March 2007 - A Sobering Perspective on Spam

Unlike most people, my entire day is spent focused on spam. When I chat with prospects, I hear about the pain they experience trying to run a business without spam protection, or the pain caused by using a bad spam filter. New customer success stories are always a high point in my day. And, I regularly talk with long time customers who call in to offer suggestions or to ask questions.

When I think of the cost of spam, I think primarily of lost productivity and wasted resources, or business risks such as viruses. Or, I think of identity theft through Phishing or websites run by criminals (the kind who sell your credit card information after you place an order).

My view of spam changed permanently when I read a story in the National Post about a woman who purchased pills from a 'Canadian Pharmacy'... On Wednesday, March 21^st, the Post reported on page A9, that:

A British Columbia woman died after allegedly taking pills purchased through an online pharmacy that represented itself as a legitimate business. The coroner for Vancouver Island set the cause of death as poisoning as a result of ingesting tainted pills purchased over the Internet. CanWest News Service

After reading the story, I paused to reflect on the new purpose spammers had just given my team here at XPMsoftware. We can no longer be satisfied with protecting our customers' identity or their financial health. The risks are now much, much higher than the cost of a bottle of colored corn starch passed off as the latest designer pharmaceutical.

I have already talked with my team about the things we must do to make PerfectMail even more effective. Now, I'd like to ask your help in the ongoing battle against spam.

Get Involved - Help Save a Life

The latest web browsers from Mozilla (Firefox 2.x) and Microsoft (IE 7) both contain Phishing filters. These add-ons are designed to allow the Internet community report bogus web sites created for the sole purpose of identity theft.

Google (Firefox) and Microsoft (IE 7) collect this information and maintain lists of proven fraudulent sites. If you try to visit a site that is on a do not visit list, the browser warns you that the site is likely fake and steers you away from it.

Since spamers use e-mail as a marketing tool to promote websites that sell counterfeit (and potentially lethal) pharmaceuticals, finding them and shutting them down is easy. Here's what I suggest...

The next time you see a spam message promoting an online pharmacy, visit the site. Once there, invoke the browsers anti-phishing tool to report the site back to Google or Microsoft. If you are using Firefox, click Help → Report Web Forgery. If you use MS Internet Explorer, click Tools → Phishing Filter → Report This Web Site.

Before you report a site, be sure it is not legitimate. Spam messages used to promote fake sites are easy to spot:

• An unintelligible sender. Many spammers autogenerate random sender e-mail addresses, something no legitimate site would do.
• The sender's domain name has nothing to do with the product or service being promoted.
• The message contains a single large image (the message) and then random text. Spammers insert random text in an attempt to defeat text based spam filters.
• A nonsense domain name. Domain names used by spammers only last a few days before they are blacklisted. Spammers replace black listed domains with new nonsense domains. Nonsense domains are easy to generate and register... and they are also easy to spot.
• The message doesn't include a valid HTML link to the spammers' site. Spammers want their domain name to last as long as possible. One way they do this is to not use HTML links in their message. There is no valid reason why a legitimate message would not link back to the site it references.
• Bad spelling, grammar, poor layout, etc.

Once you are sure the site is fake, report it. Not only will you get the satisfaction of doing something positive in the war against spam... you may help save a life!


Larry Karnis

________________

I hope you found this article useful. My intent is to help organizations understand, assess and effectively defend against e-mail threats. I would like to receive your thoughts on this article. Please direct your comments by e-mail to Larry Karnis.

© 2007 by Larry Karnis and XPMsoftware. All rights reserved. Permission is hereby granted to quote from this article in whole or in part, or to reproduce this article by any means as long as the the author and XPMsoftware receive appropriate attribution.

About the Author

Comments on this article should be directed to lkarnis@xpmsoftware.com.