Tiscali Members: Spam

It's a can of worms. Junk mail activity has exploded in the last 3 months. At first the problem was stemmed by the well-known spam filters that Tiscali and its customers use. These are similar across the industry. Of late, the problem has become less manageable. Two key questions need answers: why and how, and what can we do about the problem?

Anti-malware and anti-virus software

Tiscali Security Centre

Tiscali customers send millions of emails each month. Recent months have seen increases in spam levels . . . and some. Most spam is stopped well before it gets to your inbox - you never see it. However, certain amounts of spam are getting through. Tiscali is not the only ISP to spot this trend, many others have too.

The problem is huge. It is not as easily managed as many may like to think. For example, an ISP cannot be held liable for an individual who decides to follw up on a dodgy stock or share offer sent by spam. That is the province of personal greed. Moreover, the increasing use of embedded images which use techniques to prevent spam filters from recognising text on the image impedes the effectiveness of existing filters. Intelligent software will find a way round this, given time. The problem is, so will the con artists.

Finally, the self replicating nature of botnets is of itself a major cause of the problem. Throw in unprotected systems in fast developing countries with explosive broadband growth and you can imagine the ever-growing scale of the problem.

There is no single cause. The problem is down to several events which, over time, have conspired to cause the problem. The main culprits are botnets. These are networks of home computers infected with malware.

Botnets have been growing in size almost exponentially, largely because internet users contract malware by visiting unsavoury sites or by innocently downloading it when installing free software. There is a lesson in this.

Botnets have been around for some years.

• Worms or Trojan horse programs infect a PC and then take control of it, forcing it to accept commands sent by a central controller;
• The commands, traditionally sent via Internet Relay Chat (IRC), were initially used to force large numbers of bots to attack a target web site, flooding it with traffic in a distributed denial of service (DDoS) attack;
• This type of occurrence usually affected large corporate or government websites;
• Botnets replicate and infect other internet users. In so doing, their power and range increases exponentially.

Now instead of large corporates, the controllers of these malicious networks are after you and me.

Botnets are increasingly used to send spam emails. The network of infected computers acts as the controllers own mail servers. Spammers now send email directly from compromised Windows PCs that sit in homes across the UK. Home users, denied the protection of large, well-administered corporate security are especially vulnerable and often least equipped to handle the consequences.

Botnet operators program the infected PCs to act as email servers whose processing power and bandwidth are sold by the controllers. There is money in all this for someone, somewhere.

The high risk/reward ratio has led the major perpetrators to produce ever more professional and effective cyber-scams on an almost daily basis. Moreover, the type of software used by these con artists can easily be upgraded and reconfigured to take advantage of Windows vulnerabilities: Windows PCs are the favourite targets for these con artists.

Sanjit Chudha