Spamming for Dummies

Original URL: https://www.theregister.com/2004/07/27/spamming_for_dummies/

A cautionary tale

Posted in Security, 27th July 2004 15:01 GMT

Let's call him Stan. Our entirely fictitious character begins his work day, as many of us do, by opening his email client and checking for new messages. As usual, a few legitimate emails are hidden amongst a deluge of spam, one of which catches his eye.

‘2 Million Email Addresses for $19.95’

Already a keen businessman, Stan doesn't take long to realise that the designer jewellery he's selling from his website could move off the shelves a lot faster if he could reach two million people with each advertisement.

Within half an hour Stan has bought a list of two million unique email addresses, 50 per cent of which are verified live accounts. Accounts that are known to be live are worth more to the soon-to-be spammer as they are known to have a human at the receiving end reading the incoming email. From the same site Stan purchases a piece of software labelled as a powerful bulk email sender with which he can hawk his wares.

While designed with the novice in mind, the spamming software is slightly beyond Stan’s level and it takes some time for him to master. Stan sees this as time well spent of course, but with each mistaken stab, hundreds of blank or malformed emails are sent to unwitting recipients.

Pausing at this late stage to read the help file for his newly-purchased software, Stan realises it will take some time for the software to send two million emails, and the first spam run is best saved for evening when Internet dialup costs are at their lowest.

Spammer in training

By the end of the week Stan is able to assess the success of his first spam run. At this point he does not consider himself a spammer and hasn’t yet considered how his marketing efforts are adding to the spam tsunami.

A quick calculation tells Stan he received a tiny response rate: only 0.03% of the people he emailed actually bought something. But even with such a poor response, he generated a healthy profit. Stan feels very happy with himself and starts researching how best to increase his future spam runs.

In the following weeks Stan’s list of email addresses grows considerably. He now owns software that will search the Web for new addresses, software to sort his lists and eliminate duplicates and software to verify if email accounts are still active.

Unfortunately for our spammer-in-training, it doesn’t take long for his Internet Service Provider to notice the deluge of emails he is sending and they cut him off, politely reminding him that spammers are not allowed on their network.

Luckily for Stan, though, he has got to know some more prolific spammers through the spam-specific chatrooms. They advise him on some of the more spam tolerant ISPs available overseas, some self- proclaimed ‘bullet proof hosting’ companies based in China that will allow him to send spam and which operate software to aid him in his advertising efforts.

Stan has now plunged in the spam industry arms race, trying to stay one step ahead of the antispam groups and companies. Luckily for him, these groups are very vocal about their efforts and even go so far as to publish their latest methods and technologies. The more of this material Stan reads, the better able he is to circumvent their attempts to block his spam.

By this stage Stan has stopped trying to sell jewellery, instead recruiting clients who want to use email as a marketing tool for their own products. With four spam runs a week, Stan is pushing out almost 20 million pieces of spam each week. His spam empire has expanded to the stage where he must outsource some runs to associates he has met in the spam circles.

Using the latest software and technologies, Stan does everything in his power to keep the antispam lobby on their toes. Constantly moving from hosting company to hosting company, routing his spam through innocent third parties with badly-configured email servers and purchasing access to virus infected machines to turn into zombie spamming hosts – Stan is always one step ahead.

Stan has dedicated a server to scanning the Internet for badly-configured email servers, known as open proxies, through which he can anonymously route his spam runs. He has made some influential friends in the virus writer community, known at VXers, who for a price will allow him to bounce his spam email messages through the network of zombie computers their viruses have infected. These are the two methods by which Stan avoids having his servers blacklisted.

More and more creative efforts constantly yield increased results. Each new idea of how best to word his advertising messages increases their response rate noticeably. Stan knows that that a large portion of his emails are being blocked by antispam software, but his response rate is high enough for it not to matter.

The Untouchable

Our mass marketing guru knows of the new laws that will attempt to curb spammers activities. But because all of his email originates on a server in China he feels content that the laws will never touch him or his enterprise.

By now Stan has become quite well-known and respected in the spamming circles, so much so that he has even mentored a few novice spammers – taking them under his wing and teaching them the tricks of the trade. So well-known has his direct marketing company become inside the spam-sending industry that it has been a long time since he worried about advertising his spam-sending services. Clients come knocking on his door now.

The offices Stan works out of are unmarked and nondescript. The antispam lobby are well aware of his activities and they have Stan listed as a major contender in the spam arena. The more spam he becomes responsible for the more his name grows. Occasionally his lawyer will call with another lawsuit but Stan has one thing the antispam lobby lacks and that is a generous source of funds to pay his legal fees.

The story has no ending. Stan continues his activities as a spammer, occasionally becoming the subject of a headline or two in the trade publications. But never does he fail to make a profit from spamming.

Each night, Stan falls asleep in a house paid for by spamming and each night he sleeps the peaceful sleep of one who knows that those who would oppose him can hardly reach him. ®

Mark Anderson is managing director of Hivercon Security, which providea a managed email filtering service called White Mail.