How spammers identify their targets

Ask any Internet user what they hate most about being online and you will usually hear an earful about spam. Spam is considered by many to be the scourge of the Internet. It is certainly a costly problem, both in time and in the costs organizations expend to fight it.

Personally, I spent some time the last few weeks looking at spam and learning about how it is created and how it spreads. What I found was a very interesting and clever process that would-be spammers use to identify targets.

Spam is primarily spread in four ways:

The first, and least common, is spammers that obtain temporary legal and real accounts with ISPs. This is less common because most ISPs quickly shut down these accounts. There are a few ISPs that turn a blind eye, but they are likely already known and blacklisted.

The second method used to send spam is through compromised hosts, usually workstations and home computers on high-speed connections such as DSL or cable modems. These systems are usually compromised and have become part of large networks of zombie systems called bot-nets. The owners of these bot-nets then either use them to send spam or rent them to spammers who use them to send spam. In my research, the cost to send spam through these bot-nets was very cheap - usually only a few dollars per ten thousand addresses.

The third way spam is spread is using web forms. This is an aging strategy, but remains viable. The spammers scan the Internet for vulnerable web forms, then use them to send their spam. This is much less common than before as many organizations have learned this trick and hardened their forms. I tested this by placing a form that seemed vulnerable online. It took about 96 hours for it to be found and once they identified it, spammers began trying to abuse it within one hour. The attempts continued until I removed it. This suggests that the spammer community maintains a database or list of vulnerable forms. They appear to have a level of coordination and communication.

Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world

• Email
• Print
• Share
  • Slashdot
  • Digg
  • Stumble
  • Reddit
  • Newsvine