As of late, many of Sagentic's customers have noticed a large increase in the amount of spam in their inboxes. We have a very robust anti-spam system installed on our server called SpamAssassin. We have tweaked SpamAssassin to the max to filter out unwanted emails and still allow desirable email. We are working with the software vendor to see what is possible as far as upgrades to the system to combat the crafty spammers.
Every time a fix is made, a work-around is established by the spammers. We will continue this fight. You can help by installing anti-spam programs on your computer. Sagentic can take your account a step further and enable BoxTrapper. BoxTrapper protects your inbox from spam by forcing all people not on your white list to reply to a verification email before they can send mail to you. Let us know if you want this enabled. It works on an account-by-account basis - we can't "blanket" enable it for your domain with one white/black list.
Make no mistake about it - Sagentic deplores spam! It is costing us (and you) a lot of money. The surge in spam increases our server load, sucks up valuable disk space, increases the amount of support time we have to spend on the phone and email, and takes away from your productivity as well.
The recent surge in e-mail spam hawking penny stocks and penis enlargement pills is the handiwork of Russian hackers running a botnet powered by tens of thousands of hijacked computers.
Internet security researchers and law enforcement authorities have traced the operation to a well-organized hacking gang controlling a 70,000-strong peer-to-peer botnet seeded with the SpamThru Trojan.
According to Joe Stewart, senior security researcher at SecureWorks, in Atlanta, the gang functions with a level of sophistication rarely seen in the hacking underworld.
For starters, the Trojan comes with its own anti-virus scanner-a pirated copy of Kaspersky's security software-that removes competing malware files from the hijacked machine. Once a Windows machine is infected, it becomes a peer in a peer-to-peer botnet controlled by a central server. If the control server is disabled by botnet hunters, the spammer simply has to control a single peer to retain control of all the bots and send instructions on the location of a new control server.
Another sign of the complexity of the operation, Stewart found, was a database hacking component that signaled the ability of the spammers to target its pump-and-dump scams to victims most likely to be associated with stock trading.
The SpamThru spammer also controls lists of millions of e-mail addresses harvested from the hard drives of computers already in the botnet. "This gives the spammer the ability to reach individuals who have never published their e-mail address online or given it to anyone other than personal contacts," Stewart explained.
"It's a very enterprising operation and it's interesting that they're only doing pump-and-dump and penis enlargement spam. That's probably because those are the most lucrative," he added.
Even the spam messages come with a unique component. The messages are both text- and image-based and a lot of effort has been put into evading spam filters. For example, each SpamThru client works as its own spam engine, downloading a template containing the spam and random phrases to use as hash-busters, random "from" names, and a list of several hundred e-mail addresses to send to.
Stewart discovered that the image files in the templates are modified with every e-mail message sent, allowing the spammer to change the width and height. The image-based spam also includes random pixels at the bottom, specifically to defeat anti-spam technologies that reject mail based on a static image.
All SpamThru bots-the botnet controls about 73,000 infected clients-are also capable of using a list of proxy servers maintained by the controller to evade blacklisting of the bot IP addresses by anti-spam services. Stewart said this allows the Trojan to act as a "massive distributed engine for sending spam," without the cost of maintaining static servers.
With a botnet of this size, the group is theoretically capable of sending a billion spam e-mails in a single day. "This number assumes one recipient per message, [but] in reality, most spams are delivered in a single message with multiple recipients at the same domain, so the actual number of separate spams landing in different inboxes could be even higher," Stewart said.
According to data from Barracuda Networks, an enterprise security appliance vendor in Mountain View, Calif., there has been a 67 percent increase in overall spam volume and a 500 percent increase in image spam since Aug. 2006.
Stephen Pao, vice president of product management at Barracuda Networks, echoed Stewart's findings, noting that the bulk of the spam is linked to the trading of penny stocks. "Across the board, we are observing more spam and more sophistication in sending the spam," Pao said.
Here's a few tips -
1. Quit giving out your professional email address to every website that asks for it. Some companies will sell your address to other companies that send spam. If you want Sagentic to create a "throw-away" email address for you that you can give out instead of you@yourdomain.com, let us know. OR use free Web mail accounts. For merchants and legit others you don't correspond with regularly, use Web mail, such as Hotmail's or Yahoo!'s. You can abandon it if it gets spammed. Many have spam filtering built in.
2. Install anti-spam software on your computer. Also, install anti-virus software. NEVER run a computer without it! NEVER! Make sure that your anti-virus software is up to date. Many viruses and Trojans scan the hard disk for e-mail addresses to send spam and viruses. Avoid spamming your colleagues by keeping your anti-virus software up to date.
3. Never reply to spam messages, even when they entice you to reply to "remove" you from their mailing lists. Often the instructions are either bogus, or a way to collect more addresses. Replying confirms to the spammers that your e-mail address is active, and you may receive even more junk mail.
4. Assume Mail from Unknown Senders is Spam - I don't know you... you must be a spammer! Carefully check out the email real good before you go clicking on any links in the email. When in doubt, delete it.
5. Watch Out for Those Checkboxes- Make sure you don't opt in for emails you don't want, and watch out for checkboxes when you submit any form on a Web site.
6. Do not open spam messages wherever possible. Frequently spam messages include "Web beacons" enabling the spammer to determine how many, or which e-mail addresses have received and opened the message. Or use an e-mail client that does not automatically load remote graphic images, such as the most recent versions of Microsoft® Outlook® and Mozilla Thunderbird.
7. Never forward spam chain letters. You will not have good luck. Don't forward to everyone you know. Bunny rabbits will not die if you don't. It doesn't matter how tragic the story is about some person, some where, with some unfortunate event happening to them - quit forwarding them and ask your friends to stop forwarding them to you! You will not receive five dollars for every person you send this message to - I promise!
8. Over half the crap your friends, relatives, and colleagues send to you about some bizarre happening that is just too unbelievable is, well, crap! Before you even think about believing it, go to www.snopes.com and see what they have to say about it.