Report: 90.4 Percent Of E-Mail Is Spam
Symantec Corp. recently announced the publication of its May 2009 MessageLabs Intelligence Report. The analysis highlights that spam experienced a further increase of 5.1 percent since last month, reaching heights of 90.4 percent. Also in May, MessageLabs Intelligence revealed that geographic location determines the time of day when spam is received, the data also highlights where spammers are most heavily concentrated.
The majority of this increase in spam in May was comprised of messages with very little content other than a subject line and valid hyperlink. Each hyperlink pointed to a different active profile on one of a number of major social networking environments. The profiles were likely created using random names and automated CAPTCHA-breaking tools. Moreover, the e-mails were sent from valid Webmail hosting providers, which means they were not spoofed, as has been the case in the past for these types of domains.
“As spam levels continue to increase, we are seeing existing attack techniques combine and morph into one” said Paul Wood, MessageLabs Intelligence senior analyst at Symantec. “In 2008 CAPTCHA-breaking, social networking spam and the use of webmail for spamming all became popular tactics. Today, the bad guys are using the three together as a triple threat to heighten the effectiveness of their spamming.”
Also this month, MessageLabs Intelligence revealed that geographic location determines when people receive spam. According to research conducted over a seven day period, analysis highlights that U.S. residents see spam peak between 9 and 10 a.m. local time and a drop overnight while Europeans are more likely to receive a steady stream of spam throughout the workday. Those in the Asia-Pacific region start their day with an inbox full of spam and see less trickling in throughout the day.
“These patterns suggest that spammers are more active during the U.S. working day,” Wood said. “This could be because most active spammers are based in the U.S., according to data from Spamhaus, or because this is when the spammers’ largest target audience is online and likely to respond.”
Image spam continued into May with Russian language “ransom-style” spam, reminiscent of traditional ransom messages constructed from letters cut out of newspapers. The content appears to read like a ransom message and is constructed from Russian characters taken from different font styles, however the subject line itself is unrelated translating into, “how to attract customers.” The use of the Russian language character set has become more popular in recent spam runs where the Russian character set is used to hide the English language content, a spamming technique deployed to avoid content folders.
Finally, in May MessageLabs Intelligence debunked a common misconception that cybercriminals are more likely to use less reputable web sites, like those containing adult content, to hide malware. However, the majority, 84.6 percent, of web site domains blocked in May for hosting malicious content were well-established domains more than a year old. Moreover, the number of new websites harboring malware identified daily declined from 3,561 in April to 1,149 in May supporting the trend that cybercriminals favor the more established domains.
“Spammers using better-known and thus more widely trusted web sites to host malware is reminiscent of the spammers who rely on well-known webmail and social networking environments to host spam content,” Wood said. “The trustworthy older domains can be compromised through SQL injection attacks while newer sites are more likely to be flagged as suspicious -- a temporary site set up with the sole purpose of distributing spam and malware -- and thus faster to get shutdown.”
Other report highlights:
Web security: Analysis of Web security activity shows that 34.2 percent of all web-based malware intercepted was new in May. MessageLabs Intelligence also identified an average of 1,149 new websites per day harboring malware and other potentially unwanted programs such as spyware and adware, a decrease of 67.7 percent since April.
Spam: In May 2009, the global ratio of spam in e-mail traffic from new and previously unknown bad sources was 90.4 percent (1 in 1.11 emails), an increase of 5.1 percent since April.
Viruses: The global ratio of email-borne viruses in email traffic from new and previously unknown bad sources was one in 317.8 e-mails (0.31 percent), a decrease of 0.01 percent since April. In May, 7.0 percent of email-borne malware contained links to malicious sites, a decrease of 6.3 percent since April.
Phishing: One in 279.7 e-mails (0.36 percent) comprised some form of phishing attack, an increase of 0.11 percent in the proportion of phishing attacks compared with April. When judged as a proportion of all email-borne threats such as viruses and Trojans, the number of phishing e-mails had remained unchanged at 89.7 percent of all e-mail-borne malware and phishing threats intercepted in May.
The May 2009 MessageLabs Intelligence Report provides greater detail on all of the trends and figures noted above, as well as more detailed geographical and vertical trends. The full report is available at http://www.messagelabs.com/Threat_Watch/Intelligence_Reports.