"Spam! Spam! Spam! Spam! - Spam! Spam! Spam! Spam!"

Good Day Readers:

Ever wonder about the derivation of "spam" to describe junk e-mail? Could this be it?

Sincerely,
Clare L. Pieuk

__________________________________________________
The changing landscape of online fraud
Long life spam
As spammers find their e-mails blocked, they are trying other tactics. Expect no respite
November 18, 2010 From The Economist print edition
WHEN Mark Zuckerberg, the boss of Facebook, presented its new messaging service on November 15th, he praised one feature in particular: the “social inbox”, which would catch spam or other unwanted messages. “Because we know who your friends are, we can put in really good filters to make sure you only see things you care about,” he said, with unwarranted confidence.

Spammers are moving onto social-networking sites such as Facebook because they find e-mail increasingly unrewarding. Data from Cisco, which makes networking gear, show the volume of e-mail spam began declining slowly in late 2009 (see chart) and by almost half in the past three months, after the authorities disabled spam networks in Russia and the Netherlands. One reason is that online-security firms have worked on every bit of the chain, from the content of junk e-mails to their sender, with the result that they stop more than 98% from reaching its target. First they blocked e-mails containing suspect words or links. Then they blacklisted addresses used by spammers. In response, senders started using botnets (networks of otherwise innocent computers). But security firms have now got better at spotting patterns in the spammers’ output.

Spammers also need lots of addresses to evade the filters. They may buy as many as 10,000 domain names for a single scam. That is getting harder. After a flood of dubious .cn registrations from Russia, China has imposed tough checks that make applications by foreigners harder. The White House turned to internet registrars when it convened a meeting in September about how best to crack down online pharmaceutical fraud. Garth Bruen, who runs KnujOn, a web-security firm (read it backwards), and thus frequents dodgy online chat rooms, has observed panicky discussions about which registrars will still take the scammers’ business.

Catch me offline

The criminal businesses that rely on spam are most at risk in law-abiding bits of the real world, such as America. Just like honest businesses, they appreciate its robust networks, reliable web-hosting. But law-enforcement agencies and internet security companies are also more active in such countries and have started working closely together. When Mr Bruen presents evidence to reputable hosting companies in America that their customers are fraudsters, they unplug them. Police agencies are increasingly interested to hear from him and fellow experts about the others.

That, says Mr Bruen, reflects an important point. The word “cyber” in cybercrime obscures real crimes committed in real places. Typical junk mail comes from freelancers (see article) who are paid to direct traffic to websites that sell fake pills and counterfeit brands. But fraud and forgery are illegal.

Technology and legal pressure have changed the spammers’ terms of trade. They long relied on sending more e-mails from more computers, knowing that some will get through. But it is hard to send 100m e-mails without someone noticing. So old-style spam is being squeezed to the limits of its return on investment, says Patrick Peterson, Cisco’s chief security researcher. In 2008 researchers from the University of California at Berkeley and San Diego posed as spammers, infiltrated a botnet and measured its success rate. The investigation confirmed only 28 “sales” on 350m e-mail messages sent, a conversion rate under .00001%. Since then, says Mr Peterson, the numbers have got worse.

But spammers are a creative bunch. Instead of tricking consumers into a purchase, they are stealing their money directly. Links used to direct the gullible to a site selling counterfeits. Now they install “Trojan” software that ransacks hard drives for bank details and the like. Such spam now makes up fully 5% of all e-mails. The conventional kind is still around 90%.

Spammers also have become more sophisticated about exploiting trust. In few places is it granted more readily than on social-networking sites. Twitter, a forum for short, telegram-like messages, estimates that only 1% of its traffic is spam. But researchers from the University of California at Berkeley and the University of Illinois at Champaign-Urbana show that 8% of links published were shady, with most of them leading to scams and the rest to Trojans. Links in Twitter messages, they found, are over 20 times more likely to get clicked than those in e-mail spam.

Nor is Facebook as safe as Mr Zuckerberg would wish. As an experiment, BitDefender, an online-security firm, set up fake profiles on the social network and asked strangers to enter into a digital friendship. They were able to create as many as 100 new friends a day. Offering a profile picture, particularly of a pretty woman, increased their odds. When the firm’s researchers expanded their requests to strangers who shared even one mutual friend, almost half accepted. Worse, a quarter of BitDefender’s new friends clicked on links posted by the firm, even when the destination was obscured.

Spammers’ resilience is best demonstrated by Koobface, a Trojan that spreads on social networks and appeared on Facebook in May 2008. Its criminal creators have so far adapted it to surmount all the obstacles put up by the firm’s security geeks. Experts estimate its profits at $2m so far. Spam is out of the can for good.