Rotten spam causing more infections than ever – study

Indian and Vietnamese kinds are the worst


Anti-spam tools have evolved to a degree where many of us hardly see much spam anymore. But when we do, the threat posed by those messages is greater than it has ever been, according to a new report from independent security firm AV-Test.

The report, entitled "Spam – More Dangerous than Ever Before," was based on an 18-month study conducted between August 2011 and February 2013, in which AV-Test harvested and analyzed some 550,000 spam emails.

As in the past, the vast majority of those messages contained fraudulent offers for counterfeit products, such as bogus pharmaceuticals. Being ripped off is the main risk there, not to mention phishing.

But around 2.5 per cent of the spam being sent today serves a different, darker purpose, the report claims – namely, spreading malware.

Certain types of spam emails are especially dangerous. Of the 30,000 spam messages AV-Test analyzed that contained attachments, over 10,000 of them – nearly a third – were infected with malware.

The file formats used to deliver the payloads were mostly the usual suspects. ZIP attachments and executable formats such as EXE and PIF were almost always infected, as were 80 per cent of HTML documents sent as attachments. PDF and image attachments were occasionally found to contain exploits, too.

Less prevalent, but much harder to spot, were messages containing links to websites that spread malware. Only around 1 per cent of the spam that included URLs contained such links, but such messages are often indistinguishable from those containing more benign links.

But not all spam is created equal. In particular, country of origin matters when determining whether a message is likely to contain malware.

As with other studies, AV-Test found that the majority of all spam sent originates in the United States, including spam messages containing attachments. But only 15 per cent of spam attachments sent from the US were actually malware, compared to 30 per cent globally.

On the other hand, spam attachments sent from India were infected 78 per cent of the time, while runner-up Vietnam sent attachments that were infected 77 per cent of the time.

Predictably, nearly all of the spam analyzed was sent by PCs that were remotely controlled by botnets. What may be surprising, however, is that some 25 per cent of these spambots only operated Monday through Friday.

According to AV-Test, that indicates they were located in offices, where PCs were switched off over the weekend – "even in Germany!" the German firm breathlessly reports, though it hastens to add that Teutonic spam was less likely to contain malware.

So what's to be done about all this? The usual cautions apply. Incoming email should be filtered for spam, and PCs should have good antivirus software installed to prevent infection by Trojans and rootkits, should an infected message happen to get through.

In addition, the AV-Test report notes that the German government and an association of local businesses have created a website containing links to tools that can help users check whether their PCs belong to a botnet. ®

Similar topics


Other stories you might like

  • Software Freedom Conservancy sues TV maker Vizio for GPL infringement

    Companies using GPL software should meet their obligations, lawsuit says

    The Software Freedom Conservancy (SFC), a non-profit which supports and defends free software, has taken legal action against Californian TV manufacturer Vizio Inc, claiming "repeated failures to fulfill even the basic requirements of the General Public License (GPL)."

    Member projects of the SFC include the Debian Copyright Aggregation Project, BusyBox, Git, GPL Compliance Project for Linux Developers, Homebrew, Mercurial, OpenWrt, phpMyAdmin, QEMU, Samba, Selenium, Wine, and many more.

    The GPL Compliance Project is described as "comprised of copyright holders in the kernel, Linux, who have contributed to Linux under its license, the GPLv2. These copyright holders have formally asked Conservancy to engage in compliance efforts for their copyrights in the Linux kernel."

    Continue reading
  • DRAM, it stacks up: SK hynix rolls out 819GB/s HBM3 tech

    Kit using the chips to appear next year at the earliest

    Korean DRAM fabber SK hynix has developed an HBM3 DRAM chip operating at 819GB/sec.

    HBM3 (High Bandwidth Memory 3) is a third generation of the HBM architecture which stacks DRAM chips one above another, connects them by vertical current-carrying holes called Through Silicon Vias (TSVs) to a base interposer board, via connecting micro-bumps, upon which is fastened a processor that accesses the data in the DRAM chip faster than it would through the traditional CPU socket interface.

    Seon-yong Cha, SK hynix's senior vice president for DRAM development, said: "Since its launch of the world's first HBM DRAM, SK hynix has succeeded in developing the industry's first HBM3 after leading the HBM2E market. We will continue our efforts to solidify our leadership in the premium memory market."

    Continue reading
  • UK's ARIA innovation body 'hasn't even begun to happen' says former research lead

    DARPA imitator not doing much after two years of Johnson government

    Updated The UK's efforts to copy US government and military innovation outfit DARPA are stalling, according to a leading figure in research and development.

    Appearing before the Science and Technology Committee, Sir John Kingman, former chair of UK Research and Innovation, told MPs this morning that ARIA – the Advanced Research and Invention Agency – was a good example of departmental research spending that could be cut, sidelined or delayed.

    "A very high-profile example would be ARIA, which has been this big plan for the Boris Johnson government, and yet here we are a few years into the Johnson government and it still hasn't even begun to happen," he told MPs.

    Continue reading

Biting the hand that feeds IT © 1998–2021