Spam,
Spamming, and Scams
Mike
de Sousa, Director, AbleStable
Email is among the most commonly used communications
medium on the planet and it's a frustrating fact of
online life that if you have an email address, you
will be sent Spam. This article highlights the most
likely reasons for receiving Spam, and the kinds of
scams that are commonly practiced using Spam.
Your First Action: Delete
Don't open an email message with an attachment from
people you don't know or recognise, delete it. Spam
is at best dubious and most often fraudulent. Many
appear to come from a well known source. An example
of a Spam email claiming to be sent by AbleStable
follows (if you have inadvertently opened an attachment
from a Spam email, go to http://securityresponse.symantec.com/
where you will find information about the latest security
fixes)
| SPAM
EMAIL MESSAGE |
Subject:
Warning about your e-mail account.
From: management@ablestable.com
Dear user, the management of Ablestable.com
mailing system wants to let you know
that, Our main mailing server will be
temporary unavailable for next two days,
to continue receiving mail in these
days you have to configure our free
auto-forwarding service.
Please, read the attach for further
details. For security purposes the attached
file is password protected. Password
is "67282".
Best wishes,
The Ablestable.com team
http://www.ablestable.com
Content-Type: application/octet-stream;
name="Attach.zip"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="Attach.zip"
|
|
There was nothing wrong with AbleStable's mailing
system, we have never sent an email like this, nor
an attachment named 'Attach.zip'. The Spammers used
our address along with thousands of other companies
to undermine confidence and to infect computer systems.
Spam Indicators
Below you'll find six points that highlight how
the example email above could be recognised as Spam:
• The salutation
'Dear
user'
is generic.
• There are grammatical
errors: '...for
next two days...'
• The letter
case is incorrect:
'...wants to let you know that, Our main mailing...'
• The email requests
certain actions: '...configure
our free auto-forwarding service...'
• There's an
invitation to open an attachment: '...read
the attach for further details...'
• The attachment
has a generic name: Attach.zip
This is just one of many types of Spam that is sent.
Another common example appears to be an e-mail greeting
card but is actually a scam that downloads mass
mailing software onto the user's computer that does
the spammers' work for them.
Most Spam is mass-marketing, and the return on spam
is about .0001 per cent. As hundreds of millions
of messages are sent out, using an unsuspecting
corporate network, or simply piggy-backing onto
an individual's email client to carry the cost is
a very effective marketing tool for the unscrupulous.
Once again the best advice is to never open an attachment
unless you are absolutely certain who it's from
and what it's likely contents are.
The Usual Suspects
The most common email scams follow:
Get Healthy
Cure
an ill, get fit, and stay healthy by popping a pill.
Don't waste your money.
Get
Rich
An
email promises earnings of $1,000 a day and upwards
claiming that the business doesn't involve selling,
meetings, or personal contact with others. The majority
of these emails tempt the user into illegal pyramid
schemes masquerading as legitimate opportunities
to earn money.
Get
Turned On
Pornography is one of the biggest revenue earners
on the Internet, and the operators of porn sites
are among the biggest users of spam. Many Spam emails
attempt to lure people to subscribing to a pornography
site or service. Never pass on card details or any
other personally identifiable information (name,
email address etc) to a company or individual you
know nothing about.
Market to Millions
Buy
a list of email addresses to which you can send
your own bulk solicitations. Buy software that automates
the sending of email messages to thousands or millions
of recipients, or pay for a service that sends bulk
email solicitations on your behalf. It is highly
unlikely these email lists have been obtained legally.
It is very likely these scams will get you into
trouble as you become blacklisted as a Spammer and
the focus of criminal prosecution.
Follow
The Chain
Send
a small amount of money, say $5, to each of four
or five names on a list, replace one of the names
on the list with your own, and then forward the
revised message via bulk email. Chain letters are
almost always illegal, and nearly all of the people
who participate in them lose their money.
Work From Home
Do
a simple task and get paid. Don't trust an unsolicited
email that promises you'll make a shed load of money
working from home, it doesn't happen. You'll have
to pay an 'enrolment fee' and you'll never see it
again.
Get Something for
Nothing
Reply to an email and get some valuable
goods: a free holiday, TV, car etc. You're asked
to pay a fee to join a club, then told that to earn
the offered goods, you have to bring in a certain
number of participants. They're pyramid schemes
that inevitably collapse.
Enjoy Guaranteed Loans
and Credit
Get a credit card at an all time
low interest rate and great terms. You're asked
for personal information that will be used illegally
and the promised credit cards will never arrive.
Spamming Methods
Whenever
I pay for something online, it's guaranteed that
my junk emails increase shortly afterwards, this
despite the fact that I'm very choosy about who
I buy online from, and the assurance that my email
address will be safely locked away from the prying
eyes of others.
There are many other ways in which spammers acquire
your email address:
•
From posts to UseNet with your email address
•
From Mailing Lists (illegally sold by the
list owner)
•
From programs which spider through web pages
looking for email addresses
•
From various web and paper forms
• From printed
material email addresses (eg. professional directories
etc)
• From Domain
name registration forms
• From some chat
clients on PCs using IRC
• Via Internet
Browsers (dependant on configuration and browser
type)
• From IRC and
chat rooms
• AOL chat rooms
• AOL profiles
• From domain
contact points ('who-is' information)
• By guessing
& cleaning
• From white
and yellow pages
• By having access
to the same computer
• From a previous
owner of the email address
• Buying lists
from others
• By hacking
into sites
• From Domain
Name Monitoring
•
From fake Unsubscribe Invitations
•
From Virus Harvesting
Combating
Spam
Use
a different email account for buying products online.
Keep your preferred email address (private) for
personal use between friends and family, and create
a new email account (public) for online purchases
and form filling. Be disciplined and stick to this.
Don't make your 'private' email address public.
If you run a website, use an online form, instead
of your email address. If you like to post messages
on forums, make sure people don't have access to
your private email address. Furthermore, if you
post messages to Newsgroups (Usenet), use your 'public'
email address.
When
your bank or companies request your email address
to be entered on a paper form, provide your 'public'
email address.
Spam
and UK Law
The
unregulated and increasing processing of personal
data, including email addresses, caused sufficient
concern for the EU to pass the Data Protection Directive
(95/46/EC) in the mid 1990s. This established that
the processing and storage of personal information
must be carried out with consent of the individual
and with regard to the individual’s rights
to privacy.
The
provisions of this directive were passed into UK
law with the 1998 Data Protection Act of which AbleStable
is a registered participant. The EU Electronic Commerce
Directive (2000/31/EC), which was integrated into
UK law as the Electronic Commerce Regulations 2002-2008,
clearly states that ‘[the sender] shall ensure
that any unsolicited commercial communication sent
by him by electronic mail is clearly and unambiguously
identifiable.’ This law renders all spam that
attempts to masquerade as legitimate email illegal.
A
further tightening of the regulatory framework was
introduced in the Privacy and Electronic Regulations
2002-2008, implementing EU directive 2002-2008/58/EC. This
law prevents the sending of unsolicited email ‘unless
the recipient of the electronic mail has previously
notified the sender that he consents’.
Conclusion
Anyone
who uses the Internet and sends email will receive
Spam. Although I use a virus filter, I don't use a
Spam filter. I still prefer to see what's been sent
to my email box and filter it myself while the email
still sits safely on the server. Scanning the address
of the sender and subject gives enough information
about the likely source. If I'm curious I view the
text element without requesting the attachment. You
can do the same by downloading the Freeware program
Popcorn available
from our Freeware Area.
Whether you filter manually, trust a Spam filter to
do the job for you, or risk all and allow the Spammers
to flood your in-box, Spam will continue to be a burden
on the Internet until new technologies make all but
the most sophisticated Spammers leave for easier pickings.
Be savvy about Spam, it's a part of every net citizen's
daily experience, like countless germs floating in
the ether waiting for a victim.
|
|
|
|
