Combating spam: an intelligent approach to the problem

Introduction

Spam is email's worst foe. Research indicates that up to 90% of all email arriving in mailboxes is spam. Spammers make a fortune from their trade, but few countries take legal action against the offenders. Some people believe that you can't beat spam, and you should just accept it as an unfortunate fact of life alongside other misfortunes like inflation or famine. We disagree, not least because spam can be dangerous as well as time-wasting if it's not handled correctly.

This issue of Security Insight will bring you up to speed on the dangers of spam and the latest techniques used by spammers, and gives you some practical tips on how to deal with spam intelligently - and without the use of specialized anti-spam software - so that your data and your personal privacy are kept intact.

Junk email, or spam - common examples

While the precise definition of spam may vary, I think we all agree that it is essentially any unsolicited email or other electronic communication (e.g. delivered through Instant Messaging communication or a blog posting) which you don't need or expect and which is sent without your prior approval or knowledge. Spam messages are distributed in bulk to millions of recipients, and their authors are chiefly looking for financial rewards from the merchants whose goods and services these spam messages are peddling.

Generic drugs, replica watches, low-interest loans and adult entertainment sites rank highest among spammers' favorites.

Example of spam email #1. Here, text is contained within the picture, making it more difficult for traditional spam filters to identify the message as spam. Legitimate dictionary words accompany the graphics to enhance the impression of validity.

Example of spam email #2. The so-called Nigerian Scam, or 401-spam (financial fraud). Usually letters of this type purport to come from a deposed ruler who offers tremendous wealth in exchange for a small amount initially invested to supposedly recover hidden treasures. This particular message also carries a virus hidden in an attached picture.

Financial fraud, where perpetrators send authentic-looking letters, ostensibly from bona fide financial institutions such as banks and auction sites, attempt to harvest users' account credentials in order to steal funds from those accounts or perform other illegal transactions under the guise of the authorized user. This type of scam is known as phishing and it's important to be aware of its dangers in order to prevent identity theft. We discussed phishing in detail in a previous Insight article.

The hidden dangers of spam

Besides the core concept of delivering unwanted ads, solicitations and phony get-rich-quick offers -so-called "safe" spam because the messages are only focused on selling something, spam can be quite destructive when it is based on viral code in an attachment or hyperlink. This kind of spam can carry a dangerous payload posing as an innocent document or a picture that the spammer tempts you to open with come-ons like "Osama bin Laden video" or "David Beckham's private life revealed". Using vulnerabilities in email client software such as Microsoft Outlook or Outlook Express, malicious code can be made to auto-execute without you doing anything at all.

On top of that, if you follow a hyperlink in a spam email, you can get infected with spyware or a Trojan by way of a drive-by download following the exploitation of unpatched vulnerabilities in your browser software. A clear reminder is never to open attachments or click on links in emails from people you don't know.

How spammers get your email address

• Be careful not to include your personal email addresses in open forums, blogs or newsgroups. If leaving your email contact is mandatory on these sites, try scrambling it a little so that spam robots trolling for emails can't easily decipher its true value. For example, if your real email address is john@something.com, you can post anything like that: "John (at) (.) {-COM-}" - a human would easily guess what the real contact address is, but a robot won't be able to translate it easily.

• Do not respond to spam, don't click on links in spam messages, and, most important of all, do not use the "unsubscribe" option. By doing so, you only confirm to spammers that the email address is valid.

• If you receive an email from a friend that includes an unexpected attachment, be very wary, as this method is often used to spread a worm to everyone in your online address book. Contact the friend separately to ask if they sent you the message.

• If an email arrives that you're not expecting from someone you don't know, assume it is spam.

• Obtain and use different email accounts for different purposes.

Remember that spammers trade email lists, so if you keep your important email address(s) hidden when you're online, you stand a good chance of minimizing the spam levels in your inbox.

How spam propagates

Spammers rarely use their own PCs and Internet connections to send their messages but instead employ armies of "slave" computers that drive spam distribution. A community of zombie machines, also known as botnets - computers with high-speed Internet access controlled remotely by a hacker,- are capable of sending millions of messages a day. Worms and Trojans can also send vast amounts of spam as they propagate from one computer to another during an Internet-borne outbreak.

How to protect yourself

First of all, it's important to recognize spam and treat it accordingly. The above information will help you to identify spam more easily, and what follows will help you to minimize the influx of spam, as well as prevent your PC from being hijacked for use as a spam distribution zombie.

• Make sure you install Windows XP Service Pack 2 and all subsequent Windows updates to ensure that the OS is as resistant as possible to exploitation.

• Install a reputable software firewall. Programs such as Outpost Firewall Pro will prevent your PC from being used to send outgoing spam because of a malware infection. The firewall will foil any attempts to draft your computer into botnet armies and can be configured to quarantine email attachments so they can't be accidentally opened and perhaps activate a virus or trojan.

• Install anti-virus software that scans incoming and outgoing mail attachments for viruses.

• Review the security measures offered by your email provider or ISP - most providers these days make spam protection tools available through their web site. You can use these to construct blacklists of email addresses you don't want to receive messages from and whitelists of addresses of people you know. Some of the more sophisticated tools will let you set up rules to manage incoming email in different ways depending on certain characteristics.

• If possible, obtain a mailbox from your ISP that allows IMAP connections. The IMAP protocol is a better medium for message retrieval than the standard POP3 protocol. It has enhanced functionality and lets you download message headers only instead of the entire email and attachments. Because most spam messages are easy to detect by looking at the subject line and the sender, you can quickly and easily identify and delete unwanted messages this way.

• Use email software with built-in spam protection such as Outlook and The Bat! and make sure you know how to configure it properly. If you use Outlook Express, try making the following modifications (all settings are available through the Options menu):

a) In the General tab, disable "Send and receive messages at startup"

b) Disable the "Automatically download message when viewing in the Preview Pane" option in the Read tab

c) In the Security tab, make the modifications shown at right

And finally

In this article, we've discussed some basic antispam concepts that will help you control and intelligently manage the influx of spam messages to your inbox. While they won't eliminate spam entirely, implementing these suggestions will limit your exposure to it.

In a future issue of Security Insight, we'll review some specialized antispam software - then, you will be able to completely rid yourself of spam, so stay tuned.

Safe emailing!