Linux machines linked to spam

Although Linux holds only a small market share, Linux computers appear to send a disproportionate amount of spam compared to other operating systems, according to new research from Symantec's MessageLabs messaging security division. Symantec looked at spam from November 2009 through March and broke down what kind of operating system is on the computer that sent the spam.

Analysts do that by a method called passive fingerprinting, which involves analysing the network traffic of a remote host, which reveals that host's operating system. Since Windows holds more than 90 percent of the market, the lion's share of spam still comes from Windows machines, said Paul Wood, a MessageLabs intelligence analyst with Symantec.

Symantec found that 92.65 percent of spam came from Windows PCs, with 2.22 percent coming from other operating systems and nearly none from Apple computers.

But 5.14 percent of spam came from Linux machines, which is somewhat odd since Linux comprises about 1.03 percent of the operating system market, according to statistics quoted by Symantec in its latest MessageLabs Intelligence report for April.

Symantec then calculated a spam index, divided the percentage of spam by the market share of the OS to derive a ratio. The ratio is the likelihood of a computer running a particular operating system that will send spam. Linux is the highest at 4.99, nearly five times more than Windows at 1.01. Apple came in at zero, with other operating systems coming in at 1.08.

The Linux results were "certainly a lot higher than we expected," Wood said.

Windows computers tend to be the most targeted by malicious software designed to send spam, Wood said. Linux isn't as heavily targeted with malware "but that's not to say it's impenetrable," Wood said.

A plausible explanation for why the Linux ratio is so high is how ISPs allow their customers to send mail. Most ISPs do not allow their customers to send mail directly from port 25 to the Internet, as that was a method used to send lots of spam. Email is typically routed through the ISP's mail servers before being sent on to its destination.

ISPs use a lot of Linux in their server farms. Email headers, which can show the route of an email from sender to recipient, can be spoofed, but the last link in the chain is accurate. So if a Windows PC on an ISP's network is spamming, the spam would go through the ISP's Linux servers, contributing to the high Linux spam ratio, Wood said.

"We're hoping to follow that up with a little bit more in-depth research," Wood said.

Picture courtesy of barmala