<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
		>
<channel>
	<title>Comments on: Inside the Grum Botnet</title>
	<atom:link href="http://krebsonsecurity.com/2012/08/inside-the-grum-botnet/feed/" rel="self" type="application/rss+xml" />
	<link>http://krebsonsecurity.com/2012/08/inside-the-grum-botnet/</link>
	<description>In-depth security news and investigation</description>
	<lastBuildDate>Thu, 20 Jun 2013 03:19:46 +0000</lastBuildDate>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.5.1</generator>
	<item>
		<title>By: oleg</title>
		<link>http://krebsonsecurity.com/2012/08/inside-the-grum-botnet/comment-page-1/#comment-99023</link>
		<dc:creator>oleg</dc:creator>
		<pubDate>Wed, 22 Aug 2012 16:19:30 +0000</pubDate>
		<guid isPermaLink="false">http://krebsonsecurity.com/?p=16464#comment-99023</guid>
		<description><![CDATA[hah! you know it&#039;s close to home when the nit-picking starts. &quot;download&quot; versus &quot;load?&quot; seriously? and yes i&#039;m sure your right that this spamer has such a deep grasp of greek mythology! why then was his password not megaera? do you know the guy? are you speaking from experience? tell us more plz. :)]]></description>
		<content:encoded><![CDATA[<p>hah! you know it&#8217;s close to home when the nit-picking starts. &#8220;download&#8221; versus &#8220;load?&#8221; seriously? and yes i&#8217;m sure your right that this spamer has such a deep grasp of greek mythology! why then was his password not megaera? do you know the guy? are you speaking from experience? tell us more plz. <img src='http://krebsonsecurity.com/wp-includes/images/smilies/icon_smile.gif' alt=':)' class='wp-smiley' /> </p>
]]></content:encoded>
	</item>
	<item>
		<title>By: HexView</title>
		<link>http://krebsonsecurity.com/2012/08/inside-the-grum-botnet/comment-page-1/#comment-99011</link>
		<dc:creator>HexView</dc:creator>
		<pubDate>Wed, 22 Aug 2012 15:51:59 +0000</pubDate>
		<guid isPermaLink="false">http://krebsonsecurity.com/?p=16464#comment-99011</guid>
		<description><![CDATA[Krebs, you are becoming a real publicity wh##re. :) You may want to validate/confirm your conclusions next time.

&quot;Zagruzka Systems&quot; here means &quot;System Load&quot;.

Megera has nothing to do with Gera, it most likeky refers to Megaera
http://en.wikipedia.org/wiki/Megaera]]></description>
		<content:encoded><![CDATA[<p>Krebs, you are becoming a real publicity wh##re. <img src='http://krebsonsecurity.com/wp-includes/images/smilies/icon_smile.gif' alt=':)' class='wp-smiley' />  You may want to validate/confirm your conclusions next time.</p>
<p>&#8220;Zagruzka Systems&#8221; here means &#8220;System Load&#8221;.</p>
<p>Megera has nothing to do with Gera, it most likeky refers to Megaera<br />
<a href="http://en.wikipedia.org/wiki/Megaera" rel="nofollow">http://en.wikipedia.org/wiki/Megaera</a></p>
]]></content:encoded>
	</item>
	<item>
		<title>By: john</title>
		<link>http://krebsonsecurity.com/2012/08/inside-the-grum-botnet/comment-page-1/#comment-98622</link>
		<dc:creator>john</dc:creator>
		<pubDate>Tue, 21 Aug 2012 08:21:12 +0000</pubDate>
		<guid isPermaLink="false">http://krebsonsecurity.com/?p=16464#comment-98622</guid>
		<description><![CDATA[It probably just checks if a domain/ip has been blacklisted.
Maybe it replaces such blacklisted resources as backup ones as well.]]></description>
		<content:encoded><![CDATA[<p>It probably just checks if a domain/ip has been blacklisted.<br />
Maybe it replaces such blacklisted resources as backup ones as well.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Uzzi</title>
		<link>http://krebsonsecurity.com/2012/08/inside-the-grum-botnet/comment-page-1/#comment-98567</link>
		<dc:creator>Uzzi</dc:creator>
		<pubDate>Tue, 21 Aug 2012 01:14:26 +0000</pubDate>
		<guid isPermaLink="false">http://krebsonsecurity.com/?p=16464#comment-98567</guid>
		<description><![CDATA[.oO(Some servants do serve more than one master...)]]></description>
		<content:encoded><![CDATA[<p>.oO(Some servants do serve more than one master&#8230;)</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: spamislame</title>
		<link>http://krebsonsecurity.com/2012/08/inside-the-grum-botnet/comment-page-1/#comment-98537</link>
		<dc:creator>spamislame</dc:creator>
		<pubDate>Mon, 20 Aug 2012 21:44:27 +0000</pubDate>
		<guid isPermaLink="false">http://krebsonsecurity.com/?p=16464#comment-98537</guid>
		<description><![CDATA[I can. In some of the biggest prosecutions of career pill spammers, notably that of Chris &quot;Rizler&quot; Smith, the affiliates attracted repeat business from people who were clearly addicted to things like Oxycontin or other highly addictive painkillers. These were all people who had been cut off from any further prescriptions, or who had no insurance, who were desperate to gain access to more of these pills.

These scumbags have a habit of targeting these kinds of people, and further they also attract people who are un-insurable under the US system.

If US health insurance were to be less restrictive than it is now (pre-existing conditions, etc.), pill spammers would see a significant drop in business. Residents of the UK and Canada, which have socialized medicine, rarely have a need to purchase these kinds of pills (although yes, doctors will still restrict how many refills on a prescription will be available to a patient.)

SiL]]></description>
		<content:encoded><![CDATA[<p>I can. In some of the biggest prosecutions of career pill spammers, notably that of Chris &#8220;Rizler&#8221; Smith, the affiliates attracted repeat business from people who were clearly addicted to things like Oxycontin or other highly addictive painkillers. These were all people who had been cut off from any further prescriptions, or who had no insurance, who were desperate to gain access to more of these pills.</p>
<p>These scumbags have a habit of targeting these kinds of people, and further they also attract people who are un-insurable under the US system.</p>
<p>If US health insurance were to be less restrictive than it is now (pre-existing conditions, etc.), pill spammers would see a significant drop in business. Residents of the UK and Canada, which have socialized medicine, rarely have a need to purchase these kinds of pills (although yes, doctors will still restrict how many refills on a prescription will be available to a patient.)</p>
<p>SiL</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Dan Herrmann</title>
		<link>http://krebsonsecurity.com/2012/08/inside-the-grum-botnet/comment-page-1/#comment-98528</link>
		<dc:creator>Dan Herrmann</dc:creator>
		<pubDate>Mon, 20 Aug 2012 20:55:00 +0000</pubDate>
		<guid isPermaLink="false">http://krebsonsecurity.com/?p=16464#comment-98528</guid>
		<description><![CDATA[Fantastic article!

(Can you believe 1.3 million suckers actually ordered from those &quot;pharmacies&quot;?)]]></description>
		<content:encoded><![CDATA[<p>Fantastic article!</p>
<p>(Can you believe 1.3 million suckers actually ordered from those &#8220;pharmacies&#8221;?)</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Neej</title>
		<link>http://krebsonsecurity.com/2012/08/inside-the-grum-botnet/comment-page-1/#comment-98486</link>
		<dc:creator>Neej</dc:creator>
		<pubDate>Mon, 20 Aug 2012 17:08:04 +0000</pubDate>
		<guid isPermaLink="false">http://krebsonsecurity.com/?p=16464#comment-98486</guid>
		<description><![CDATA[&quot;one in every six spams delivered worldwide, and capable of blasting 18 billion spam emails per day.&quot;

&quot;large email address lists — more than 350 GB&quot;

&quot;more than 2.3 billion addresses&quot;

They/He wasn&#039;t doing things by halves was he ROFL ;)

I make my daily bread through internet marketing and it&#039;s pretty much an open secret that many supposedly reputable  affiliate partners, both networks and vendors themselves, will tolerate non-compliant email traffic.  Often with the full knowledge and cooperation of the affilate manager.  

I&#039;m not talking only fly-by-night operators either but rather some of the largest names in the business.  Traffic that converts is a win/win for both parties are making money so you know ... it happens.  It should be noted that AFAIK most partners will NOT be happy with email campaigns that have no opt-out (even if they will allow unsolicited email to generate leads) and expect suppression lists to be applied and adhered to.

Most marketers operating along these guidelines will hire several VPS servers in Eastern EU, Asia and the Middle East that will ignore complaints - at least for a time - and use corporate solutions such as Interspire Email Marketer for example.  

They also use fairly well known tactics to minimise honeypots and people marking addresses as spam such as sending out a blast of innocent enough messages.  &quot;Hi, I&#039;ll be in town we should meet - Bob&quot; or the like.

Anyhow, the point of this rambling (sorry) post is it seems to be far more profitable to market legitimate products this way - dating sites leads that involve a free signup for example - than counterfeit pills and Rolexes if you look at the numbers of messages being sent.  I mean these small time blackhatters are not sending hundreds of thousands of messages per day let alone *billions*(!) and yet a few grand a day isn&#039;t uncommon. 

Why do you think these criminals only spam pills mainly?  They just can&#039;t being themselves to sell anything legal?]]></description>
		<content:encoded><![CDATA[<p>&#8220;one in every six spams delivered worldwide, and capable of blasting 18 billion spam emails per day.&#8221;</p>
<p>&#8220;large email address lists — more than 350 GB&#8221;</p>
<p>&#8220;more than 2.3 billion addresses&#8221;</p>
<p>They/He wasn&#8217;t doing things by halves was he ROFL <img src='http://krebsonsecurity.com/wp-includes/images/smilies/icon_wink.gif' alt=';)' class='wp-smiley' /> </p>
<p>I make my daily bread through internet marketing and it&#8217;s pretty much an open secret that many supposedly reputable  affiliate partners, both networks and vendors themselves, will tolerate non-compliant email traffic.  Often with the full knowledge and cooperation of the affilate manager.  </p>
<p>I&#8217;m not talking only fly-by-night operators either but rather some of the largest names in the business.  Traffic that converts is a win/win for both parties are making money so you know &#8230; it happens.  It should be noted that AFAIK most partners will NOT be happy with email campaigns that have no opt-out (even if they will allow unsolicited email to generate leads) and expect suppression lists to be applied and adhered to.</p>
<p>Most marketers operating along these guidelines will hire several VPS servers in Eastern EU, Asia and the Middle East that will ignore complaints &#8211; at least for a time &#8211; and use corporate solutions such as Interspire Email Marketer for example.  </p>
<p>They also use fairly well known tactics to minimise honeypots and people marking addresses as spam such as sending out a blast of innocent enough messages.  &#8220;Hi, I&#8217;ll be in town we should meet &#8211; Bob&#8221; or the like.</p>
<p>Anyhow, the point of this rambling (sorry) post is it seems to be far more profitable to market legitimate products this way &#8211; dating sites leads that involve a free signup for example &#8211; than counterfeit pills and Rolexes if you look at the numbers of messages being sent.  I mean these small time blackhatters are not sending hundreds of thousands of messages per day let alone *billions*(!) and yet a few grand a day isn&#8217;t uncommon. </p>
<p>Why do you think these criminals only spam pills mainly?  They just can&#8217;t being themselves to sell anything legal?</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: BrianKrebs</title>
		<link>http://krebsonsecurity.com/2012/08/inside-the-grum-botnet/comment-page-1/#comment-98485</link>
		<dc:creator>BrianKrebs</dc:creator>
		<pubDate>Mon, 20 Aug 2012 17:07:47 +0000</pubDate>
		<guid isPermaLink="false">http://krebsonsecurity.com/?p=16464#comment-98485</guid>
		<description><![CDATA[I tried to avoid getting too clicky with the buttons. But now that you mention it, hey I wonder what this button here do&lt;snip&gt;]]></description>
		<content:encoded><![CDATA[<p>I tried to avoid getting too clicky with the buttons. But now that you mention it, hey I wonder what this button here do<snip></snip></p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Nic</title>
		<link>http://krebsonsecurity.com/2012/08/inside-the-grum-botnet/comment-page-1/#comment-98461</link>
		<dc:creator>Nic</dc:creator>
		<pubDate>Mon, 20 Aug 2012 15:29:45 +0000</pubDate>
		<guid isPermaLink="false">http://krebsonsecurity.com/?p=16464#comment-98461</guid>
		<description><![CDATA[Wow... the kind of news you won&#039;t find anywhere else!

I&#039;m curious about the &quot;Ban Control&quot; feature which has SpamhousePBL (sic) and a few others listed.  What happens when those links are clicked?  I could guess, but guessing isn&#039;t worth much.]]></description>
		<content:encoded><![CDATA[<p>Wow&#8230; the kind of news you won&#8217;t find anywhere else!</p>
<p>I&#8217;m curious about the &#8220;Ban Control&#8221; feature which has SpamhousePBL (sic) and a few others listed.  What happens when those links are clicked?  I could guess, but guessing isn&#8217;t worth much.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: BrianKrebs</title>
		<link>http://krebsonsecurity.com/2012/08/inside-the-grum-botnet/comment-page-1/#comment-98443</link>
		<dc:creator>BrianKrebs</dc:creator>
		<pubDate>Mon, 20 Aug 2012 14:13:53 +0000</pubDate>
		<guid isPermaLink="false">http://krebsonsecurity.com/?p=16464#comment-98443</guid>
		<description><![CDATA[Nice! Hey, that&#039;s my site&#039;s IP address at Prolexic! Cool. 

Although, this would not be the first time, I guess.

From this piece: 

http://krebsonsecurity.com/2012/07/top-spam-botnet-grum-unplugged/

 Very soon after my investigative piece on Grum was published, KrebsOnSecurity.com was the target of a rather large distributed denial of service (DDoS) attack. I’ve recently learned that the attack was launched by the Grum botnet, suggesting that the findings were a little too close to home for the Grum botmaster(s).

Brett Stone-Gross, a senior security researcher for Atlanta-based Dell SecureWorks, analyzed a copy of the Grum malware from that time and found that it was instructing all infected systems to visit 94.228.133.163 (the IP address for krebsonsecurity.com). The nonexistent filename that the Grum bots were told to fetch from my site was “fuckingyou^^/9590899.php”.]]></description>
		<content:encoded><![CDATA[<p>Nice! Hey, that&#8217;s my site&#8217;s IP address at Prolexic! Cool. </p>
<p>Although, this would not be the first time, I guess.</p>
<p>From this piece: </p>
<p><a href="http://krebsonsecurity.com/2012/07/top-spam-botnet-grum-unplugged/" rel="nofollow">http://krebsonsecurity.com/2012/07/top-spam-botnet-grum-unplugged/</a></p>
<p> Very soon after my investigative piece on Grum was published, KrebsOnSecurity.com was the target of a rather large distributed denial of service (DDoS) attack. I’ve recently learned that the attack was launched by the Grum botnet, suggesting that the findings were a little too close to home for the Grum botmaster(s).</p>
<p>Brett Stone-Gross, a senior security researcher for Atlanta-based Dell SecureWorks, analyzed a copy of the Grum malware from that time and found that it was instructing all infected systems to visit 94.228.133.163 (the IP address for krebsonsecurity.com). The nonexistent filename that the Grum bots were told to fetch from my site was “fuckingyou^^/9590899.php”.</p>
]]></content:encoded>
	</item>
</channel>
</rss>

<!-- Performance optimized by W3 Total Cache. Learn more: http://www.w3-edge.com/wordpress-plugins/

Page Caching using memcached (User agent is rejected)
Database Caching 5/21 queries in 0.005 seconds using memcached
Object Caching 387/401 objects using memcached

 Served from: krebsonsecurity.com @ 2013-06-19 23:40:03 by W3 Total Cache -->