Day: July 23, 2024

Coincidence? 

It’s probably something like bunch of compromised servers were acting as routing agents and now that those links have been broken.

The IT professionals are looking closely at their systems and questioning all the excessive traffic. They’ve probably throttled it and are waiting to see who complains.

Since so many corporate desktop computers were affected, I’d bet a lot of the worm/phishing/bot software lurking on them has been purged as part of the cleanup.

CrowdStrike was supposed to be protecting corporate computer systems. Maybe this screwup has uncovered that CrowdStrike wasn’t performing exactly as advertised.

It wouldn’t be the first time vaporware was sold to Corporate America. Remember the DOT Com boom/bust? With few exceptions, there was nothing real, but venture capitalists spent billions on smoke & mirrors.

Maybe Corporate America and IT professionals should re-examine CrowdStrike and not be so single sourced? They’ll never listen to someone like me.

I don’t have 100K in student debt forgiven by President Poopy Pants. I also don’t have the right letters after my name, I could say, “The sky is blue,” and they’d dispute or ignore my observation.

A week later one of them would publish a paper on the likelihood that the sky is definitively blue. The byline would have the requisite A.A. B.S. Phd. Maybe there’d be an “et al” too.

For SPAM to drop 99% like it has in my case, suggests something other than CrowdStrike failing. Sure CrowdStrike is the overarching issue and the cleanup is long and tedious.

The question is, will enough people in the right positions ask questions about other functions that have suddenly changed? If SPAM/Phishing emails are being routed by corporate servers then the questions becomes how much of the corporation equipment and bandwidth is being consumed and effectively used for free?

The monetization of SPAM / Phishing is akin to Mining Bitcoin.

No corporation would allow their servers or systems to be used for Bitcoin mining for free. I’ve worked at companies that denied SETI’s distributed computing application from running on their equipment.

The SETI software was at one time a benign screen saver application that used idle computer resources for analysis of radio signals from space. The application itself was slick. It got out of your way when you needed to work. But if you were in a meeting, or at lunch, or home with your family, the system used your desktop CPU cycles to do work that SETI didn’t have the computing resources to do themselves. 

The result: SETI analyzed way more of the sky than they would have been able to in a reasonably short time. Signals of interest got to the right people and sophisticated analysis programs in weeks rather than being buried for years. All it cost was nothing more than leaving computers on, which Corporate America does so that the machines can be updated 24/7 anyway.

But some corporations wouldn’t give SETI anything for “Free”.

So why are these corporations giving SPAMMERS valuable resources for free?

The IT folks don’t pay attention to anything that is “working”. It’s a human trait, “if it works, don’t fix it.”  But that doesn’t mean you’re not supposed to be monitoring the systems, specifically network traffic.

The math is pretty straight forward. How much email is sent within the company. It’s logical to assume most corporate email would be internal. If you notice that your external mail packets are greater than your internal email packets and you’re not engaged in sending customer contact and retention emails then you probably need to track down who’s sending all that mail.

Sometimes it’s an employee, making a few extra bucks on the side. I busted some guys who were looking at and sending/selling porn from my testing lab network. I saw a weird spike in traffic and it was regular enough that I got curious.

Sometimes, the network traffic can’t be tracked to a specific computer or lab. Then you’ve got a more serious problem. 

I’m hoping that the IT folks worldwide, in the process of fixing the CrowdStrike problem are also fixing the SPAM problem.

In the mean time I’m going to enjoy my SPAM free life. I’ll be expecting my SPAM filters to blow up as soon as the CrowdStrike problem is resolved and everyone goes back to business as usual.

---

Later that day…

Ahhh, there we go, the SPAM is restarting. I’m sure it will be up to its normally annoying level in no time. Oh well it was really nice while it lasted.