Ryan Singel
Security

Big Corps Busted Hosting Spam Zombies on Their Networks

Support Intelligence, a networking monitoring company, is busting some of the world’s largest corporations for having malware-infected or PWNED machines that are spewing spam from within corporate firewalls. Using spam honeypots (fake email addresses left laying around the internet for a spam bot to find) and reverse IP addresses lookups from spam headers, the company […]

boalogoSupport Intelligence, a networking monitoring company, is busting some of the world's largest corporations for having malware-infected or PWNED machines that are spewing spam from within corporate firewalls. Using spam honeypots (fake email addresses left laying around the internet for a spam bot to find) and reverse IP addresses lookups from spam headers, the company has fingered Bank of America, Toshiba, Aflac (I never trusted that duck), AIG, and Business Week among others for having compromised machines on their networks.

UPDATE: AFLAC says it's network wasn't infected, saying it found that the spam came out of their network via an employee's infected home machine that connected to the AFLAC network through a VPN.

We have observed many months of good behavior from BofA but starting on April 2, 2007 a lone system named system6.bofasecurities.com [63.80.4.6] got infected with something nasty. The situation lasted until the evening of April 6th. During this time we collected 226 SPAM.

Support Intelligence wasn't the only place that noticed this box spew,System6 was blacklisted by CBL, TQM 3, and UCEProtect. We also note that this same system has been blacklisted by SpamHaus before on 2006-12-31 and 2007-03-30.

None of the Spam we collect from System 6 had any Received headers so we believe all the mail to have originated from hosts outside of Bank of America, probably via socks proxy - so lets be clear that this appears to be a casual penetration of [our attorney has encouraged us to leave this space blank]

Via TaoSecurity via Emergent Chaos, both of which have more...