Vulnerabilities / Threats
3/30/2009
06:39 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Spam Is Making A Comeback, Google Finds

The volume of unwanted messages has been creeping upward at a rate of about 1.2% per day as spammers try to rebuild the infrastructure they lost at McColo.

Last November, the volume of spam coming into Google's Postini e-mail security service fell by 70% following the closure of McColo, a San Jose, Calif., Web hosting company that turned out to be more of a spam hosting company.

By the middle of this month, spam had rebounded and was back to its previous level, said Adam Swidler, senior product marketing manager for Google's message security team.

"Spammers have been rebuilding their botnets," he said, adding that Google plans to post details to one of its blogs on Tuesday.

Spam volume, said Swidler, has been creeping upward at a rate of about 1.2% per day as spammers try to rebuild the infrastructure they lost at McColo.

In 2008, the average spam growth rate was 1% per day, a record growth rate up to that point.

Spammers have been resorting to old tricks like malicious payloads, links to malicious Web sites, and messages that leverage interest in current events to bait their scams. Popular spam message themes these days tend to revolve around topics like the economy, job cuts, mortgages, refinancing, and holidays.

According to Swidler, spammers also are trying some new tricks. The most significant, he explained, is the use of location data to target message recipients with locally relevant content.

Typically, this is done by enticing a spam message recipient to click on a link. When an Internet user arrives at the Web site through a link in a spam message, the site reads the visitor's IP address. More often than not, IP addresses can be used to identify the general area where an Internet user resides. Armed with this information, the malicious Web site can serve up an attack tailored to appeal to viewers from a specific region, a technique that generally fools more people than an attack that's not targeted.

Compared with February, the incidence in March of e-mail payload viruses -- attached infected files -- has risen by a factor of nine.

Simultaneously, spammers are sending less spam on Sundays, a day previously popular with spammers, Swidler believes, because corporate IT departments often perform systems maintenance over the weekend.

The assumption appears to have been that more messages would get through during this period, but, said Swidler, "they weren't getting through as many as they thought they might."


2009 marks the 12th year that InformationWeek will be monitoring changes in security practices through our annual research survey. Find out more, and take part.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2006-1318
Published: 2014-09-19
Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, Office 2004 for Mac, and Office X for Mac do not properly parse record lengths, which allows remote attackers to execute arbitrary code via a malformed control in an Office document, aka "Microsoft Office Control Vulnerability."

CVE-2012-2588
Published: 2014-09-19
Multiple cross-site scripting (XSS) vulnerabilities in MailEnable Enterprise 6.5 allow remote attackers to inject arbitrary web script or HTML via the (1) From, (2) To, or (3) Subject header or (4) body in an SMTP e-mail message.

CVE-2012-6659
Published: 2014-09-19
Cross-site scripting (XSS) vulnerability in the admin interface in Phorum before 5.2.19 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

CVE-2014-1391
Published: 2014-09-19
QT Media Foundation in Apple OS X before 10.9.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file with RLE encoding.

CVE-2014-3614
Published: 2014-09-19
Unspecified vulnerability in PowerDNS Recursor (aka pdns_recursor) 3.6.x before 3.6.1 allows remote attackers to cause a denial of service (crash) via an unknown sequence of malformed packets.

Best of the Web
Dark Reading Radio