Years ago the spammers would send their spam out from a single or even several computers. They might forge the “from” address to make it not as obvious where it was coming from, but it was relatively easy to “blacklist” ip addresses that were producing spam. Often they would send the original spam through an “open relay” — that is, an email server that accepts email for relaying without regard for where it’s coming from or where it’s going.
These days email servers are pretty much locked down — they will only accept email for addresses they know how to deliver. And with the CanSpam law, it would be pretty unwise to send out spam where the email could easily be traced back to the sender. It would be just asking for fines and jailtime.
Nowadays, spam is mostly sent from botnets. A botnet is a collection of virus-infected computers that can be controlled by an individual or group. Because the ‘bots are usually running behind some form of firewall, they can’t be directly controlled from the internet. Instead they are designed to run autonomously, meaning they’re smart enough to “phone home” — that is, to connect to any of a group of controllers for instructions and data as well as uploading data that the bot may have collected. Botnets are crafted to be really hard to detect, as well as being really hard to identify the perpetrators.
Botnets are used for more than just sending out spam. They also collect from the host computers things like email addresses, personal data like credit card information, and even intellectual property from businesses. They can also be used to try to infect computers on the same network using security holes in Windows. Among other things they can be used to mount a “denial of service” attack, by using thousands or even millions of ‘bots to flood websites or internet services with so much traffic that it clogs their networks or overloads their servers. There was a widely publicized incidence of this recently with the Facebook/Twitter attack that took place in August of 2009 (“facebook twitter attack“) that was apparently contracted to botnet operators by the Russian government.
The good news about botnets is that although they have tended to live free on the net for several years, researchers and ISP’s (Internet Service Providers) have begun to fight back and have successfully shut down at least two botnets. Be assured this is not a problem that will be solved overnight: like cockroaches the cybercriminals will find ways to adapt and evade, but at least for now the researchers are making some headway on clobbering the botnets.
Here’s a couple articles on successful botnet elimination from “DarkReading” and “FireEye“.
The thing you need to do to avoid having your computer join a ‘botnet is to make sure you have a good anti-virus, anti-spyware program running on your computer. I don’t recommend the free ones — who’s paying the person that has to constantly be on the watch for new viruses?