Download

46 Chapter 2 • Botnets OverviewFigure 2.7 The SpamThru TrojanThe botnet clients transmit their spam to an e-mail spam proxy for relay. By using aspam proxy instead of sending the spam directly from each botclient, the spammer protectshimself from Relay Black Lists (RBL). Once a proxy is listed as being in an RBL it becomesineffective to whoever uses the RBL service, since the point of the RBL is to permit organizationsto ignore traffic from known spam sites. Using proxies permits the spammer toreplace any proxy that is RBL listed with one of the existing clients.They promote theclient to a proxy and demote the old proxy back to being a spam engine. By periodicallyrotating proxy duty sometimes you can avoid being listed by an RBL at all. Stewart calculatedthat the Russian botnet he analyzed was theoretically capable of sending 1billion spame-mails a day, given that they had enough e-mail addresses and enough varieties of spam to