What's With all the SPAM Lately?
Have you noticed more spam in your Inbox and Junk Mail folders lately? Luckily, my Inbox isn’t plagued with unsolicited commercial emails, but if I showed you my Spam folder I might get reported to human resources for sexual harassment. I rarely check the Spam folder itself unless someone says; “I sent you an email, didn’t you get it?” For now, I won’t ask the expected question, “What is Spam?” I think we all know what spam is, and we have all at one email address or another gotten spam messages. Rather, I invite you to ask; “Where does all this spam come from?” and “Why do we get so much of it?”
Your email addresses are valuable, so are mine. I have a few, and I’m sure you do too. They’re not worth much, cents really, but to spammers a valid email address is valuable as a destination for advertisements. When gathered together in the hundreds of thousands of emails, and made into lists of known-live addresses, the list can cost from hundreds into thousands of dollars. Spam advertisers, or spamvertisers, will pay for and then feed the target lists into a specialized command-and-control program. This special program is basically a website on the Dark Web where the list gets uploaded to, and from there the bots receive their instructions.
Bots, what bots? Ah yes! When referring to bots, they are the thousands, maybe millions of zombie computers connected to the Internet that their owners don’t update. Regularly updating computers is important to keep them working right, as well as to keep them safe from vulnerabilities that are discovered almost daily. There are thousands of common vulnerabilities and exploits (CVE) when discussing Windows XP, Vista, 7, 8, 8.1, 10, and even Microsoft’s versions of Windows Server. Just visit https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=Windows and browse the 7,228 results, as of the writing of this article.
Some of those CVE notices, when left unpatched by end-users, take advantage of vulnerabilities to turn unpatched computers into rogue email servers, also known as bots. Even when the computer may appear to be working normally, it’s secretly sending spam out in waves and in concert with other zombified computers to avoid being detected and blacklisted by major providers like Google or Microsoft. These bots, when networked together, are collectively known as a bot-net. By distributing their spamvertisements over hundreds or thousands of bots in a bot-net, the recipient email providers are less likely to catch the messages in their spam filters. The more effective the spammers that handle the bot-net are at this tactic, the more likely their spamvertisers’ emails will end up in your Inbox instead of your Junk Mail. The more effective the spammer, the more money spamvertisers pay them for their services.
One of the largest, if not the largest network of bots that has been employed as a spamming source is known as Emotet. It was first discovered as a maligned application in 2014. The bot-net's spammers were always expanding it to rent it out to more spamvertisers or even use it for their own spam campaigns, and it kept growing until the beginning of 2019. For months the Emotet was silent, until it came roaring back in September. A researcher, and self-proclaimed “botnet mercenary” named Rasshid Bhat broke the news that the bot-net was back, on Twitter at https://twitter.com/raashidbhatt at the end of August.
Now, some of my email addresses are publicly known, whether through website ownership records, or having given it out freely in the past. I expect spammers to easily get a hold of most of my email addresses, which is why I use spam filters. I get so much spam, because my email has been used so many times on so many websites, that all I could do is change emails and wait for the situation to grow out of control again eventually. Why we get so much spam has almost the same answer as where does all this spam come from? Money. Someone, somewhere, paid a spamvertiser, who bought your email address on a list with others’, and paid a spammer to rent their bot-net, in an attempt to get you to click on something or to spend your money.
What’s worse is, some people believe the emails are real and try to buy their products. In a few clicks, not only can the user’s computer be infected and turned into a bot, but most of the products are scams. If they don’t just steal your credit card numbers for use in financial crimes, then the products ordered are garbage. In closing, I urge you to take a look at your email’s spam filters. If it’s at work, ask your email administrator how they work. There are online video tutorials that can show you how to work them and tune them to your needs. As a rule of thumb to avoid getting turned into a bot, never click on links or open any attachments from sketchy senders. Beyond that, always keep your computer up-to-date and use a free antivirus program, as there are several to choose from.
