Zombie Monitoring Tool Released

Anti-spam firm CipherTrust has made available a new tool for tracking zombie activity in real-time. ZombieMeter lets users monitor hijacked spam sending systems worldwide.

It provides statistical information regarding which countries are currently the most active. CipherTrust uses its base of over one thousand enterprise level customers to gather data for the monitoring program.

It doesn't specifically say what technology is used to determine which spam was sent from malicious software ridden systems, as opposed to traditional spamming techniques. It may be possible to make this distinction by compiling data from multiple email content filter installations. If the same spam message is simultaneously originating from multiple sources, it could be being sent from a zombie.

The tool only tracks general zombie activity, and not specific compromised systems. System administrators can usually tell if a zombie is installed on their network by tracking excessive SMTP activity. Some service providers will disable network access if they believe a system has been compromised. By sending highly randomized email from multiple sources, zombies confound many traditional efforts to filter e-mail.

Users most often infect themselves by opening an infected message or by way of a security flaw in their browser or operating system. Not all anti-virus software reliably detects this type of malicious software. Users can help minimize the risk of exposure by deploying the latest security updates.

Back