The latest MessageLabs spam index reveals that relative to its market share, any given Linux machine is five times more likely to be sending spam than any given Windows machine. But what are the facts behind those headline grabbing numbers and can Windows really get off the hook that easily?
MessageLabs Intelligence Senior Analyst, Paul Wood has spoken out on the much discussed issue of spam being a Windows generated problem, noting that it is "more commonly sent from computers running Windows than from those running other operating systems" but adding "spam not identified as coming from botnets was seen in lower proportions coming from Windows machines than from known botnets". Yet when a spam index is applied, that is the likelihood that a particular computer is sending spam and calculated by comparing the ratio of spam from a given operating system to its market share, Linux becomes the bad guy. In the current spam climate, the spam index shows that relative to its market share, any given Linux machine is five times more likely to be sending spam than any given Windows machine. However, Linux machines are only responsible for 5.1 percent of all spam. MacOS is least likely to be sending spam, based both on its global contribution to spam and on an individual machine basis. The spam index suggests that there is almost no spam being sent from MacOS machines. However, 0.001 percent of the spam examined did originate from machines running MacOS.
Of course, this doesn't actually get Windows off the hook as apparently 84 percent of spam is now spewed forth by botnets. According to the latest Symantec MessageLabs Intelligence Report for April 2010, just five botnets are responsible for distributing 90% of the spam in circulation. Detailed analysis reveals that the Russian Federation and India are have the highest number of botnet infected machines in the world. It also further reveals that Rustock has surpassed Cutwail as the biggest botnet in terms of spam volume, although it has reduced the output of individual bots by 65 percent. Unfortunately Rustock has also increased the number of active bots by 300 percent, more than making up for that decreased output figure. Rustock itself remaining the single largest spambot, responsible for 32.8 percent of global spam. The top three Rustock-infected countries are India, USA, and Brazil.
The second largest source of global spam is Grum on 24 percent, with an increased bot count rising from 700,000 to just under a million. Mega-D accounts for 18 percent of global spam, Cutwail, on the other hand, has dropped from 2 million bots to 600,000 bots and churns out 4 percent of all spam by volume.
While spam has, for sure, become less of a problem for the end user who is now quite happy on the whole to trust whatever spam filtering is in place at their ISP or email provider to remove the filthy stain before it leaves a mark on their monitors and eyeballs alike, that does not mean that spam itself has gone away. In fact, quite the opposite. despite China cleaning up its spam relaying act there remain hundreds of billions of spam messages being shifted around the Internet every single day. Just because we don't see it, does not mean it is not there. Ask your ISP about spam and it will gladly tell you just what a strain it is on their resources, that it costs them dearly in terms of manpower, money and bandwidth, that they would love to be able to execute spammers at will. and that applies whether they are running machines under Windows, Linux or freakin' BeOS for that matter!
I'm a hacker turned writer and consultant, specialising in IT security. I've been a freelance word punk for over 20 years and along the way I have seen 23 of my books published, produced and presented programmes for TV and radio, picked up a bunch of awards and continue being a contributing editor with PC Pro - the best selling IT magazine in the UK .
One problem. Market share, which is a measure of machines sold and shipped with a particular operating system installed, has nothing to do with installed base when talking about freely downloadable and freely distributable operating systems. The metric cited is meaningless.
Not to mention the question of user intent. I'd be willing to wager more Windows users (per capita) do not intend to be sending spam, but malware is sending it for them, without their knowledge, whereas the Linux users are more likely intentionally running those botnets.
I bet they're counting spam sent out of public web based email accounts, that's where the majority of this "Linux" spam is coming from. That and intentional spam machines as cited above. Get google and other web mail providers to magically reduce the number of malicious users in their systems and you'd very likely see a drop in "Linux" spam.
@jwenting: I think it speaks poorly for Windows that their OS would allow the user to unwillingly become a pawn for some "super geek" that happenned to pick Linux as their OS. The users are victims, not the machines.