See your link here
Spam volumes -- what's REALLY going on?
6 comments- IT TOPICS:Emerging Technology, Government & Regulation, Networking, Security
The sky is falling! The sky is falling! Spam has doubled / spammers are winning / spam is 80% of all mail / 90% of mail / 110%, etc. etc. etc...
Yawn.
I'm getting bored with self-serving anti-spam vendors flinging dubious statistics around. Yes, spam volumes have increased recently, but doubled? No.
Here's my take on what's happening.
The growth in spam is chiefly down to two factors:
- Demand-side -- stock kiting gangs wanting access to more and more sending capacity
- Supply side -- new, bigger botnets with more sophisticated command and control mechanisms, which are more resistant to being shut down and can send fewer messages per zombie (because they're bigger), so they stay under the radar longer
This growth is compounded by bad statistics, which make the growth seem bigger than it actually is:
- New botnets are spewing spam from PCs not on blacklists, so a smaller proportion of spam gets rejected (and thus more ends up in quarantines).
- New botnets are resistant to anti-spam techniques such as greylisting (because they have real, autonomous MTAs), so a smaller proportion of spam gets rejected (and thus more ends up in quarantines).
- New botnets are employing content-morphing tricks, which are fooling many vendors' content filters. So more spam reaches the inbox (and naive commentators wrongly assume that a doubling of spam in the inbox equals a doubling of spam on the Internet).
As a side note, the image spam messages tend to be about 10x bigger than "normal" (median 30K compared with 3K), so spam volumes are now much higher in terms of numbers of bytes on the wire.
Some anti-spam vendors are coping quite adequately with spammers' new techniques, but either their PR departments don't seem to be able to get the word out, or the news media are more interested in shock-horror sky-falling-pictures-at-11 stories. As I mentioned during my Thanksgiving debacle, Symantec/Brightmail seems to be doing a very good job.
I run my own spamtraps and I also trust data from Commtouch and MessageLabs. My reading is that spam volumes increased measurably about a month ago, but not to the extent that Chicken Licken would have us believe.
Richi Jennings is an independent technology and marketing consultant, specializing in email, blogging, Linux, and computer security. A 20 year, cross-functional IT veteran, he is the main author of Computerworld's IT Blogwatch and an analyst at Ferris Research. Contact Richi at cw@richi.co.uk.
Print
Email this
Digg this
