Symantec reveals how the spammers are trying to steal Christmas

Kelly Conley announced the Christmas edition of Symantec's spam report on the company blog:

Here we are the end of another year. As 2007 rolls to a close the December State of Spam Report reviews this past month’s key trends and reflects on some of the year’s most notable spam events and trends.

The report notes that Bill Gates' prediction in 2004 that spam would be eradicated has proven not only to be wrong, but that the amount of spam circulating on the Internet has exceeded everyone's expectations (nightmares?).

This month, three out of every four e-mails sent is spam!

Spammers are even using MP3s, videos, and Google's alerts/searches to spread their seedy marketing ventures to Internet users.

Here are some of the highlights of the end-of-year report:

• Penny stocks use Thanksgiving holiday captions in subject line – spammers using common personal Thanksgiving-related words in the subject of emails

• Replica products a favorite for spammers this holiday season – replica gear has always been a spammer favorite. Spammers are marketing their wares using seasonal words in the subject lines of their mailings

• Spam begins to snowball – spammers collecting email addresses by using a funny .gif that shows a snowball hurtling at you through your computer

• Christmas freebie anyone? – spammers taking advantage of the season to market "free" gift cards for well known companies

• Seasonal lotto scams - in a scam targeted at UK end users, spammers have updated a lottery spam email for a Christmas Bonanza special

The current interest in celebrities like Britney Spears, Lindsay Lohan and the Osmonds were used as lures to get people to open spam e-mails hawking "questionably safe" drugs.

Spammers use whatever is trendy, popular or in the news to trick people into clicking on them. Here is one of the sicker examples of this seen recently:

An attack this month preyed on the public interest in the story of the missing British child, Madeleine McCann. The email contained a link to http://madeleine2007.notlong.com/, which redirected to http://internetwonderful.com/madeleine. The second site is designed to look similar to the official McCann family site, www.findmadeleine.com, however, it actually is set up to distribute a virus. The site also contains an unauthorized use of the Symantec logo and a number of Google ads for anti-virus products.

It should be noted that although the spam email also contains a link to the legitimate findmadeliene.com site, there is no connection between the spammers and the genuine site.

The report concludes it's findings with recognition of anti-spam efforts during the year, such as the FBI's Operation Bot Roast, the SEC's Operation Spamalot, ISP's sharing more information and security vendors employing new spam filter technologies.

We need to remember that spam is the vehicle used to spread 99.9 percent of the questionable marketing and scams on the Internet. Clicking on a spam e-mail can cause a person to become victim of anything from a financial scam to using a unsafe product that is a threat to their personal safety.

These reports serve a purpose, which is to educate the average person on what to watch out for and not click on a spam e-mail in the first place. Since it's Christmas and a lot of us are thinking about the young people in our lives, perhaps this is a good time to educate them on the growing problem of spam on the Internet!

I meet a few older people from time to time that might benefit from the education process, also.

Kelley Conley's blog post announcing the December report, here.

Symantec's December (year end) report on the state of spam, here.

On a lighter note, here is the YouTube video on the 12 days of Christmas Spam:

The Phishermen keep using the IRS name to hook Phish (Identity Theft Victims)

Phishing has become a huge problem. Criminals (phishermen) spoof (impersonate) a brand or organization that people trust to trick people into giving up their personal, or financial information. The information is then used to steal money.

In the more sophisticated attempts, malware (crimeware) is dropped on a system that logs keystrokes, gathering even more personal information, without the computer owner's knowledge, or consent.


The phishermen have been spoofing the IRS so frequently, the IRS set up a dedicated e-mail address to report activity. The address is phishing@irs.gov (follow the instructions).


The most recent version is a spam e-mail intended to scare a person into thinking they are being investigated. Here is what the IRS site is reporting:

The e-mail purporting to be from IRS Criminal Investigation falsely states that the person is under a criminal probe for submitting a false tax return to the California Franchise Tax Board. The e-mail seeks to entice people to click on a link or open an attachment to learn more information about the complaint against them. The IRS warned people that the e-mail link and attachment is a Trojan Horse that can take over the person’s computer hard drive and allow someone to have remote access to the computer.

Trojan horses are often a gateway to install malware -- sometimes referred to as crimeware -- which often includes keylogging software. The bottom line is that once installed on a computer, they have the ability to steal personal and financial details, from afar, without any additional assistance from you.


All the terms out there get confusing to non-technical people, there are some now saying, we should group some of the terms together and call it "grayware?" Another term to group some of this terminology together is "badware."


Similar technology is used for advertising and marketing purposes by legitimate businesses, also. This is often referred to as spyware and adware. The one thing they all have in common is that they are often a nuisance.


The key is to NOT even open the spam e-mails enticing you to click on their links. The best practice is to delete them. These e-mails are generated by the millions, perhaps billions by now, using automated software and botnets (other people's computers that have been taken over).


Spam filters designed to stop them from getting in your inbox, seem like they are getting less effective, recently.


Botnet owners are known to rent out their networks to other criminals for this purpose.


Sadly enough, the IRS name has been being spoofed a lot lately. Here is the extent of it:

Since the establishment of the mail box last year, the IRS has received more than 17,700 e-mails from taxpayers reporting more than 240 separate phishing incidents. To date, investigations by TIGTA have identified host sites in at least 27 different countries, as well as in the United States.

The phishermen often impersonate financial institutions, eBay, PayPal, or government agencies; such as the FBI and Interpol.


The latest alert from the IRS can be seen, here.

Symantec warns of newsletters and "legitimate" advertising being hijacked!

Viagra with your Fantasy Football?

Spam is getting worse than ever, and a lot of spam filters don't seem to be stopping it. Even worse, legitimate mail is being designated as "spam" and placed in "bulk folders."

I find myself having to review my "bulk folder," daily.

Symantec is reporting a new "sneaky" spam tactic being seen out there. Legitimate newsletters and advertising from well known organizations, such as Walmart and ESPN are having ads for Viagra (example) inserted into their publications and sent out as if they are affiliated with the product.

In essence, the spammers are "hijacking" legitimate publications.

As reported in the Symantec Security Response blog by Kelly Conley:

We've noticed a tricky new spam tactic occurring recently and thought we'd share it with you. It’s always exciting when a new spamming technique comes along and it’s even more exciting when our filtering capabilities are successful against it. Most users running our product will not have seen this. Spam filtering can still protect you from this “new spam technique,” but, even if you have seen it or even opened it, you probably gave it a one-two glance and wondered “Eh? This isn't what I thought it was.”

The headers are legit – coming from a newsletter or ad that you have signed up for. You should be receiving this mail, right? Nope, it's a spam email. Look closer. There at the top of the page. It's an ad for something entirely different than what you thought was going to be in that email.

Kelly's full post, here.

Symantec's researchers have noted these "faux" (fake) images inserted on legitimate pages, or when the page is accessed - a "pop in" spam message appears moments later. They've also noted that the spammers seem to be able to control how many messages are sent out. No more than one a day is sent to any particular e-mail address -- and a different legitimate newsletter, or retailer is used each time.

According to the researchers, the motivation behind this is to (probably) make the reader more likely to read the message (believe it's credible). This method is possibly also used to in an attempt to trick a lot of the spam filters out there.

The good news is that - according to Kelly - Symantec's filters appear to be catching almost all of this.

A lot of us laugh at spammers and their "seemingly ridiculous" advertising, but the sad truth is, they wouldn't be sending it out if unless some people were falling for it. And that person might be one of your grandparents, or "younger relatives."

Even worse, the products they are "hawking" are questionable and in some instances, dangerous. In addition to this, spam is also used as a means to hook "victims" into all the various Internet scams that I frequently write about.

Symantec covers this issue "online fraud" (and others) on their blog, here.

Screenshot (below) of Kohl's ad being hijacked to sell drugs

2006 was the Year of Internet Crime - 2007 is predicted to be even worse

Have you noticed spam getting past your e-mail filters lately? You're not alone, experts are saying 2006 was the worst year ever in Internet crime - and it appears - security fixes are being defeated.

Brian Krebbs (Washington Post) is warning:

Few Internet security watchers believe 2007 will be any brighter for the millions of fraud-weary consumers already struggling to stay abreast of new computer security threats and avoiding clever scams when banking, shopping or just surfing online.

Washington Post story, here.

Brian cites that in October 90 percent of all e-mail received was spam. And most spam is a come-on for one fraud scheme, or another.

Since "security fixes" are being defeated pretty quickly by organized criminals - who allegedly hire their own computer security experts - the only viable recourse is to go after the source(s) with the intent to put the people behind it out of business.

Resources allocated to fund the investigation of financial crimes are (normally) not funded very well and the people investigating them are "overwhelmed." Maybe we should take some of the money being spent on developing "fixes" and use it to solve the real problem, which is a social one. Prevention seems to only work temporarily.

Security fixes are needed, but if we don't aggressively go after the sources, the criminals develop countermeasures and we have to start all over again.

After all - it seems that organized criminals and some say, terrorists are flocking to this activity because it's financially lucrative and a lot less dangerous than other criminal activities. Until we make it more dangerous for them, the problem is likely to keep growing.

John Bambenek (Assistant Politics Editor for Blogcritics and academic professional for University of Illinois) recently wrote a compelling essay about this subject, here.

Here is a previous post, I wrote about why we are approaching this problem the wrong way:

Are We Addressing Cyber Crime from the Wrong End