Future Tense: Spam! A Lot!

Posted 07/08/2010 at 9:59am | by David Gerrold

8

Comments

Print

Depending on who you ask, the percentage varies, but it’s always high. Way too high.

Allegedly, 90% of internet traffic is spam. Or maybe it’s 95%.

Personally, I don’t see as much spam as I used to. I use Gmail and its spam-filtering is pretty good. I haven’t heard from any Nigerians in a long time—which kind of disappoints me, because I always regarded the Nigerian swindle as an opportunity to have some fun.

I learned a long time ago that if something sounds too good to be true, it probably is. So when someone sends me an email telling me that if I will send them my bank account number, they’ll send me ten percent of forty million dollars, my BS alarm goes off big time.

I used to reply to the Nigerians with: “All of us here at the International Outreach Effort of the Institute for Homosexual Research are thrilled at your generosity. Your continuing donations will allow us to do important work all over Africa, educating people everywhere on the importance of gay liberation…. Please tell us how to proceed, etc.”

Why this? Because homosexuality is criminalized in Nigeria. Extremely so. So if someone is monitoring emails in Nigeria, this might very well put a few swindlers out of business in a very nasty way. As far as I’m concerned, swindlers are fair game. And no, I’m not a nice man. Why do you even bother to ask?

But getting back to the subject at hand, the percentage of internet traffic dedicated to malware, trojans, spyware, and spam is still on the rise. It’s an evolutionary process. The more that users protect themselves with security measures, the harder the spammers have to work to get through—and that means increasing both the aggressiveness of the spam they put into the cyber-ecology and the quantity.

While most power-users use a combination of security tools and common sense, there are still way too many people who remain vulnerable to pernicious little phishing tricks. The inventiveness of the criminal class is often astonishing.

The problem with the internet is that it is exactly what it was designed to be.

The original specification for the DARPA network that eventually became the internet, was for it to be a failure-proof network. The breakthrough was the idea that information did not need a continuous one-to-one connection for transmission. Data could be sent in packets from one node to the next. If any node failed, the packet would automatically detour around that node until it found a path through the network to its intended destination. The multiplicity of nodes was the rugged strength of the internet. Internet Service Providers (ISPs) became the entry and exit points for users, providing numerical addresses. What we call the World Wide Web was made possible by linking those numerical addresses to site-specific names like www.google.com or www.maximumpc.com.

But underneath the names, the numerical addresses still represent the real addresses. When you type in a site name, the Domain Name Server decodes it to the numerical address to make the connection.

And therein lies a partial solution to the problem of spam. Partial.

All spam and malware has to have an entry point. The ISPs control internet traffic. If ISPs had the power to shut down spammers at the source, a great deal of spam could be virtually eliminated. And to some degree, some ISPs have been responsible about shutting down criminal operations—when they are aware of them.

One part of the problem is that a lot of spam and malware comes in with spoofed (false) home addresses. One of the better suggestions I’ve heard is to add authentication to packet forwarding. Very simply, the receiving computer would send an inquiry back to the sending address. Did you send this message? If the address has been spoofed there will either be a negative reply or no reply at all, and the receiving computer will discard the packets as invalid. This would stop some, perhaps even many, kinds of malware schemes.  

A few years back, I got an angry email from someone I did not know, claiming that I had sent him spam. I politely pointed out to him that the latest (at that time) trick of spammers was to raid the contact list of the infected computer, using one or more names from that contact list as spoof-addresses for the spam sent to everyone else. The enraged person replied that I was still at fault for having my name in the contact list of someone so careless as to allow his machine to be infected with malware. I replied that he had obviously been equally at fault for allowing his name to be in the same contact list. He did not reply to that. (Okay, I already admitted I’m not a nice man. Why do we keep having to have this conversation?)

One objection to authentication schemes is that they might slow down honest traffic—but my theory is that if we could eliminate the 90% of the traffic that is spam, everything else gets speeded up correspondingly and there’s more than enough time for authentication.

Another way to attack spammers at the source is to shut down questionable addresses—but spammers buy addresses by the terabyte. Shut down one and the spammer will open six more. It becomes a wild moose chase. (Geese are easy to track. Do you really want to piss off an angry moose?)

Let’s consider another way to improve internet security. I call it the ISP-peer-pressure method. Let’s assume there’s an ISP that provides a safe-haven for spammers and pirates. (An easy assumption, there’s more than one.) After enough back and forth traffic, it should be obvious how much of that service provider’s traffic is malicious. At that point, other ISPs start downgrading its traffic, slowing it down more and more until that ISP becomes functionally useless. It then becomes the responsibility of that ISP to police itself. When it cleans up its act, restoring its integrity, the service resumes. (Of course, this does penalize the honest users of that ISP, but I don’t doubt they will put immediate pressure on their ISP to get rid of the customers who compromise their access.)

This would probably require a rating system among ISPs, based on an analysis of traffic or some other reliable metric, but I can’t think of a better way to control spam than to put the responsibility for policing it onto the shoulders of those who are profiting by providing the access.

There are probably other good methods to go after internet criminals and spammers. But ultimately, it boils down to a question of cost-effectiveness. How much time and effort and resources are you willing to spend to guarantee your security? And how much time and effort and resources is the criminal willing to spend to break your security?

Because the individual is effectively outnumbered by the spammers and because no anti-malware is 100% effective, the only real defense is a united effort. Given that cyber-crime is now costing all of us hundreds of millions, even billions of dollars a year, we can’t afford not to take action.

In principle, we need to make it so hard for spammers to do their mischief that it’s no longer cost-effective. In practice…there will always be those who can’t resist the challenge, whether it’s profitable or not.

But I believe there’s a lot more we can do and must do to make spam unprofitable.

What do you think?