bits & bytes - Ping! Zine Web Tech Magazine

SERVER SECURITY
to another few hundred dollars a month.
3. Next is the spam run” – the
process in which the spammer sends out
millions of e-mail messages as part of a
specific campaign. Sending spam from
compromised computers (“zombies”), a
very common practice, does not incur any
costs at all.
4. Revenue generation – with the
campaign on its way, and the online store
live, the spammer sits back and counts
the money coming in. Assuming a 0.01%
sales conversion rate on one million e-
mails, a spammer’s gross profit can range
from$3,000 (porn website subscription),
to $10,000 (Sex-related products) or
even to $150,000 (home refinancing) per
campaign.
Getting Your Address
Let’s take a look at the process from
an economic standpoint, starting with e-
mail lists. A list containing 300M e-mail
addresses can be purchased online from
$29.99 to $59.99. These lists are often
automatically created by special software
modules (called ‘bots’), which crawl the
internet in search of e-mail addresses.
For example, if you have participated in
a newsgroup discussion and used your
e-mail address, chances are you will be
receiving spam to the e-mail address
you’ve used for posting.
44 Ping! Zine Web Hosting Magazine
Since e-mail addresses are easily obtained
from across the internet, e-mail lists are also
relatively low-priced. Spammers utilize
a variety of other technical methods to
harvest addresses too, such as “dictionary
attacks” (automatically guessing common
e-mail addresses) and “P2P harvesting,”
in which spammers exploit peer-to-peer
(e.g. filesharing) networks to obtain e-mail
addresses.
Sending You Spam
Each spam campaign advertises a
specific type of product. The types of
products favored by spammers include
generic prescription drugs, mortgages
and sex-related products. The spammer
usually sets up an online store selling the
advertised product. Those online stores
exist only for a few days, and are moved
from one hosting provider to another.
Typically, those hosting providers are
“spam-friendly” and are willing to host
spam-sites in exchange for high hosting
fees.
Once spammers obtain an e-mail list
and set up an online store, running a
spam campaign is the next step. Although
the spammer is interested in sending out
millions of e-mail messages, but sending
such massive amounts of e-mail would
normally incur significant costs, if done in a
conventional manner. To avoid these costs,
spammers do not typically send out all
these messages from their own servers, but
rather use compromised machines, known
as “zombies,” to send their messages.
Notably, many recent virus outbreaks were
launched to create a network of “zombies”
that could be controlled remotely. Such
machines are used to send out spam e-
mails, often without the knowledge of
their owners.
Assuming spammers rely on 3rd party
infrastructure like zombies, their costs for
sending spam are limited to their own ISP
hosting fees. In such a situation, there is
almost no difference in cost for the sender
to send an e-mail message to one million
recipients versus sending it to a single
recipient. So, in essence, when running
a spam campaign, the spammer actually
uses other people’s resources, incurring
little expense in the process.
Making Money
at Your Expense
With the e-mails on their way, the
spammer waits for customers. Industry
surveys show at least ten percent of the
population actually buys products and
services advertised via spam. In specific
product categories, the percentage of
people buying spamvertised products is
even higher – a recent survey conducted
by the Better Business Bureaus showed
twenty-one percent of American e-
mail users have bought software from
a spammer, while twenty-two percent
purchased apparel and jewelry advertised