IT Business
Confessions of a reformed spammer
strap
By Jeremy Kirk, IDG News Service | Published 16:00, 18 July 07
It was a life of greed and excess, one that preyed especially on vulnerable people hoping to score drugs or win money gambling on the Internet. From when he was expelled from high school at 17 until he quit his spam career at 22, Ed - who does not reveal his full name but sometimes goes by SpammerX - was part of an electronic underworld profiting from the Internet via spam.
"Yes, I know I'm going to hell," said Ed, who spoke in London on Wednesday at an event hosted by IronPort Systems, a security vendor now owned by Cisco Systems. "I'm actually a really nice guy. Trust me."
Also in this channel
Virtualisation, Big Data and BYOD
Check out our Business IT Hub for opinions and briefings. Read more
A quick-witted and affable guy who wears an earring and casual clothes, there was a time when Ed wasn't so nice. He sent spam to recovering gambling addicts enticing them to gambling Web sites. He used e-mail addresses of people known to have bought anti-anxiety medication or anti-depressants and targeted them with pharmaceutical spam.
In short, Ed said he was: "basically what people hate about the internet".
He spent 10 hours a day, seven days a week studying how to send spam and avoid filtering technologies in security software designed to weed out garbage email. Most spam filters are effective 99% of the time; he aimed for that remaining window, using tricks such as including slightly different images in his spam, which can fool filters into thinking the e-mail is legitimate.
"The better I got at spam, the more money I made," Ed said.
He would start a spam run by finding an online merchant who wanted to sell a product. Then he'd acquire a list of e-mail addresses - another commodity that has spawned its own market in the world of spam. He'd also set up a domain name, included as a link in a spam message, that, if clicked, would redirect the recipient to the merchant's website, enabling Ed to get credit for the referral.
The spam would then be sent from a network of hacker-controlled computers, called botnets. Those machines are often consumer PCs infected with malicious software that a hacker can control. Ed would "rent" time on those computers from another group of hackers that specialized in creating botnets.
If one of the spam recipients bought something, Ed would get a percentage of the sale. For pharmaceuticals the commission was around 50%, he said.
Response rates to spam tend to be a fraction of one percent. But Ed said he once got a 30% response rate for a campaign. The product? A niche type of adult entertainment: photos of fully clothed women popping balloons.
