MessageLabs: Two thirds of spam sent via hijacked PCs

By Alun Williams

Posted on 8 Dec 2003 at 13:08

You have mail. Which means you also have spam, worms and viruses...

Two-thirds of spam is now sent via hijacked PCs and the ratio of virus emails has risen more than 80 per cent in the last year. These are among the findings of MessageLabs in its End of Year Report for 2003.

That we are suffering a large increase in the volume of spam is not news, but MessageLabs breaks down the figures into a more detailed analysis. It has found, for example, that the ratio of spam to authentic emails is now 1 in 2.5 - this compares with 1 in 11 a year ago and represents an increase of 77 per cent. Similarly the danger of virus attacks from within emails has risen dramatically. Whereas one year ago 1 email in 212 would contain some sort of virus, this has risen dramatically to 1 in 33, which is an increase of 84 per cent.

Most alarming, however, is the calculation that two-thirds of spam is now sent via hijacked PCs, potentially yours or mine. In other words, viruses are being used by spammers to leave machines vulnerable to being used as relay stations for pumping out the unwanted emails.

Certainly, the email-borne security threats are becoming ever-more sophisticated. Consider, for example, the recent Mimail-L worm. Not only does this try to extract financial information, but it also prepares the ground for denial of service attacks on antispam firms and sets up PCs as proxy servers for spam.

On the virus front, MessageLabs highlighted the impact of the Sobig-F virus in 2003. Describing it as the fastest spreading virus ever - MessageLabs intercepted a million copies one day in August - the total now stands at 32 million emails containing the virus.

Among other characteristics, Sobig-F also takes advantage of SMTP multi-threading to more efficiently process its emailing duties - instead of dealing with 100 addresses (for example) one by one, it will process them in bulk.

The MessageLabs 'top ten' of 2003 virus threats is as follows:
- Sobig.F-mm (32,432,730 emails)
- Swen.A-mm (4,184,129)
- Klez.H-mm (4,006,766)
- Yaha.E-mm (1,920,424)
- Dumaru.A-mm (1,129,061)
- Mimail.A-mm (1,052,481)
- Yaha.M-mm (862,682)
- Sobig.A-mm (842,729)
- BugBear.B-mm (814,865)
- SirCam.A-mm (511,578)