Spam Evolution: January – July 2007. Executive Summary

Kaspersky Lab has released Anna Vlasova’s half-year report on spam, covering the first six months of 2007.

The report begins by addressing the tactics used by spammers over the first half of the year. In February, spammers returned to experimenting with graphical and animated spam using images that were broken into fragments and used different fonts in one email. New tactics showed recipients images within the message, making it possible for spammers to bypass using images in an attachment. Instead, links to images on websites with free hosting were included in the body of the email, or images were used as a background in the email. Another new tactic is the use of .pdf and .fdf format attachments to emails. In this instance, spammers are hoping that these attachments will go undetected by spam filters.

Over the course of the reporting period, it became clear that graphical spam has turned out to be less effective thanks to the continued evolution of spam filters. But it is also obvious that spammers have no intention of abandoning this tactic altogether.

There are a number of different categories of spam. The article identifies the top five categories over the first six months of 2007 (and their respective percentages of all spam):

1. Medications: health related goods and services (17.3% of all spam).
2. Education (13.8%)
3. Computers and the Internet (9.2%)
4. Computer fraud (8.9%)
5. Electronic advertising services (8.3%)

The amount of spam in the medications: health related goods and services category is traditionally high and increased from 11.5% in January to 21.4% in June. In addition to the English-language advertisements for Viagra and Cialis most often seen in this category of spam, there were Russian language messages advertising massaging glasses, self-help books on how to quit smoking and gym memberships.

The Education category primarily consists of Russian-language offers for training courses and seminars, as well as English-language offers for fake degrees and diplomas.

The computers and the Internet category is mostly made up of English-language offers for unlicensed software.

The high numbers for the categories in fourth and fifth place - computer fraud and electronic advertising services – demonstrate that spammers are still actively looking for new clients.

The personal finance category also deserves mention. During the first ten days of June, this category reached a new record low of 1.1% of all spam. The author of the report pinpoints a number of reasons behind this decline: saturated consumer demand, improved spam filters, and increased attention paid to financial spam on the part of the Canadian and US authorities.

One major event in the world of spam in the first six months of the year was the appearance of phishing attacks targeting Russian Internet users. The first victim of these attacks was Alfa-Bank. Phishers attempted to steal personal account data in the online banking system using a traditional phishing tactic: attempting to lure users to a false website. A number of similar attacks also targeted the Yandex.Dengi e-payment system.

Attempts to attack the users of Russian services are quite rare. The events of the first half of 2007 clearly indicate that the spammers are carrying out their own type of feasibility study. It seems they have given up for now, but new attacks are likely to be detected in the future.

Anna Vlasova also provides predictions for the second half of the year. Specifically, she notes that users should not be overly concerned about the threat of .pdf and .fdf spam attachments. Spammers are much more likely to work on improving graphical technology, and there may be a renewed upsurge of old spammer tactics in addition to the appearance of new approaches.

In general, spam mailings are expected to become more targeted by focusing on certain social groups, geographical locations, age-groups, languages and other groups. Signs of this emerging trend of targeted spam are already evident today.