A Choice Quote:

“Spam isn’t going to die. It’s not a technological problem. It’s a human problem. As long as people are prepared to click on the links without thinking and buy from unscrupulous people, it will continue. I don’t think we are going be able to fix people.”

~ Sophos Plc. senior technology consultant Graham Cluley

Internet Security
Who might spammers care to fear?

Spammers probably couldn’t care less about law as long as they don’t get busted. And with at least one million hijacked computers, known as bots, under their command around the world, they can just sit back and relax when those bots are made scapegoats.

The only enemy they perhaps care to fear would be internet security companies. They are swift and proactive in countermeasures and are the ones stopping them making money.

Sophos Plc. senior technology consultant Graham Cluley said: “We have thousands of ‘spam traps’ all around the world feeding back information to us. Our lab analyses spam 24 hours per day, every single day of the year. We issue an update almost every five minutes.”

'Backscatter spam'---a desperate sign?

Mr Cluley said about 3% of spam emails they monitor is backscatter spam. The spammer would forge the From field of a message header with an email address of a victim. Because the spammer uses servers of legitimate companies to “bounce back” spam messages to “myriads of victims”, hence the name “backscatter”.

“All of this shows the spammers are getting a little more desperate in their techniques and try to come up with a more convoluted way,” Mr Cluley commented.

Love and hate complex?

It is probably fair to say while spammers are the bane of internet security companies’ existence, they are also money-spinners. But Mr Gluley said: “There’s not much love. We’ll still do jolly well even if the spam problem is reduced. The problem has got worse and worse over the years. Believe me. The researchers are sick to the back teeth of people who are making the internet a less fun place to be.”

Infrastructural problem

Internet was invented without security in mind. The Simple Mail Transfer Protocol (SMTP) does not have authentication mechanism and therefore can be exploited by spammers to relay their spam emails without checking their identity.

A radical way is to rewrite the mail transfer protocol completely. The problem: getting everyone to agree on the internet is colossal work.

Another solution is the use of blacklists (or blocklists). But there are also cases where legitimate companies whose IP addresses are wrongly blacklisted, causing another form of cyber bullying.

What about charging people by the amount of emails sent? Mr Cluley said: “I think it will prove incredibly unpopular. How would you enforce it over the entire internet? You can’t just have one company saying: ‘We’re going to charge you per email’ because all of their customers will go somewhere else.”