Vulnerabilities / Threats
3/30/2009
06:39 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Spam Is Making A Comeback, Google Finds

The volume of unwanted messages has been creeping upward at a rate of about 1.2% per day as spammers try to rebuild the infrastructure they lost at McColo.

Last November, the volume of spam coming into Google's Postini e-mail security service fell by 70% following the closure of McColo, a San Jose, Calif., Web hosting company that turned out to be more of a spam hosting company.

By the middle of this month, spam had rebounded and was back to its previous level, said Adam Swidler, senior product marketing manager for Google's message security team.

"Spammers have been rebuilding their botnets," he said, adding that Google plans to post details to one of its blogs on Tuesday.

Spam volume, said Swidler, has been creeping upward at a rate of about 1.2% per day as spammers try to rebuild the infrastructure they lost at McColo.

In 2008, the average spam growth rate was 1% per day, a record growth rate up to that point.

Spammers have been resorting to old tricks like malicious payloads, links to malicious Web sites, and messages that leverage interest in current events to bait their scams. Popular spam message themes these days tend to revolve around topics like the economy, job cuts, mortgages, refinancing, and holidays.

According to Swidler, spammers also are trying some new tricks. The most significant, he explained, is the use of location data to target message recipients with locally relevant content.

Typically, this is done by enticing a spam message recipient to click on a link. When an Internet user arrives at the Web site through a link in a spam message, the site reads the visitor's IP address. More often than not, IP addresses can be used to identify the general area where an Internet user resides. Armed with this information, the malicious Web site can serve up an attack tailored to appeal to viewers from a specific region, a technique that generally fools more people than an attack that's not targeted.

Compared with February, the incidence in March of e-mail payload viruses -- attached infected files -- has risen by a factor of nine.

Simultaneously, spammers are sending less spam on Sundays, a day previously popular with spammers, Swidler believes, because corporate IT departments often perform systems maintenance over the weekend.

The assumption appears to have been that more messages would get through during this period, but, said Swidler, "they weren't getting through as many as they thought they might."


2009 marks the 12th year that InformationWeek will be monitoring changes in security practices through our annual research survey. Find out more, and take part.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8142
Published: 2014-12-20
Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys w...

CVE-2013-4440
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 generates weak non-tty passwords, which makes it easier for context-dependent attackers to guess the password via a brute-force attack.

CVE-2013-4442
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which makes it easier for context-dependent attackers to guess the numbers.

CVE-2013-7401
Published: 2014-12-19
The parse_request function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service (crash) via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS method.

CVE-2014-2026
Published: 2014-12-19
Cross-site scripting (XSS) vulnerability in the search functionality in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6.0 Online Update 10 allows remote attackers to inject arbitrary web script or HTML via the request parameter.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.