There is damning evidence that this activity has been going on there for way too long, and plenty of people in the security community have gone out of their way to raise awareness about this network, but nobody seems to care.”

– Paul Ferguson, a threat researcher with computer security firm Trend Micro

According to security experts, Web-hosting outfit McColo is responsible for enabling the broadcast of more than 75 percent of all spam globally. Its client list is a rogues gallery of bad-guy syndicates involved in everything from botnets to counterfeit pharmaceuticals and kiddie porn. So how is it that MoColo’s ISPs, Hurricane Electric and Global Crossing, were unaware of that until notified by a Washington Post reporter?

I’m not sure there’s a good answer to that question, though it would certainly be interesting to hear one. Almost as interesting as hearing the two ISPs explain away their network traffic from known criminal botnets Mega-D, Srizbi, Pushdo, Rustock and Warezov, all of which have their master servers hosted at McColo.

“We shut them down,” Benny Ng, director of marketing for Hurricane Electric, told the Post. “We looked into it a bit, saw the size and scope of the problem you were reporting and said ‘Holy cow!’ Within the hour we had terminated all of our connections to them.”

“Holy cow?” More like, “Holy cow, someone finally noticed we’re the preferred ISP of a massive criminal syndicate! What do we do?!?”

“ISPs can’t take the ‘I see nothing, I hear nothing’ approach to this content,” said Mark Rasch, a former cyber crime prosecutor for the Justice Department. “It’s a little bit like a landlord who owns a building and sees people coming in and out of the apartment complex constantly at all hours and not suspecting their may be drug activity going on. There are certain things that raise red flags, such as the nature, volume, source and destination of the Internet traffic, that can and should raise red flags. And to have so many third parties looking at the volume and content from this Internet provider saying ‘This is outrageous,’ clearly the people doing the hosting should know that as well.”

Consider this: Using the Storm botnet and 75,869 of its zombie members, researchers at UC Berkeley and UC San Diego broadcast 350 million pieces of spam peddling male enhancement supplements. All but 28 were ignored. “After 26 days, and almost 350 million e-mail messages, only 28 sales resulted,” the researchers explained. “Taken together, these conversions would have resulted in revenues of $2,731.88–a bit over $100 a day for the measurement period.”

That’s a conversion rate of well under 0.00001 percent. Laughable, right?

Not really. The supplements were priced at $100. And botnet overhead, as you might imagine, is quite low. Which means it’s entirely possible to turn a nice profit by managing just one sale per 12.5 million emails sent. Said the researchers, “Under the assumption that our measurements are representative over time, we can extrapolate that…Storm-generated pharmaceutical spam would produce roughly $3.5 million dollars of revenue a year.”

Unsettling, isn’t it? The thought of a million machines sitting in homes, schools and businesses around the country just waiting to spew out some nasty piece of malware or the latest “pump and dump” stock scheme. Depressing, too. Said Gadi Evron, who coordinates an international volunteer effort to fight botnets, “The war to make the Internet safe was lost long ago, and we need to figure out what to do now.”