Spam, Q4 Email Threat Trends of 2007

Airport security screeners are taught to use psychology and behavior patterns to spot suspicious behavior. The bad guys use similar techniques. Cyberoam, a division of Elitecore Technologies and the leading innovator of identity-based Unified Threat Management (UTM) solutions, announced the release of Q4 email threat trends of 2007, which revealed a steep rise in attacks using social networking techniques targeting user psychology and behavior patterns. Spammers launched attacks by predicting user behavior patterns, such as looking for easy cash and discounted gifts during the holiday season, and preying on consumer trust to generate interest in cheap pharmaceutical products and stocks. Existing security solutions were unable to block the new spam formats and techniques, resulting in an alarming rise in spam levels reaching 96 percent by the end of 2007. Spammers used the Storm Worm, an aggressive and self-preserving botnet, to generate, host and distribute large amounts of spam and malware in 2007. Consequently, the Storm Worm’s massive outbreak accounted for 7-10 percent of all global spam traffic at its peak. Experts agree, however, that the worm has yet to reach its damaging potential. The Address Validation Spam sending seemingly harmless, incoherent or empty email messages from an unfamiliar address was used to validate the email addresses in the botnet owners’ list. The “clean” list was then rented out at a higher value to spammers and other cyber villains. Spam attacks in short, intense waves by the Stration malware maximized damage in the first few hours of the attack before antivirus signature updates could be released. Spammers gained financially by using traditional image spam techniques, promoting pharmaceutical products and pump-and-dump stocks with images that included nonclickable URLs and stock ticker symbols. Recipients interested in the products and stocks opened a web browser and manually typed in the URLs, driving up the sales of cheap pharmaceutical products and stock prices. Spam e-mails using holiday subject lines easily slipped past antispam filters and users’ suspicions. These e-mails took users to malicious Web sites and attempted to download Trojan software. Most antispam solutions were ineffective, as blocking emails leveraging holiday-themed keywords often resulted in false positives.

The “Q4 2007 Email Threat Trend Report,” prepared in collaboration with Commtouch, revealed that botnets are becoming more sophisticated and difficult to control. Traditional IP blocking technologies are unable to maintain pace with the dynamic IP activation and deactivation of innumerable botnets. Cyberoam uses the Commtouch RPDTM technology to analyze large volumes of Internet traffic in real-time. Unlike traditional spam filters, it does not rely on e-mail content, so it is able to detect spam in any language and in every message format (including images, HTML, etc.), non-English characters, single and double byte, etc.. Its language and content agnostic nature enables it to provide effective spam blocking capabilities. Cyberoam incorporates this technology within its UTM appliances, which deploy identity-based functionality across all of its features. A departure from traditional IP address-dependent solutions, Cyberoam determines precisely who is doing what in the network, providing IT managers with stronger policy control and clearer visibility of activity.