You've got spam!
SPAM email seems to be on the rise. It is rare for a week to go buy without a church member asking me why they are receiving emails that are less than desirable. Most of the time their question is accompanied with a caveat that they have never sent emails to these folks, browsed their web sites, etc. I can understand. I get those emails too.
So, why is their SPAM in your inbox? Here are a couple of thoughts:
- The same technology that makes email great also makes it weak
- Combatting spam is an arms-race and we're living in Berlin
- SPAM costs the spammer almost nothing, so they will make money.
Email is a great communication medium because of interoperability. In simple terms, you can send email to any person on the planet as long as you have their correct email address. Assuming there are no problems such as a full mailbox, they will get your message. There is no advanced configuration or pre-coordination required. You type your message, hit send, and as a benefit of globally accepted standards, your message will show up in a few minutes. Every time you buy a stamp at the post office you can see the global success of email.
The global standards for email are weak in several ways. For example it is easy to create an email message that appears it came from someone else (just using Outlook Express). There is no reliable way to determine where an email came from. This is why you should never respond to an email with bank account information, etc. Spammers take advantage of these holes.
Various approaches are in the works for beefing up to standards for email to overcome these issues. We will probably have to go through a global upgrade to fix it. It will become one more of those technology-driven upgrades that will impact consumers (see HDTV, underground utilities, alternative fuels, etc). You might have to upgrade or replace that Windows 95 machine for your email to continue to function.
Combatting spam is an arms-race and we're living in Berlin
SPAM email comes to you through a sophisticated decentralized ecosystem. First of all the spammer does not maintain a huge data center to send millions of emails. They do not maintain a list of email addresses. They do not even maintain the systems that sell their wares. They lease these assets from other folks on the Internet who have gained control of these assets through a mix of ingenuity and illegal activity. In general we have multiple people or organizations in the ecosystem. The spammer, the email address harvester, the bot herder, and the vendor.
- The vendor has a product to sell.
He hires the spammer to send out the messages and processes orders that come through the spammer.
- The email address harvester works to develop a list of known-good email addresses which are for sale.
They use brute-force approaches and other techniques to locate email addresses. For example they might concatenate various combinations of initials with first and last names to build candidate email addresses. They then use the spamming network to send out sacrificial email messages. These messages are specially formatted so that if you open the message it will send a signal home to the harvester that the email address is "good". For example they might download an image in the email message from one of their servers. When you open the email, a request goes to their server for the very small (1 pixel by 1 pixel) image at a unique address that is based on the email. This is a simple description of the very elaborate techniques that the harvester uses to obtain, validate, and characterize email addresses.
- The botnet herder has a decentralized network of computers with high-speed Internet connections that can send millions of email messages and process incoming orders.
A botnet is essentially a transportation system utility. A good analogy would be a railroad. The railrood maintains the tracks, engines, and freight cars and rents them at market rates to move goods from point A to point B. The railroad does not own the freight that it carries. The difference between the botnet herder and a railroad is that the botnet herder does not own all of the computers and internet connections that he is using. He has stolen them. Typically a botnet herder uses viruses and security vulnerabilities to compromise computers on the Internet. Once the machines are compromised the botnet herder adds them to his distribution network. The header carefully balances the workload that he assigns to each computer so that he can keep using them for as long as possible. Many users are unaware that their computer is controlled by others and has a devious alter-ego. This is why you should run up-to-date firewall and virus scanning software.
- The spammer brings all of these folks together and bingo! You've got spam.
SPAM costs the spammer almost nothing, so they will make money
Spammers send out millions of emails at once. They have very little overhead. If just a tenth of 1 percent of the emails result in a purchase, they make money. As a long as they make money, SPAM will continue.


