Researchers hijack Storm botnet for spam study

It takes 12.5 million spam emails to get one response, according to a month-long study where Californian researchers pretended to be spammers.

The researchers from the University of California campuses at Berkley and San Diego took control of some 75,000 machines via the Storm botnet earlier this year, before it was effectively dismantled.

They also set up their own fake pharmaceutical web site to direct people to, in order to see how much money spamming networks actually make and how many people really click links in emails offering cheap drugs and anatomical enhancements.

"By infiltrating its command and control infrastructure parasitically, we convinced it to modify a subset of the spam it already sends, thereby directing any interested recipients to servers under our control, rather than those belonging to the spammer," the researchers wrote in their report.

The group sent 350 million messages over 26 days, garnering just 28 sales for a conversion rate of under 0.00001 per cent. All but one of the sales were for "male-enhancement products" at an average cost of $100 (62.50).

The researchers stressed that their study used just 1.5 per cent of the Storm botnet, suggesting the real value of that malicious network ranges from about $7,000 (4,375) to $9,500 (5,938) each day, or about $3.5 million (2.19 million) a year. They noted this was less than the "millions of dollars a day" some security researchers have suggested such botnets are worth, but said it was "certainly a health enterprise."

However, the cost of sending out such spam would be higher than the return yet spammers still continue, so they must be making a profit.

While some email campaigns are clearly run off the botnet at a fee the spammers paying for access to the mailing service the researchers suggested most campaigns are likely run by the creators of the Storm botnet itself. This is backed up by the similarity in targeted email domain names between the spam campaigns and mailouts designed to spread the botnet itself, they said.

If that is indeed true, continuing to secure email could make spamming unprofitable. "The prot margin for spam (at least for this one pharmacy campaign) may be meagre enough that spammers must be sensitive to the details of how their campaigns are run and are economically susceptible to new defences," the researchers wrote.