Although the motivation may be the same there’s now very little to relate today’s spammers to the original daddy of unsolicited e-mail, according to technology security experts.
Some 30 years ago, Gary Thuerk, sent out what is widely credited as the first unsolicited marketing e-mail to about 400 of the more than 2,600 people using ARPANET, the predecessor of the Internet.
His invitation to an open house where he was selling computers eventually led to sales totaling $12 million but also earned him the ire of many ARPANET users and a stern warning from a major of a defense communication agency who wanted Thuerk to promise he would never send out such an e-mail again.
“There’s nearly nothing that can relate Thuerk to what spam has become today. Spam is now totally out of control,” said Dermot Harnett, principal analyst of the anti-spam engineering department of Symantec Corp.
Today, spam – the abuse of electronic messaging system to indiscriminately send unwanted bulk messages – accounts for as much as 87 per cent of the world’s e-mail, according to Symantec Corp.
Lost productivity caused by problems such as malware and identity theft linked to spam amount to more than $50 billion each year in dealing, says Chip Reeves, national director of Computer Troubleshooters Ltd., a U.S.-based computer service franchise.
Canadian businesses are likely to spend anywhere from $3 to $20 per user per year to combat spam, says Peter Firstbook, research director at analyst firm Gartner Inc.
While Thuerk’s spamming exploit may have been motivated by the desire to make money, Harnett or Symantec maintains that the former marketing executive differs from many of today’s spammers.
For one, Thuerk’s technique was very crude by today’s standards. Here’s a copy of his original spam message:
DIGITAL WILL BE GIVING A PRODUCT PRESENTATION OF THE NEWEST MEMBERS OF THE DECSYSTEM-20 FAMILY; THE DECSYSTEM-2020, 2020T, 2060, AND 2060T.
THE DECSYSTEM-20 FAMILY OF COMPUTERS HAS EVOLVED FROM THE TENEX OPERATING SYSTEM AND THE DECSYSTEM-10 COMPUTER ARCHITECTURE. BOTH THE DECSYSTEM-2060T AND 2020T OFFER FULL ARPANET SUPPORT UNDER THE TOPS-20 OPERATING SYSTEM.
THE DECSYSTEM-2060 IS AN UPWARD EXTENSION OF THE CURRENT DECSYSTEM 2040 AND 2050 FAMILY. THE DECSYSTEM-2020 IS A NEW LOW END MEMBER OF THE DECSYSTEM-20 FAMILY AND FULLY SOFTWARE COMPATIBLE WITH ALL OF THE OTHER DECSYSTEM-20 MODELS.
WE INVITE YOU TO COME SEE THE 2020 AND HEAR ABOUT THE DECSYSTEM-20 FAMILY AT THE TWO PRODUCT PRESENTATIONS WE WILL BE GIVING IN CALIFORNIA THIS MONTH. THE LOCATIONS WILL BE:
TUESDAY, MAY 9, 1978 – 2 PM
HYATT HOUSE (NEAR THE L.A. AIRPORT)
LOS ANGELES, CA…
“I’m not defending him, it appears he didn’t intend to inconvenience anyone,” said Harnett.
Unlike current spammers, Thuerk also did not make any attempt to hide his identity. “There was absolutely not attempt to obfuscate. Everything was upfront.”
Of course spamming has made great strides since then. Spammers have resorted to a multitude of ever changing strategies to bait computer users from using image spam to grabbing control of a user’s machine to create zombie botnets.
In Symantec’s monthly spam report the current favourite is NDR (non-delivery report) Spam Bounce.
Symantec observed that spammers have been sending bogus NDR reports using forged headers. “Spammers are taking advantage of user familiarity with office message systems that return full message copies with delivery failure reports, out of office messages and mail box quota messages,” said Harnett.
He said people that click on these messages are routed to a site selling products such a Viagra.
Spammers are also capitalizing on the popular Google brand to steal personal information from computer users.
In February, Symantec found that spammers have manipulated the parameters of Google’s uniform resource locator (URL) used for AdSense to redirect unsuspecting users to a spam Website.
There have also been reports of phishing e-mails purporting to come from Google AdWords a service that allows advertisers to intelligibly connect with individuals who are conducting searches using Google. In this method, the end user is encouraged to click on a link to purportedly update their billing information or renew their account. The user is actually led to a fraudulent Website where personal information is harvested.
Meanwhile, other spammers are taking advantage of the growing popularity of Web 2.0-based personal and professional social networking sites.
Professionals from various industries report that they have been receiving unsolicited e-mails that claim to be seeking their expertise and offer the opportunity to connect them with their peers.
One such e-mail starts out this way:
Welcome to our Inner Circle.
We are eager to consult with you. Our referral based program enables you to be reached by hundreds and thousands of professionals and your peers with the purpose of doing business with you…
Visit us at the address below and acquaint us with your history…
“This technique is taking advantage of the popularity of sites like Facebook and LinkedIn to harvest personal information and passwords from professionals and job seekers,” said Harnett.
Other techniques exploit the popularity of many amateur talent shows like Canadian Idol. Some spammers put out Internet ads for casting calls for actors, models, singers and extras. The aim is to gain e-mail address and other personal information.
One interesting technique discovered by Symantec this month offers recipients of the spam message an opportunity to scan through their instant messenger (IM) buddy list and highlight names of people they would like to be removed from it.
Instant messaging services are the preferred medium for many Internet-based social interactions, especially among young computer users. The spam invites users to click on a URL which will purportedly notify them who has blocked their name on an IM list. The site actually harvests usernames and passwords.
While e-mail security vendors continue to develop new tools, the best defense a user has is to resist the temptation to open suspicious messages, said Harnett.
Users and IT departments must install adequate e-mail filters and firewall protection and continually update these tools. User training must be held regularly and often to instill a culture of security consciousness and bring them up to date with the latest threats.
If you have been a victim of spam, Thuerk knows your pain. He was not spared from the monster he spawned. But after having his machine flooded with unwanted e-mail he changed his e-mail account and stayed off filling online forms. He has this advise for computer users: “Now I just give my phone number.”
Comment: [email protected]
