Vulnerabilities / Threats
3/30/2009
06:39 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Spam Is Making A Comeback, Google Finds

The volume of unwanted messages has been creeping upward at a rate of about 1.2% per day as spammers try to rebuild the infrastructure they lost at McColo.

Last November, the volume of spam coming into Google's Postini e-mail security service fell by 70% following the closure of McColo, a San Jose, Calif., Web hosting company that turned out to be more of a spam hosting company.

By the middle of this month, spam had rebounded and was back to its previous level, said Adam Swidler, senior product marketing manager for Google's message security team.

"Spammers have been rebuilding their botnets," he said, adding that Google plans to post details to one of its blogs on Tuesday.

Spam volume, said Swidler, has been creeping upward at a rate of about 1.2% per day as spammers try to rebuild the infrastructure they lost at McColo.

In 2008, the average spam growth rate was 1% per day, a record growth rate up to that point.

Spammers have been resorting to old tricks like malicious payloads, links to malicious Web sites, and messages that leverage interest in current events to bait their scams. Popular spam message themes these days tend to revolve around topics like the economy, job cuts, mortgages, refinancing, and holidays.

According to Swidler, spammers also are trying some new tricks. The most significant, he explained, is the use of location data to target message recipients with locally relevant content.

Typically, this is done by enticing a spam message recipient to click on a link. When an Internet user arrives at the Web site through a link in a spam message, the site reads the visitor's IP address. More often than not, IP addresses can be used to identify the general area where an Internet user resides. Armed with this information, the malicious Web site can serve up an attack tailored to appeal to viewers from a specific region, a technique that generally fools more people than an attack that's not targeted.

Compared with February, the incidence in March of e-mail payload viruses -- attached infected files -- has risen by a factor of nine.

Simultaneously, spammers are sending less spam on Sundays, a day previously popular with spammers, Swidler believes, because corporate IT departments often perform systems maintenance over the weekend.

The assumption appears to have been that more messages would get through during this period, but, said Swidler, "they weren't getting through as many as they thought they might."


2009 marks the 12th year that InformationWeek will be monitoring changes in security practices through our annual research survey. Find out more, and take part.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Cybersecurity's 'Broken' Hiring Process
Kelly Jackson Higgins, Executive Editor at Dark Reading,  10/11/2017
Ransomware Grabs Headlines but BEC May Be a Bigger Threat
Marc Wilczek, Digital Strategist & CIO Advisor,  10/12/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Search Cybersecuruty and you will get unicorn.
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.