Wall St was down 94 overnight, its biggest fall in a month, while the local market is down 66.
What is spam and where does it come from?
|
If you think spam is about selling the products being advertised, in most cases you’d be wrong. The real spam business is very different. By definition, spam is any unsolicited or indiscriminate bulk message sent electronically. That covers email advertising, yes, but also messages sent by SMS or instant messaging, or posted in blog comments. It also covers non-commercial content such as political or religious messages, or attempts to defraud you or others, or to infect your computer. Those last few are where the real money lives. An estimated 94% of all email is spam: over 100 billion messages every day. Some of that is advertising by businesses who don’t realise it’s wrong or, imagining a sudden surge of business, don’t care. But over 80% of spam is sent by fewer than 200 people using networks of “borrowed” computers called botnets. These zombie computers have been infected with a virus or Trojan horse that hands control of the computer to the bad guys. Ironically, that infection is itself usually delivered via spam, or surreptitiously installed by an infected website promoted by spam. All this happens on a vast scale. Internet pioneer Vint Cerf reckons up to a quarter of all computers on the internet are already part of botnets, their owners unaware. In April 2008 it was claimed the Kraken botnet consisted of 495,000 zombie computers capable of sending 9 billion spam messages a day. In late 2007, the Storm botnet may have been even larger, with more than a million zombies. The amount of spam we receive each day varies wildly as new botnets come online or are dismantled, or as spammers learn new tricks to fool the spam filters. At least until the spam-fighters work out a countermeasure. The Srizbi botnet was around 450,000 computers, but could send 60 billion messages a day. When internet hosting provider McColo was shut down in November 2008, taking Srizbi’s controlling computers with it, global spam volumes dropped 75% overnight. In 2008, investigators infiltrated Storm and reported that 350 million spam emails resulted in a mere 28 sales, a conversion rate well under 0.00001%. “All but one were for male-enhancement products and the average purchase price was close to $100,” the researchers said. Total revenue: $2,731.88. Yet this is such a tiny percentage of Storm’s capacity that it translates into potential annual revenues of $3.5 million, even without repeat sales. Not bad for using hacked computers for free. That all still assumes sales are the aim. As Joe St Sauver pointed out in 2003, though, “the mechanism by which [spammers] make money often has nothing to do with the sale and delivery of an actual product or service.” Often, the aim is to gather your name, address, credit card details and anything else which allows the attacker to steal your identity. Identity theft and the resulting fraud is now bigger business globally than the illegal drug trade. Heard of the Nigerian Scam? Or of phishing? Another possibility is pump and dump stock market fraud. Sending spam is illegal in Australia. The Spam Act 2003 applies when there’s any “Australian link” — that is, if the message is sent from or commissioned here, or if the recipient accesses their address from Australia. You can only send commercial messages with the recipient’s explicit consent, and only if the message identifies the sender and has a functioning unsubscribe facility. There’s a few narrow exemptions for “implied consent”, such as when there’s an established, ongoing business relationship, or for purely “factual messages”. There are also some exemptions for government, political parties, religious organisations and registered charities, as well as educational institutions contacting current or former students. Hacking other people’s computers to send spam is a crime, of course, as is engaging in stock market or credit card fraud via any medium. Bonus video: Why is it called “spam” anyway? Blame Monty Python’s Flying Circus. |
|
|
2 Comments
What happened to the proposal, yonks ago, to charge everyone 0.1 cent for every email they send? Wouldn’t that close down spam in a year by encouraging emailers to delete Trojan horses hiding on their computers?
@Gavin Moodie: The “charge for email” approach is one of a number of naïve suggestions for solving the spam problem which keeps getting floated. Short answer: it wouldn’t work, for many reasons. The most important:
1. The internet has no central trusted authority to whom the money would be paid.
2. People have been sending email for “free” for 40 years. (Or at least email is seen as just one kind of data transfer for which they already pay.) A new charge specifically for one kind of data transfer would never get up.
3. People already fail to keep their computers free of infection, even though they can already be penalised by paying for the data spam uses, or be cut off by their ISP. This is just another way of punishing the innocent after the spam has already been sent.
4. Spammers already use stolen credit card numbers to fund other aspects of their operations — they’re criminals, remember! — so they’d have no qualms about using them to pay this new charge too.
In fact, so many people have suggested this and other unworkable ideas before that there’s actually a parody (US-centric) form letter response…
Some people have too much time on their hands.