Spam Is Making A Comeback, Google Finds

Last November, the volume of spam coming into Google's Postini e-mail security service fell by 70% following the closure of McColo, a San Jose, Calif., Web hosting company that turned out to be more of a spam hosting company.

By the middle of this month, spam had rebounded and was back to its previous level, said Adam Swidler, senior product marketing manager for Google's message security team.

"Spammers have been rebuilding their botnets," he said, adding that Google plans to post details to one of its blogs on Tuesday.

Spam volume, said Swidler, has been creeping upward at a rate of about 1.2% per day as spammers try to rebuild the infrastructure they lost at McColo.

In 2008, the average spam growth rate was 1% per day, a record growth rate up to that point.

Spammers have been resorting to old tricks like malicious payloads, links to malicious Web sites, and messages that leverage interest in current events to bait their scams. Popular spam message themes these days tend to revolve around topics like the economy, job cuts, mortgages, refinancing, and holidays.

According to Swidler, spammers also are trying some new tricks. The most significant, he explained, is the use of location data to target message recipients with locally relevant content.

Typically, this is done by enticing a spam message recipient to click on a link. When an Internet user arrives at the Web site through a link in a spam message, the site reads the visitor's IP address. More often than not, IP addresses can be used to identify the general area where an Internet user resides. Armed with this information, the malicious Web site can serve up an attack tailored to appeal to viewers from a specific region, a technique that generally fools more people than an attack that's not targeted.

Compared with February, the incidence in March of e-mail payload viruses -- attached infected files -- has risen by a factor of nine.

Simultaneously, spammers are sending less spam on Sundays, a day previously popular with spammers, Swidler believes, because corporate IT departments often perform systems maintenance over the weekend.

The assumption appears to have been that more messages would get through during this period, but, said Swidler, "they weren't getting through as many as they thought they might."

2009 marks the 12th year that InformationWeek will be monitoring changes in security practices through our annual research survey. Find out more, and take part.