Linux – Weird CBL blacklisting (cutwail spambot ?!)

Most malware discovery advice is focused on getting users to run security checks on their computers...you don't mention your exact circumstances, but it sounds like you're running a school network of some kind? Which of course adds a wonderful layer of head-slapping to address the issue as it will cause all sorts of added frustration.

So the first approach to try is education of users. Posters, announcements, etc. Of course most users will probably ignore this, but it can raise awareness. Seeing as Torpig apparently disables AV software, make users aware of the effects of this malware (stealing bank information) and give links to online scanners and sponsor handing out burned discs of bootable malware detection software, or sponsor campus virus-checking events with IT to go to dorms and scan or bring laptops to a location for free malware checking. With appropriate waivers for responsibility of the effects of wiping malware off, of course.

Next I'd investigate the routers. Decent routers should have the ability to report network traffic via SNMP, and you can check them for unusual traffic patterns. You should be able to tell when there are unusual spikes in traffic or check for anomalies, and some software may be able to alert you to unusual activity. Some bosses may see this as a waste of time, checking over reports and status of equipment that seems to be working fine. In my opinion it is never a waste to be familiar with how things run; sometimes you know your car is going to have issues because something doesn't "feel right" or "sound quite right," the same goes with your network.

Do you proxy your traffic? What are you using for proxy? We had a FreeBSD Squid box for awhile that caught malware infection on a user's computer because I noticed something odd in the ARP tables originating from that user's workstation; his malware was broadcasting all sorts of IP's trying to hit other targets within our own network and it was showing up in my status checks on the proxy server health.

Torpig apparently uses HTTP commands to connect to control points. The proxy may help in that as well, if it's logging activity. If you can find some of the IP's that torpig connects to, you may be able to grep your logs for connections from XYZ machine to lock it down really quickly. Proxies that filter should also be able to automatically block the traffic from reaching the C&C servers as well.

Reading an analysis of the bot may help give you some ideas. See http://www.cs.ucsb.edu/~seclab/projects/torpig/torpig.pdf for a study on the malware's behavior.

Another thing to try; email other universities that have this issue and ask them what they're doing to detect the traffic. See an example of someone advertising that they're analyzing student traffic and see if you can contact their IT people; they'll most likely be willing to share hints. http://cnc.ucr.edu/security/announcements/2010_03_04_mebroot.html

Honeypots...I wouldn't be against putting this in your network just because it sounds like you have students and computers you can't control. Stick a few honeypots on the network, see what hits it gets. I don't know if torpig will be detected with it, but you'll probably find it useful to have for other malware; stick SNORT or other IDS on it and check up on it frequently (and email you alerts).

The last thing you might consider, but this is entirely dependent on your situation, is running something like SAINT or Nessus on your network to check machines for vulnerabilities. This could be a big drain on your network resources, however, and some people probably won't appreciate their machines being scanned and you may have issues if this isn't spelled out in policy. Also it depends on the size of your network.

There are tools that can keep you apprised of what's on your network such as spice network's tool and LanSweeper.

Other than that all I can think of off the top of my head is to run a full audit of all servers that you DO have some control over on the network, run the vulnerability framework tools against them to audit for possible security issues, and tighten your border routers to restrict all outgoing ports that aren't necessary for users to have outgoing traffic from so you can restrict activity from malware on unusual ports. At a minimum you might want a machine or appliance that monitors for unusual activity from odd ports and have it sent alerts for you to follow up on and contact other IT departments in other schools similar to yours to see how they address this issue.

The techniques I use to identify spam have little to do with volume. They are bases more on how well the server complies with standards and best practices. 5,000 is a relatively small mailing list and shouldn't trigger spam classification. Getting your server correctly configured to use its FQDN and having PTR configured so you pass rDNS validation will get you most of the way there.

The spam filter I use triggers on content and looks for indication that the message is similar to previously seen spam. Well formatted text not selling things in a spamish way is unlikely to be blocked by the filter.

During some research into the incoming spam I posted an article on Running an Email Server. It is a bit of a rant at marketers who do everything they can to look like they are sending spam. It is mostly mailing lists (including major mailing organizations) and automated systems (including airlines, banks, and others) that tend to be poorly configured. My article on Detecting Email Forgery (which a lot of spam attempts) may also be helpful.

EDIT: If everything else is configured correctly, you should be able to send batches of up to 100 using a single connection. Your mail server should handle the batching for you if you get ahead of it.