Feeds

Rotten spam causing more infections than ever – study

Indian and Vietnamese kinds are the worst

Internet Security Threat Report 2014

Anti-spam tools have evolved to a degree where many of us hardly see much spam anymore. But when we do, the threat posed by those messages is greater than it has ever been, according to a new report from independent security firm AV-Test.

The report, entitled "Spam – More Dangerous than Ever Before," was based on an 18-month study conducted between August 2011 and February 2013, in which AV-Test harvested and analyzed some 550,000 spam emails.

As in the past, the vast majority of those messages contained fraudulent offers for counterfeit products, such as bogus pharmaceuticals. Being ripped off is the main risk there, not to mention phishing.

But around 2.5 per cent of the spam being sent today serves a different, darker purpose, the report claims – namely, spreading malware.

Certain types of spam emails are especially dangerous. Of the 30,000 spam messages AV-Test analyzed that contained attachments, over 10,000 of them – nearly a third – were infected with malware.

The file formats used to deliver the payloads were mostly the usual suspects. ZIP attachments and executable formats such as EXE and PIF were almost always infected, as were 80 per cent of HTML documents sent as attachments. PDF and image attachments were occasionally found to contain exploits, too.

Less prevalent, but much harder to spot, were messages containing links to websites that spread malware. Only around 1 per cent of the spam that included URLs contained such links, but such messages are often indistinguishable from those containing more benign links.

But not all spam is created equal. In particular, country of origin matters when determining whether a message is likely to contain malware.

As with other studies, AV-Test found that the majority of all spam sent originates in the United States, including spam messages containing attachments. But only 15 per cent of spam attachments sent from the US were actually malware, compared to 30 per cent globally.

On the other hand, spam attachments sent from India were infected 78 per cent of the time, while runner-up Vietnam sent attachments that were infected 77 per cent of the time.

Predictably, nearly all of the spam analyzed was sent by PCs that were remotely controlled by botnets. What may be surprising, however, is that some 25 per cent of these spambots only operated Monday through Friday.

According to AV-Test, that indicates they were located in offices, where PCs were switched off over the weekend – "even in Germany!" the German firm breathlessly reports, though it hastens to add that Teutonic spam was less likely to contain malware.

So what's to be done about all this? The usual cautions apply. Incoming email should be filtered for spam, and PCs should have good antivirus software installed to prevent infection by Trojans and rootkits, should an infected message happen to get through.

In addition, the AV-Test report notes that the German government and an association of local businesses have created a website containing links to tools that can help users check whether their PCs belong to a botnet. ®

Internet Security Threat Report 2014

More from The Register

next story
George Clooney, WikiLeaks' lawyer wife hand out burner phones to wedding guests
Day 4: 'News'-papers STILL rammed with Clooney nuptials
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
PEAK IPV4? Global IPv6 traffic is growing, DDoS dying, says Akamai
First time the cache network has seen drop in use of 32-bit-wide IP addresses
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
You dirty RAT! Hong Kong protesters infected by iOS, Android spyware
Did China fling remote access Trojan at Occupy Central?
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.