Traffic Analysis on a Mass Mailing Worm and DNS/SMTP

From researchers in Japan and found on the website of Yasuo Musashi, Traffic Analysis on a Mass Mailing Worm and DNS/SMTP [PDF], a presentation by Yasuo Musashi, Kenichi Sugitani, and Ryuichi Matsuba. Now, what they've done is interesting and so simple it's beautiful. It turns out that aside from a large number of mails that all look similar and are sent bypassing the local SMTP relay, mass mailer worm infected hosts also generate a large number of DNS requests for MX records of their targets. They don't do this under normal operations (where they relay mail through a local SMTP server that they get an A record for), so you can easily measure this and detect a mass mailer infected system. Using the technique and principles described in this presentation (prior to finding it, I might add), I built a small prototype in Python using libpcap and was able to reliably detect mass mailer infected hosts within a few minutes. A simple solution that doesn't require much heavy analysis. Unfortunately, I am unable to share the code with the general public at this time.