SPAM – Part 2

SPAM – Part 2

In this, the second part of the series, we’ll examine the more insidious side of spam: using your own (compromised) email account, bandwidth, and ISP services to send spam on behalf of or by the spammers.

SPAMMERS are free loaders. They want to do as little and spend as little money as possible to bombard people’s inboxes with junk email. They achieve this by using other people’s email addresses to send out their spam.

Account Compromised

But wait. How do they know your email address and password? Currently, the more common methods to gain your details are:

• ‘phishing web sites’ – the SPAM email contains links to a fake banking site or webmail site, typically asking you to confirm your login details. Don’t do this!
• ‘unsubscribe’ link (or similar). You’ve got SPAM, you know it’s SPAM, but hey, they provide a handy ‘unsubscribe’ link to click, so you don’t receive future emails. Don’t do this!
• you open an attachment from an unknown source, installing malware Don’t do this!
• You chose a weak, easy-to-guess password and/or have been using the same password across multiple sites. Don’t do this!

Malware

Once the bad link is clicked, malware can be silently downloaded and installed on your PC. The malware captures your login details, sends the information to a “Botnet” controller server that collects all these addresses. At a predetermined time, these Botnets are launched, and suddenly your email address is being used to send thousands of SPAM messages to the world.

This is detrimental to you, your ISP, and every other legitimate email user on the Internet. Your email address will become blacklisted, and this may lead to your ISP’s mail servers being blacklisted as well.

OPQ Reacts

At OPQ, we proactively monitor our customers’ outbound emails for signs of potential spam and compromised PCs. When the alarm is triggered, the errant email user’s mail account is suspended, and the password is immediately changed. This usually stops the attack within a few minutes with only a brief interruption to email services.

At this point, OPQ will insist that all devices using the problematic email account be scanned and cleaned with antivirus tools. A report is provided before the account suspension is lifted.

In Part 3 of this series, we’ll explore ways to identify spam more easily and discuss potential methods to stop spam altogether.