Industry


Ads by TechWords

See your link here


Eric Ogren's picture
Eric Ogren

Security Impact

Spam does work

One of the fascinating things about spam is how it requires technical skill in gaming security systems followed by psychological skill in provoking human responses. A recent note distributed to the Security Metrics mailing list referred to an interesting study conducted by Laura Freider and Jonathan Zittrain titled Spam Works: Evidence from Stock Touts and Corresponding Market Activity. It shows the effectiveness of spam in spiking trading volume for a stock, with price fluctuations that are profitable for spammers and not-so-much for spammees.

The gist of the study is that spam e-mail touting a little known stock actually drives enough people to buy that the stock price moves. A spammer that invests before unleashing the stock-touting spam reduces the risks of market timing and direction of price movement, resulting in returns of approximately 5.79% in only 2 days. Not too shabby. Those people reacting to the spam find themselves buying as the price is rising, selling as the price drops after the spam campaign completes, and losing roughly 5.48% of their money. Not too good. The effectiveness of this ploy is evidenced by Sophos measurements which has seen stock spam explode from a mere 0.8% of all spam in January 2005 to a robust 15.0% of all spam by July 2006.

On the spammer side, it shows a level of sophistication and professionalism. With this approach, there are no traceable links to back-end systems required (unlike the “buy this product” or “give me your identity” scams) and spammers can use gained experience points to improve their message with the next touted stock. There really is not a ton of risk here if the spammers account for SEC laws that they disclose their financial interest in the message. It is designed to capitalize on the greed of recipients, and it works!

One the spammee side, it is the same old story to be cautious. It blows me away that people would actually put their money into play based on a stock tip received from an unknown source on the Internet. I guess there is no accounting for the gullible. We’ve said it many times before, but it is always a good to remind ourselves:

1. Don’t open, don’t read e-mail from people who you don’t know. No need to make yourself vulnerable to malicious code or temptations of offers too good to be true.
2. Don’t believe everything you read. Be sure you know that the author is reputable – the fact that your friend forwarded you the e-mail does not vouch for its authenticity.
3. Don’t act on what you read. If the above two points don’t stop you, please chicken out before tossing your hard earned money away.

Remember TINSTAAFL: There Is No Such Thing As A Free Lunch

What People Are Saying

Spammers obtain their list

Spammers obtain their list of victims primarily by harvesting web pages. They use special address extraction software that will spider a site and extract all of the email addresses off its web pages. Entity encoded address obfuscation is one technique to protect your web pages against harvesting. It's popular and easy to do. Unfortunately, it doesn't work.

I had been a loyal and

I had been a loyal and paying customer of Spamarrest for some time, recently their service has been erratic and I lost a number of important messages. After not receiving adequate support I decided to cancel my recently renewed account and asked for a refund of the unused portion. Here is their response:
Hi David,

Thanks once again.

David, I am very sorry to tell you that we are not able to offer you a refund for your account. You may continue to use your Spam Arrest account till 2008-10-01 by reactivating the account.

I truly apologize for your inconvenience, David. Please do let me know if you need anything else.

Best Regards,
Peter
Technical Support Specialist
Spam Arrest

I disagree with you botn, if

I disagree with you botn, if everyone would send 1000 spams to the spammers address we would not have spam anymore. Even if they are using someone else computer it would convince that person to put a stop to them using his computer for spamming. It would also overload some networks that allow spamming. Good they need it.

Also open the spam and find out who it is going to and spam their abuse addressess or support address with at 1000 spams
FIGHT SPAM WITH SPAM

AFrank, I strongly recommend

AFrank, I strongly recommend people not to use SpamArrest.

This service replies to spam. As you may know, spammers don't send email "from" their own email addresses. Instead, they forge other people's addresses. Hence, SpamArrest sends your challenge replies to innocent 3rd parties. It's a big and growing problem.

A growing number of email administrators treat these "misdirected challenges" as abuse of the Internet. They perceive that services like SpamArrest send what is effectively spam. By using SpamArrest, you are therefore being seen as a spammer, and will no doubt find yourself on lists of spammers. This may mean that your email will have more and more trouble getting through. It will also mean that your challenges won't get through, so you won't be able to receive email from new email addresses.

I urge you to stop using SpamArrest so that I and other email users won't have to deal with the spam you're indirectly generating. You'll also benefit from actually receiving the email you wanted to get.

As an alternative, may I recommend a good conventional spam filter, which will lose far fewer legitimate messages, while filtering out practically all the spam.

More at:

Spamarrest

Since joining spamarrest I've followed their stats page for my account and my spam has increased in just over two years 300% from when I joined. Bill Gates said he would solve the spam problem in 2006 but really Spam Arrest did years ago at least for me. I don't see spam decreasing anytime soon so I'm keeping my Spam Arrest account.