Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

Spam Takes a Vacation

South sea islands account for more spam per capita than anyplace else in the world

If you're thinking of heading to a quiet Pacific island in order to escape spam, forget about it. Some of those islands are worse junk email offenders than the U.S., China, or Russia.

According to a report issued yesterday by security researcher Sophos, some of the Pacific islands relay more spam per capita than any of their larger neighbors across the globe.

Pitcairn Island -- a tiny spot where the mutineers of the HMS Bounty were marooned in 1790 -- relays more spam per person than any other location in the world, according to Sophos. The island's population is about 50 people.

The rest of the top 10 offenders are, in order: Niue, Tokelau, Anguilla, the Faroe Islands, Monaco, Bermuda, Falkland Islands, Andorra, and Aruba.

"Between October-December 2007, the U.S. relayed far more spam than any other country, due to the sheer number of computers in the country that had been taken over by remote hackers," said Carole Theriault, senior security consultant at Sophos. "But when measuring spam emitted per capita, the results are very different.

"Most of the countries [on the list] have very small populations compared to the usual offenders, but their totals are sky-high when it comes to spam emitted on a per-person basis," Theriault said. "Just because your PC is located on a remote island in the South Pacific doesn't mean it's not contributing to the global spam problem."

By contrast, many countries with large populations actually have a fairly low rate of spam per capita. Of the top three spam-producing countries, Russia is No. 45 on the list of the per-capita list, the U.S. is No. 64, and China is No. 132, Sophos reported.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

  • Sophos plc

    Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Newest First  |  Oldest First  |  Threaded View
    Navigating Security in the Cloud
    Diya Jolly, Chief Product Officer, Okta,  12/4/2019
    Register for Dark Reading Newsletters
    White Papers
    Video
    Cartoon Contest
    Write a Caption, Win a Starbucks Card! Click Here
    Latest Comment: "The security team seem to be taking SiegeWare seriously" 
    Current Issue
    Navigating the Deluge of Security Data
    In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
    Flash Poll
    Rethinking Enterprise Data Defense
    Rethinking Enterprise Data Defense
    Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    CVE-2019-16770
    PUBLISHED: 2019-12-05
    A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack. If more keepalive connections to Puma are opened than there are threads available, additional connections will wait permanently if the attacker sends requests frequently enough.
    CVE-2019-19609
    PUBLISHED: 2019-12-05
    The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because it does not sanitize the plugin name, and attackers can inject arbitrary shell commands to be executed by the execa function.
    CVE-2019-16768
    PUBLISHED: 2019-12-05
    Exception messages from internal exceptions (like database exception) are wrapped by \Symfony\Component\Security\Core\Exception\AuthenticationServiceException and propagated through the system to UI. Therefore, some internal system information may leak and be visible to the customer. A validation m...
    CVE-2012-1105
    PUBLISHED: 2019-12-05
    An Information Disclosure vulnerability exists in the Jasig Project php-pear-CAS 1.2.2 package in the /tmp directory. The Central Authentication Service client library archives the debug logging file in an insecure manner.
    CVE-2019-16769
    PUBLISHED: 2019-12-05
    Affected versions of this package are vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of RegExp.prototype.toString() backslash...