Spam

What is spam?

Spam is the equivalent of physical junk mail and unsolicited telemarketing phone calls. It has become one of the largest nuisances to computer users for both home and business users.

Over the last few years, the use of and delivery of spam has evolved. Initially, spam was sent directly to computer users. In fact, spammers didn't even need to disguise the sender information. This early spam was easy enough to block – if you blacklisted specific sender or IP addresses, you were safe. In response, spammers began creating mock sender addresses and forging other technical information.

In the mid-1990s all email servers were open relay - any sender could send an email to any recipient. Starting in 2000, spammers began switching to high-speed Internet connections and exploiting hardware vulnerabilities. Cable and ADSL connections allowed spammers to send mass email messages inexpensively and quickly. In addition, spammers quickly discovered that many ADSL modems had built-in socks servers or http proxy servers. Both are utilities that divide an Internet channel between multiple computers. This important feature meant that anybody from anywhere in the world could access these servers since they had no protection at all. In other words, malicious users could use other people's ADSL connections to do whatever they pleased, including sending spam. Moreover, they could make the spam look as if it had been sent from the victim's IP address. Since millions of people worldwide had these connections, spammers had a field day. That was until hardware manufacturers began securing their equipment.

In 2003 and 2004 spammers sent the majority of spam messages from machines belonging to unsuspecting users. Spammers use malware to install Trojans on users' machines, leaving them open to remote use. Methods used to penetrate victim machines include:

• Trojan droppers and downloaders injected into pirate software which is distributed via file sharing P2P networks (Kazaa, eDonkey etc.).
• Exploiting vulnerabilities in MS Windows and popular applications such as IE & Outlook.
• Email worms

Anyone who has the client portion of a malicious program which controls the Trojan that has been placed on the victim’s machine controls that machine or network. The resulting networks are called bot networks, and are sold and traded among spammers.

Spammer techniques have evolved in response to the increased number of filters and the improved functionality of filters. As soon as security firms develop effective filters, spammers change their tactics to avoid the new spam blockers. This results in a predictable circular pattern, with spammers re-investing profits into developing new techniques to evade new spam filters.