A botnet is a hugely parallel supercomputer. If they so desired, botnet operators could use this processing power to, say, simulate exquisite climate models, or defeat Deep Blue (which defeated Gary Kasparov) in chess. But the botnet’s most valuable attribute is its distributed bandwidth. This is how to send a billion emails in a day or coordinate a denial of service attack to take down a website—“the digital equivalent of filling a fishtank with a firehose”.

Take the Storm botnet as an example. Some say it controls over a million computers. Some security experts suspect that Storm is run by the Russian Business Network, a group of renegade Russian (surprise!) computer scientists also blamed for the denial of service attacks that crashed Georgian President Mikhail Saakashvili’s website along with the National Bank of Georgia just before the 2008 South Ossetia War. Storm is also responsible for a considerable fraction of the world’s email spam.

How much money is in spam? IBM Security Systems expert Joshua Corman is widely quoted as claiming    that spam sent by Storm is generating “millions and millions of dollars every day”. And, does Storm send its own spam or does it rent its bandwidth to specialized spammers—a disconcerting possibility, suggesting a maturing underground economy.

A team of researchers in Berkeley and San Diego set out to investigate. First they figured out how Storm works. It’s complicated but here’s the gist: infected computers are classified as either workers or proxies based in part on whether they have a firewall installed. Workers do the actual spamming, receiving instructions from proxies that coordinate the jobs. Proxies take orders from a master server.

The researchers set up eight proxies, simply by installing the software (the didn’t have to go looking; it was in their email). This way, workers contacted them, requesting tasks. But just as the instructions were shipping out, they modified the text of the spam messages, replacing the link with their own—a mock pharmaceutical website complete with Viagra, “Viagra professional”, a shopping cart, etc. (though they never collected any money or personal information about their customers).


In this way, they tracked half a billion spam messages—a Viagra campaign and a botnet expansion campaign with fake greeting cards (complete with dancing banana)—over 26 days. Here is the big result: 350 million emails resulted in 28 purchases. Average purchase size was $100. Estimating they tracked 1.5% of the full network and assuming continuous active spamming, this gives about $3.5 million in Viagra-inspired revenue per year. Much less than millions in a day, but not too shabby either.

Is this good or bad? Well, it’s annoying. If nobody ever bought anything as a result of email spam, it would stop. And 28 in 350 million—1 in 12.5 million—is awfully close to nobody. It’s good in the sense that at $3.5 million per year, it’s unlikely that Storm is running an affiliate program—renting their services to third party spammers—since profit margins are so slim.


The bad news is two-fold. First, the greeting card expansion campaign was considerably more successful. One in ten people that visited the greeting card page downloaded and installed the software (no purchase necessary). If people are gullible enough to install Storm themselves, it’s very hard to imagine how to slow down the botnets. Second, so much mystery remains. Perhaps this particular spam campaign was just a side-project, an experiment much less fruitful than the botnet’s ordinary activities.

Further analysis shows national differences. While the U.S. received over 10 times more spam than Japan (the 2nd most spammed country), it is the least efficient of targets: the U.S. response rate was lowest, while India, Pakistan, and Bulgaria showed the highest response rates. The researchers believe these differences are due more to spam-filtering technology and anti-spam awareness than to varied interest in Viagra.

Ok. A few statistics to close out this installment. Spam doubled in 2007 to 120 billion messages sent daily. The rate seems to have doubled again in 2008. Microsoft recently estimated that over 97% of all email sent is spam, and that nearly 1% of all computers are infected by some botnet. Bill Gates, it is said, receives around 10000 spam emails every day.

Related Articles Here On Scientific Blogging