Computer SPAM; The Impact of Unsolicited Email on Information … · 2014. 10. 25. · Spam and...

18
Information Security Management May 2014 Computer SPAM; The Impact of Unsolicited Email on Information Security Mahmood H. Shubbak May 2014 Author Note - Words in italics are explained in the Glossary at the end of this research paper.

Transcript of Computer SPAM; The Impact of Unsolicited Email on Information … · 2014. 10. 25. · Spam and...

Page 1: Computer SPAM; The Impact of Unsolicited Email on Information … · 2014. 10. 25. · Spam and Information Security Mahmood Shubbak Spring 2014 1 Abstract Spam, or the unsolicited

Information Security Management May 2014

Computer SPAM; The Impact of Unsolicited Email

on Information Security

Mahmood H. Shubbak

May 2014

Author Note

- Words in italics are explained in the Glossary at the end of this research paper.

Page 2: Computer SPAM; The Impact of Unsolicited Email on Information … · 2014. 10. 25. · Spam and Information Security Mahmood Shubbak Spring 2014 1 Abstract Spam, or the unsolicited

Table of Contents

Abstract ..................................................................................................................................... 1

Introduction .............................................................................................................................. 2

What is Spam?.......................................................................................................................... 2

Spam Types............................................................................................................................... 3

Statistics and Figures ............................................................................................................... 4

Spam Volume......................................................................................................................... 4

Spam Sources and Themes .................................................................................................... 5

Driving Factors......................................................................................................................... 6

Email Addresses Harvesting ................................................................................................... 8

Spam Impact............................................................................................................................. 8

Legal Aspects ............................................................................................................................ 9

Reduction Methods ................................................................................................................ 10

Users Level .......................................................................................................................... 10

Email Providers Level.......................................................................................................... 11

Spamming Botnets Takedown ............................................................................................. 11

Conclusion .............................................................................................................................. 12

Glossary .................................................................................................................................. 13

References ............................................................................................................................... 14

Page 3: Computer SPAM; The Impact of Unsolicited Email on Information … · 2014. 10. 25. · Spam and Information Security Mahmood Shubbak Spring 2014 1 Abstract Spam, or the unsolicited

Figures

Figure 1: Screenshot of mail inbox full of Spam (HBE, 2008) ................................................. 2

Figure 2: CryptoLocker; example of spam-transmitted malware (Cisco, 2014) ....................... 3

Figure 3: Spam percentage of overall email traffic in 2013 ...................................................... 4

Figure 4: The volume of Spam in global email traffic in 2013 (SIO, 2014) ............................. 4

Figure 5: Advertising percentage in Media ............................................................................... 5

Figure 6: The top ten global spam origins and languages (Cisco, 2013) ................................... 5

Figure 7: The top themes for spam messages worldwide in 2013 (Cisco, 2014) ...................... 6

Figure 8: The parasitic economics of spam (Cobb, 2003) ......................................................... 7

Figure 9: The percentage of the blocked, filtered, and delivered messages by Microsoft ..... 11

Tables

Table 1: Comparison between different advertisement methods (Boehme & Holz, 2006) ....... 6

Table 2: Spam Reduction Methods Summary ......................................................................... 12

Page 4: Computer SPAM; The Impact of Unsolicited Email on Information … · 2014. 10. 25. · Spam and Information Security Mahmood Shubbak Spring 2014 1 Abstract Spam, or the unsolicited

Spam and Information Security Mahmood Shubbak

Spring 2014 1

Abstract

Spam, or the unsolicited email messages are widely considered as risk on information

security of both individual and businesses. It wastes users’ time, reduces their productivity

and costs organisations huge amount of money on storage units and spam filters. It also might

incorporate with various types of fraud, data phishing, and malware. Moreover, spam costs

the email service providers an extreme unnecessary share of the global email traffic. In this

research paper, a brief explanation of the spam problem, its types, and statistics on its global

volume, sources and themes are provided. In addition, the economical driving factors for

spammers, their methods in collecting valid email addresses and building Botnets, as well as

the negative impact of their activities are explained in the second part of this paper. In the last

part, an overview of the regulating laws in the United Kingdom; the Privacy and Electronic

Communications Regulations 2003, and the United States of America; the CAN-SPAM 2003

act, as well as the commonly used reduction methods by the email providers’ servers, and

best practice instructions for users to mitigate the spam risk on their information security.

Keywords: Spam; Junk mail; Malware; Impact; Information Security; Legal aspects

Page 5: Computer SPAM; The Impact of Unsolicited Email on Information … · 2014. 10. 25. · Spam and Information Security Mahmood Shubbak Spring 2014 1 Abstract Spam, or the unsolicited

Spam and Information Security Mahmood Shubbak

Spring 2014 2

Computer SPAM; The Impact of Unsolicited Email

on Information Security

Mahmood H. Shubbak

Cardiff Metropolitan University

Introduction

With the widespread use of electronic means for communication and data transmission over

the Internet, many new types of risks on information security have appeared, such as

information stealing, fraud, computer viruses, as well as the unsolicited email messages;

Spam.

In this research paper, a brief explanation of spam, its types, sources, global volume, and

economics, as well as spamming methods, laws and regulations are introduced, followed by

an overview of the commonly used reduction methods and some advices for users and

enterprises on how to protect their information security from this risk.

What is Spam?

The terms spam, junk mail, or unsolicited bulk email are usually used to describe the practice

of sending commercial email messages blindly to a huge group of people without consent

(Encarta, 2008). The identity and address of spam sender are usually concealed (SpamLaws,

2010) while the sender generally does not target recipients personally (ICO, 2014).

Spam emails are usually sent for advertisement and commercial purposes. However, they are

sometimes used for phishing recipients’ personal and financial details, or might involve some

kinds of viruses and other malware infection. Figure 1 shows a screenshot of email inbox full

of spam messages (HBE, 2008).

Figure 1: Screenshot of mail inbox full of Spam (HBE, 2008)

Page 6: Computer SPAM; The Impact of Unsolicited Email on Information … · 2014. 10. 25. · Spam and Information Security Mahmood Shubbak Spring 2014 1 Abstract Spam, or the unsolicited

Spam and Information Security Mahmood Shubbak

Spring 2014 3

Beyond email environment, spam can be found in most, if not all, electronic communication

and sharing methods; such as instant messaging, mobile phone text messages, forums,

newsgroups, blog comments, online gaming, as well as social networking.

Spam is widely considered as a serious problem; besides wasting people's time and efforts

dealing with unwanted messages, spam also consumes a huge share in the global network

bandwidth (Stroud, 2006). Moreover, fraud, data phishing and other cybercrime activities,

associated with it, can form a huge risk.

Spam Types

Based on their purpose, spam emails can be categorized into two main types; advertising and

fraud. While most spam messages are for commercial purposes of advertising and promoting

various kinds of goods and services, some bulk mailings are completely fraud; such as asking

the recipient to provide personal or bank account details, or to download programs or

software tools that comprise some kind of malware, or sometimes by forwarding him/her to

an infected link. This type of spam is usually called ‘scam’ (Kaspersky, 2010).

An example of a ‘spam-transmitted malware’ is the ransomware Trojan; CryptoLocker,

which infected many computers in the fall of 2013. Disguised as a legitimate email

attachment, CryptoLocker began encrypting victims’ files with a combination of RSA 2048-

bit key pairs and AES-256, considered unfeasible to break, asking victims to pay amounts of

money within specific time, to avoid losing their data forever. As shown in Figure 2 (Cisco,

2014).

Figure 2: CryptoLocker; example of spam-transmitted malware (Cisco, 2014)

Page 7: Computer SPAM; The Impact of Unsolicited Email on Information … · 2014. 10. 25. · Spam and Information Security Mahmood Shubbak Spring 2014 1 Abstract Spam, or the unsolicited

Spam and Information Security Mahmood Shubbak

Spring 2014 4

Statistics and Figures

Spam Volume

Starting since the release of the electronic mail services for the general public in early 1990s,

the spam problem has grown exponentially over years. According to Cisco Security

Intelligence Operations SIO 85.6% of the global email traffic in 2013 was spam; with

average volume of 106 Billion spam emails daily, comparing to 17.7 Billion daily legitimate

emails in the same year. As shown in figures 3 and 4 (SIO, 2014).

Figure 3: Spam percentage of overall email traffic in 2013

Figure 4: The volume of Spam in global email traffic in 2013 (SIO, 2014)

To understand the size of the problem, let’s compare these statistics to the advertising overall

average in other printed, audio, and visual media. Figures from United States and United

Kingdom will be used here as examples. The Independent regulator and competition

authority for the UK communications industries (Ofcom) determined the Allowances for

advertising and teleshopping for audio-visual media not to exceed a limit of 7 minutes per

hour on public service channels (11.7% of the overall broadcasting), and 12 minutes per hour

on other channels (20%). (Ofcom, 2010). Furthermore, in the written media, 20 to 25% of the

daily newspapers pages in the USA fall into the ‘Advertising only’ category (RI, 2001).

Spam 85.66%

Legitimate Email 14.33%

Malware 0.01%

Glo

bal

Em

ail

Vo

lum

e in

Bil

lio

ns

Page 8: Computer SPAM; The Impact of Unsolicited Email on Information … · 2014. 10. 25. · Spam and Information Security Mahmood Shubbak Spring 2014 1 Abstract Spam, or the unsolicited

Spam and Information Security Mahmood Shubbak

Spring 2014 5

Figure 5: Advertising percentage in Media

Spam Sources and Themes

This huge volume of spam messages is sent daily from all over the world. In 2012, India were

recorded as the top source of spam globally, with a share of 12.3%, the United States of

America came second with a share of 11.4% of the global spam. Figure 6 below shows the

top ten global spam origins, and languages, as stated in the 2013 Cisco Annual Security

Report (Cisco, 2013).

Figure 6: The top ten global spam origins and languages (Cisco, 2013)

Bank details phishing, commercial advertisements, and online dating were the most used

themes in spamming in 2013. However, spammers recently start to use topics related to the

social media networking because of its growing popularity among email users. Figure 7

below shows the top themes for spam messages worldwide, according to Cisco Annual

Security Report (Cisco, 2014).

0.00% 20.00% 40.00% 60.00% 80.00% 100.00%

TV public channels

Other TV channels

Daily Newspapers

Spam Email

Page 9: Computer SPAM; The Impact of Unsolicited Email on Information … · 2014. 10. 25. · Spam and Information Security Mahmood Shubbak Spring 2014 1 Abstract Spam, or the unsolicited

Spam and Information Security Mahmood Shubbak

Spring 2014 6

Figure 7: The top themes for spam messages worldwide in 2013 (Cisco, 2014)

Spamming process involves three main parties; the spammer, the email delivery service

provider, and the recipient. In the following sections, the motivations and impact on each

party of those will be discussed from an information security point of view.

Driving Factors

In their paper, (Boehme & Holz, 2006) refers to an interesting comparison between different

advertisement methods in terms of their cost and associated number of recipients. It shows

that spam has the least cost per recipient of only $0.0005, which is 70 times less than online

advertisements. As shown in Table 1 below.

Table 1: Comparison between different advertisement methods (Boehme & Holz, 2006)

Total cost Number of recipients Cost per recipient

Direct mail $ 9,700 7,000 $ 1.39

Telemarketing $ 160 240 $ 0.66

Print – targeted $ 7,500 100,000 $ 0.075

Print – general $ 30,000 442,000 $ 0.067

Fax $ 30 600 $ 0.05

Online ads $ 35 1,000 $ 0.035

Spam $ 250 500,000 $ 0.0005

Page 10: Computer SPAM; The Impact of Unsolicited Email on Information … · 2014. 10. 25. · Spam and Information Security Mahmood Shubbak Spring 2014 1 Abstract Spam, or the unsolicited

Spam and Information Security Mahmood Shubbak

Spring 2014 7

In light of these figures, it becomes clear why there are huge amounts of spam emails

generated and delivered daily. It is “the parasitic economics of spam” (Cobb, 2003); while the

cost per message decline rapidly with volume for spammers who use cheap or sometimes free

tools, the case is totally the opposite for recipients who need more time, mailbox capacity,

and effort for processing these loads of junk mails. As shown in Figure 8.

Figure 8: The parasitic economics of spam (Cobb, 2003)

Furthermore, the free nature of most email services attracts scammers to upload and distribute

their viruses and all other kinds of malware, and carry out their phishing and fraud activities

as well.

In both cases; advertising spamming and scamming, “the cost per transmission to the

spammer is so low that a tiny success rate is acceptable” (Anderson & Moore, 2008), even “a

return rate as low as 0.001% can be profitable” (Cobb, 2003), which means that making only

one successful commercial deal out of 100,000 spam email messages sent, can still be

considered profitable.

As an example of the revenue that the first type spammers, marketers, can gain; in one case, a

mailing of 3.5 million messages resulted in 81 sales in one week. For each sale, the marketing

company got $19 as commissions, which equals a net revenue of $1,555 against a very low

sending costs; less than $300 (Mangalindan, 2002).

When it comes to Scammers, the second type of spammers, huge profits are made by

breaking the law and lying on customers about fake services or products. In his paper (Cobb,

2003) referred to Arizona company that used to buy ‘herbal’ pills at $2.50 per bottle and

resell them via email for $59.95, under misleading label. “When the company was busted by

the State Attorney General, the seized profits included nearly $3 million in cash; a large

amount of expensive jewellery; more than $20 million in bank accounts; 12 luxury imported

automobiles (including 8 Mercedes plus assorted models from Lamborghini, Rolls Royce,

Ferrari and Bentley); an office building; and assorted luxury real estate in Paradise Valley

and Scottsdale”.

Page 11: Computer SPAM; The Impact of Unsolicited Email on Information … · 2014. 10. 25. · Spam and Information Security Mahmood Shubbak Spring 2014 1 Abstract Spam, or the unsolicited

Spam and Information Security Mahmood Shubbak

Spring 2014 8

Email Addresses Harvesting

Spammers use many ways to collect valid email addresses, in his paper (Brain, 2010)

mentioned many of these ways such as:

1. Newsgroups, Chat Rooms, and social networking sites (Polakis, et al., 2010).

2. Searching the Web for the ‘@’ symbol that indicates email addresses. Such kind of search

engine programs are often called ‘spambots’. Business addresses are more likely to be

collected by this method since they are usually shown directly in the enterprises’

websites.

3. Carrying out a dictionary search of the email servers of large hosting companies, starting

with a known address and randomly generate addresses by slight changing it, and test

their availability.

4. Websites that are specifically created to attract email addresses using various methods

and claims such as asking users to enter their email addresses to get some documents,

newsletters, or to get registered for a prize draw.

5. Or, in the past, by buying email addresses lists of other sites’ users.

Spam Impact

On the other hand, spam has a negative impact on the recipients and the email delivery

network as well (Bauer, et al., 2008);

1. Spam costs recipients effort and time for processing or even deleting it from their mail

inboxes. This might lead to reducing the employees’ productivity and wasting some of

their working time for purposes beyond their main job duties. (NR, 2003) shows that

spam costs the average organization about 1.4% of employee productivity, for about 6.5

minutes daily wasted. In estimation back in 2003, spam globally cost $20 billion in lost

productivity (Lyman, 2003).

2. Spam can contain some embarrassing, offensive, or inappropriate content.

3. With email inbox full of unsolicited messages, it becomes difficult to recognise the

legitimate emails. Some important messages might get lost or accidentally deleted.

4. As many spam messages are aimed for fraud or illegal goods promotion, recipients might,

by responding to it, lose their money in fake commercial operations.

5. Recipients might also encounter personal and financial details phishing attacks that also

might cause them financial losses.

6. Besides to its financial harm, spam transmitted spyware also involves large risk on

recipients’ privacy.

7. Some spam contains viruses and other malware that can damage the recipients’ systems.

The loss becomes more severe when enterprises systems are infected by them; such harm

is not only in terms of systems hardware or software, but also it might affect their service

delivery time for customers, which can directly affect their reputation. Moreover, this

damage might cause data loss, which certainly cost much money.

8. These risks lead business organisations to use some security systems, anti-malware, spam

filters, as well as additional storage units, which can be considered as additional costs.

Page 12: Computer SPAM; The Impact of Unsolicited Email on Information … · 2014. 10. 25. · Spam and Information Security Mahmood Shubbak Spring 2014 1 Abstract Spam, or the unsolicited

Spam and Information Security Mahmood Shubbak

Spring 2014 9

9. On the other hand, spam consumes high portion of the global email traffic, costing the

email delivery networks and servers a lot of power and storage space for transferring and

storing unsolicited data; which reducing their efficiency.

10. Also on email service providers, spam has negative effects on their reputation, users’

confidence, and quality of service.

In 2007, Ferris Research, a web security research company in California, estimated the global

cost of spam at US$ 100 billion (SPAMfighter, 2008).

Legal Aspects

In light of the previously mentioned cost that spam has on both recipients and email servers,

lawmakers have made laws and regulations that control the email communication processes,

and prevent unsolicited mailing activities.

In this section, two laws will be discussed briefly; the CAN-SPAM 2003 act in the United

States of America, and the Privacy and Electronic Communications Regulations 2003 in the

United Kingdom.

CAN-SPAM, stands for ‘Controlling the Assault of Non-Solicited Pornography and

Marketing’, were signed by the American president in December 2003, and put into action in

2004. The law contains many terms for online marketers to abide by when sending emails for

commercial purposes, the list below summarises these main requirements (Jennings, 2004):

- It prevents senders from using fraudulent transmission data or misleading sender or

subject lines.

- Senders should add their valid postal address to each email.

- Email lists should be ‘opt-in’, i.e. the acceptance of recipients for their addresses to be

added to the list is required, otherwise, the emails should “include a clear notice that

states the email is an advertisement or solicitation in commercial messages” (USA, 2003)

- Every email should include a "clear and conspicuous" unsubscribe mechanism ‘opt-out’.

- Senders should have a process for handling unsubscribes within the 10-day window.

- Senders are prevented from sharing the address of their subscribed persons with any third

party without their permission.

- Email addresses harvesting as well as randomly addresses generators are forbidden.

- The subject line should readily identify the message content.

The CAN-SPAM Act involves penalties of fine, imprisonment for no more than 5 years, or

both, for particular offenses.

Containing very similar terms, the Privacy and Electronic Communications Regulations

PECR, approved by the UK parliament in December 2003, goes a step further by requiring

organisations to only send marketing emails to individuals who “have agreed to receive them,

except where there is a clearly defined customer relationship” (ICO, 2014). The full text of

these regulations can be found in the UK legislation archive website (UK, 2003).

Page 13: Computer SPAM; The Impact of Unsolicited Email on Information … · 2014. 10. 25. · Spam and Information Security Mahmood Shubbak Spring 2014 1 Abstract Spam, or the unsolicited

Spam and Information Security Mahmood Shubbak

Spring 2014 10

However, it is worth mentioning here that since a lot of spam comes from overseas, such

national legislations are not capable, alone, of completely eliminating the spam problem.

Reduction Methods

Analysing the ‘parasitic economics’ model of spam, the immediate suggestion for eliminating

spam might be to charge some fees for sending email messages. However, such a solution is

very difficult to be applied for many reasons. First, there are many email service providers

around the web, such as Yahoo and Gmail, depend on their free email services to attract

users, while making profit from selling online advertisements. In other words, the economic

system for these businesses is built on the free services, so changing this system by charging

fees per email message is not a simple matter. Moreover, this solution might have a negative

effect on the email usage volume around the world, Emails might be less used, and online

communicating will become difficult.

To reduce the amount of spam emails, many methods are used both at the users’ practice

level and the email providers level, as follows:

Users Level

Email security experts advise users to adhere to ‘best’ practice, that can help in reducing the

amount of unsolicited email messages they receive (ICO, 2014), such as:

- To be careful with whom you share your email address.

- To have separate personal and business email addresses.

- Not to put your email addresses directly on internet webpages, and -when necessary- to

put it not as a text but as an image, or to write it without the ‘@’ symbol; e.g.

person(at)example.com instead of [email protected].

- To check privacy policies when subscribing in marketing websites or newsletters.

- To check for the ‘opt-out’ option and use it to unsubscribe.

- When there is no ‘opt-out’ option available, avoid responding to spam emails, since

replying indicates that your email address is active.

- Never to click on the hyperlinks, images, or any adverts in spam emails, and don’t

download the attached files if any.

- To use a spam filter on your computer, or check that such filters are used by your email

service provider.

- To keep your systems well maintained and up to date.

- To make sure that you have up-to-date anti-virus software.

- To move any unsolicited messages to the spam (sometimes called bulk or junk) folder.

This can help your email provider to identify spam sources and update their filters, i.e.

prevent these messages from reach your inbox again.

- For enterprises, to develop an internal code of conducts that prevents the employees from

using their business email addresses for personal or online shopping purposes. And also

to use internal spam filters on their servers and networks. “Companywide spam filters

reduce the productivity loss from spam by 26%” (NR, 2003).

Page 14: Computer SPAM; The Impact of Unsolicited Email on Information … · 2014. 10. 25. · Spam and Information Security Mahmood Shubbak Spring 2014 1 Abstract Spam, or the unsolicited

Spam and Information Security Mahmood Shubbak

Spring 2014 11

Email Providers Level

Email service providers usually use specific filtering systems and techniques to detect and

block spam. Some filters scan the content of messages and their subjects in order to filter the

spam out. Others rely on blocking email messages from the ‘bad addresses’ lists; senders

from whom a lot of messages were reported as spam (Cobb, 2003).

Another approach that is used in Microsoft Outlook email systems is to put limits on the

volume and type of email that users can send (Outlook, 2012). These limits are on the daily

allowed number of messages that user can send, as well as the number of recipients for each

message. Moreover, Outlook introduces a reputation score for each email account, which is

related proportionally to the user’s volume limits.

The data shown in the following graph were collected from multiple editions of the Microsoft

Security Intelligence Report in the period from 2006 to 2014 (Microsoft, 2014). It shows the

percentage of the blocked (not delivered), filtered (to the junk email folder), and delivered

messages by Microsoft email services in the period from the first half of 2006 (1H06) to the

first half of 2013 (1H13).

Figure 9: The percentage of the blocked, filtered, and delivered messages by Microsoft

Spamming Botnets Takedown

The final effective method in fighting spam, is the takedown of the spammers botnets; i.e.

closing the spam sources. As shown in the previous figure 9, the amount of spam was

decreased significantly in 2011, because of the successful takedowns of a number of large

spam-sending botnets; Cutwail in August 2010 and Rustock in March 2011(Microsoft, 2014).

Table 2 below summarises the main spamming activities and the corresponding used methods

for reducing them.

40%

50%

60%

70%

80%

90%

100%

Delivered

Filtered

Blocked

Page 15: Computer SPAM; The Impact of Unsolicited Email on Information … · 2014. 10. 25. · Spam and Information Security Mahmood Shubbak Spring 2014 1 Abstract Spam, or the unsolicited

Spam and Information Security Mahmood Shubbak

Spring 2014 12

Table 2: Spam Reduction Methods Summary

Reduction Methods

Bes

t P

ract

ice

Dis

gu

isin

g

Ad

dre

sses

Sp

am

Fil

ters

An

tim

alw

are

Blo

ckin

g

Vo

lum

e

Da

ily

Lim

its

Rec

ipie

nts

Lim

its

Rep

uta

tio

n

Sco

re

Sp

amm

ing

Act

ivit

ies Collecting Email Addresses

Sending to many Addresses

High Rate Message Sending

Fraud and Phishing

Malware Attachments

Infected Links

Conclusion

When I have started with this research two weeks ago, the counter of spam comments in my

‘under-construction’ website (shubbakom.wordpress.com) stated that Akismet; a spam

filtering software, has protected my site from 42 spam comments. The counter has reached

249 now.

No matter how hard we try to reduce them, it must be admitted that the issue of junk emails

cannot be totally eliminated, at least in the near future. However, seeing the full half of the

glass, it is obvious that spam as all other cybercrime means has helped, in a way or another,

in creating smart filtering algorithms, developing the information security systems,

discovering and solving many bugs in the electronic communication systems.

Paper Statistics

Word Count: 3,153 Number of References: 26

Number of Pages: 15

Page 16: Computer SPAM; The Impact of Unsolicited Email on Information … · 2014. 10. 25. · Spam and Information Security Mahmood Shubbak Spring 2014 1 Abstract Spam, or the unsolicited

Spam and Information Security Mahmood Shubbak

Spring 2014 13

Glossary

Botnet: a large number of compromised computers that are controlled by a third party in order to

perform tasks; (is usually used for transmitting malware or spam, or to launch attacks).

Cybercrime: criminal activities carried out by means of computers or the Internet, such as

fraud, viruses and malware.

Malware: short for malicious software, is software that is intended to disrupt computer

operation, steal information, or damage computer systems, such as viruses, spyware, and

Trojan.

Opt-in: choose to participate in something. Usually used for subscribing email address into

newsletters and marketing lists.

Opt-out: choose not to participate or continue in something. Usually used for unsubscribing

from newsletters or marketing mailing lists.

Phishing: the fraudulent attempts to make individuals reveal their personal or financial

information, such as passwords and credit card numbers.

Ransomware: a type of malware designed to restrict access to a computer system until a

specific sum of money is paid.

Spyware: a type of malware that is used for spying; gathering others’ information without

their permission or knowledge.

Trojan: a type of malware that appears as a legitimate computer program or tool. However,

it performs or facilitates some criminal activity when it is run.

Page 17: Computer SPAM; The Impact of Unsolicited Email on Information … · 2014. 10. 25. · Spam and Information Security Mahmood Shubbak Spring 2014 1 Abstract Spam, or the unsolicited

Spam and Information Security Mahmood Shubbak

Spring 2014 14

References

Anderson, R. & Moore, T., 2008. Information Security Economics – and Beyond. Cambridge,

University of Cambridge.

Bauer, J. M., van Eeten, M. . J. G., Chattopadhyay, T. & Wu, Y., 2008. ITU Study on the

Financial Aspects of Network Security: Malware and Spam, Geneva: International

Telecommunication Union (ITU).

Boehme, R. & Holz, T., 2006. The Effect of Stock Spam on Financial Markets. Cambridge,

Workshop on the Economics of Information Security (WEIS), Univercity of Cambridge.

Brain, M., 2010. How Spammers Get Addresses. [Online]

Available at: http://computer.howstuffworks.com/internet/basics/spam1.htm

[Accessed 14 April 2014].

Cisco, 2013. Annual Security Report, California: Cisco Systems Inc..

Cisco, 2014. Annual Security Report, California: Cisco Systems Inc..

Cobb, S., 2003. The Economics of Spam. [Online]

Available at: http://www.spamhelp.org/articles/economics_of_spam.pdf

[Accessed 15 April 2014].

Encarta, 2008. E-Mail, Impact of, Redmond, WA: Microsoft Encarta Encyclopedia.

HBE, Home Business Endeavors, 2008. Why You Need an Email Filter for Press Release

Distribution. [Online]

Available at: http://www.homebizpal.com/technical/why-you-need-an-email-filter-for-press-

release-distribution/

[Accessed 11 April 2014].

ICO, The Information Commissioner’s Office, 2014. Spam emails. [Online]

Available at: http://ico.org.uk/for_the_public/topic_specific_guides/online/spam_emails

[Accessed 15 April 2014].

Jennings, J., 2004. Complying With CAN-SPAM: A 10-Point Checklist for Marketers. [Online]

Available at: http://www.clickz.com/clickz/column/1692179/complying-with-can-spam-a-point-

checklist-marketers

[Accessed 15 April 2014].

Kaspersky, 2010. Securelist Threats, Types of Spam. [Online]

Available at: https://www.securelist.com/en/threats/spam?chapter=88

[Accessed 15 April 2014].

Lyman, J., 2003. Spam Costs $20 Billion Each Year in Lost Productivity. [Online]

Available at: http://www.technewsworld.com/story/32478.html

[Accessed 14 April 2014].

Mangalindan, M., 2002. For Bulk E-Mailer, Pestering Millions Offers Path to Profit. The Wall

Street Journal, 13 November, p. http://online.wsj.com/news/articles/SB1037138679220447148.

Page 18: Computer SPAM; The Impact of Unsolicited Email on Information … · 2014. 10. 25. · Spam and Information Security Mahmood Shubbak Spring 2014 1 Abstract Spam, or the unsolicited

Spam and Information Security Mahmood Shubbak

Spring 2014 15

Microsoft, 2014. Security Intelligence Report. [Online]

Available at: http://www.microsoft.com/security/sir/archive/default.aspx

[Accessed 16 April 2014].

NR, Nucleus Research, 2003. Spam: The Silent ROI Killer, RESEARCH NOTE D59, Boston:

Nucleus Research Inc..

Ofcom, 2010. Code on the scheduling of television advertising, London: Independent regulator and

competition authority for the UK communications industries.

Outlook, 2012. Errors sending or receiving email. [Online]

Available at: http://windows.microsoft.com/en-us/windows/outlook/errors-sending-mail

[Accessed 16 April 2014].

Polakis, I. et al., 2010. Using Social Networks to Harvest Email Addresses. Chicago, WPES’10,

ACM 978-1-4503-0096.

RI, Readership Institute, 2001. Newspaper Content Analysis: Industry Content Report. [Online]

Available at: http://www.readership.org/content/contentanalysis.asp

[Accessed 10 April 2014].

SIO, Cisco, 2014. Cisco SenderBase Spam Overview. [Online]

Available at: http://www.senderbase.org/static/spam/

[Accessed 15 April 2014].

SPAMfighter, 2008. Protecting Exchange Environments from Spam, Copenhagen: SPAMfighter.

SpamLaws, 2010. Spam: What is Spam?. [Online]

Available at: http://www.spamlaws.com/what-is-spam.html

[Accessed 12 April 2014].

Stroud, F., 2006. spam. [Online]

Available at: http://www.webopedia.com/TERM/S/spam.html

[Accessed 12 April 2014].

UK, Legislation Archive, 2003. The Privacy and Electronic Communications (EC Directive)

Regulations (No. 2426). [Online]

Available at: http://www.legislation.gov.uk/uksi/2003/2426/contents/made

[Accessed 16 April 2014].

USA, 108th Congress, 2003. Public Law 108–187, CAN-SPAM Act, Washington: The U.S.

Government Printing Office (GPO).