux Web sites and creates dynamic rules that adapt to these rapidly changing threats in real time," said Nathan Strong, director of product planning for Red Condor.

"ZHR is currently accounting for anywhere between 1 percent and 3 percent of spam blocked [by Red Condor] for a given day," said Strong. "We currently block over a billion messages a week, so this technology is making a difference for our customers. We have tens of thousands of active rules and techniques, and ZHR is just one of many intelligent algorithms that we employ."

Zombie Harvester Robot is now part of a service the company provides, Strong said.

Check out eWEEK.coms Security Center for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEKs Security Watch blog.

Reader Comments: Red Condor Zeros In on Fast-Flux Spam >>> Be the FIRST to comment on this article!

>>> More Network Security & Hardware Articles          >>> More By Brian Prince