Vulnerabilities / Threats

3/30/2009
06:39 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Spam Is Making A Comeback, Google Finds

The volume of unwanted messages has been creeping upward at a rate of about 1.2% per day as spammers try to rebuild the infrastructure they lost at McColo.

Last November, the volume of spam coming into Google's Postini e-mail security service fell by 70% following the closure of McColo, a San Jose, Calif., Web hosting company that turned out to be more of a spam hosting company.

By the middle of this month, spam had rebounded and was back to its previous level, said Adam Swidler, senior product marketing manager for Google's message security team.

"Spammers have been rebuilding their botnets," he said, adding that Google plans to post details to one of its blogs on Tuesday.

Spam volume, said Swidler, has been creeping upward at a rate of about 1.2% per day as spammers try to rebuild the infrastructure they lost at McColo.

In 2008, the average spam growth rate was 1% per day, a record growth rate up to that point.

Spammers have been resorting to old tricks like malicious payloads, links to malicious Web sites, and messages that leverage interest in current events to bait their scams. Popular spam message themes these days tend to revolve around topics like the economy, job cuts, mortgages, refinancing, and holidays.

According to Swidler, spammers also are trying some new tricks. The most significant, he explained, is the use of location data to target message recipients with locally relevant content.

Typically, this is done by enticing a spam message recipient to click on a link. When an Internet user arrives at the Web site through a link in a spam message, the site reads the visitor's IP address. More often than not, IP addresses can be used to identify the general area where an Internet user resides. Armed with this information, the malicious Web site can serve up an attack tailored to appeal to viewers from a specific region, a technique that generally fools more people than an attack that's not targeted.

Compared with February, the incidence in March of e-mail payload viruses -- attached infected files -- has risen by a factor of nine.

Simultaneously, spammers are sending less spam on Sundays, a day previously popular with spammers, Swidler believes, because corporate IT departments often perform systems maintenance over the weekend.

The assumption appears to have been that more messages would get through during this period, but, said Swidler, "they weren't getting through as many as they thought they might."


2009 marks the 12th year that InformationWeek will be monitoring changes in security practices through our annual research survey. Find out more, and take part.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
How to Attract More Women Into Cybersecurity - Now
Dawn Kawamoto, Associate Editor, Dark Reading,  1/12/2018
AI in Cybersecurity: Where We Stand & Where We Need to Go
Raffael Marty, VP Security Analytics, Sophos,  1/11/2018
What Can We Learn from Counterterrorism and National Security Efforts?
Adi Dar, Chief Executive Officer of Cyberbit,  1/12/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The Year in Security: 2017
A look at the biggest news stories (so far) of 2017 that shaped the cybersecurity landscape -- from Russian hacking, ransomware's coming-out party, and voting machine vulnerabilities to the massive data breach of credit-monitoring firm Equifax.
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.