Spam has now got new flavours

When Luis von Ahn gives talks on his work fighting spam, he likes to start by asking the audience a question. “How many of you have had to fill out one of those web forms that asks you to read a distorted sequence of letters or a word?” he asks. “How many of you found that annoying?” As the hands shoot up, he breaks into a grin: “I invented that.”

Von Ahn is a professor of computer science at Carnegie Mellon University and was the recipient of a MacArthur “genius grant” worth $500,000 in 2006. His work on the “captcha”—those irritating automated tests that help distinguish humans from computers—is probably one of the most important advances in spam-fighting since the birth of email.

Since he helped invent it nine years ago, the system has helped prevent countless billions of spam messages. And as captchas are now combined with advanced filtering techniques, von Ahn suggests that, at least from his point of view, email spam is now a problem more or less contained.

“Maybe five years ago there was a crapload of spam I got in my inbox because the filters were so bad,” he says. “But it’s changing a lot – spam email seems to be much less of a problem than it was, because filters have become a lot better … I personally see very little actual email spam.”

Not everybody feels so certain, however. While users are probably exposed to fewer spam emails than ever, thanks to the rapid improvement of services such as Hotmail, Gmail and Yahoo Mail, the picture behind the scenes is not so rosy.

“It is worse than ever,” says Richard Cox of Spamhaus, which tracks the world’s worst spammers and runs blacklists to help block them. “The fact that it’s growing, I don’t think anyone can exactly miss out on … we’re getting to the stage now when any email containing a [Chinese] domain is likely to get rejected. Is that good for China at the commercial level, internationally? No, it is not, but they don’t seem to recognise that.” The totality of spam is hard to gauge, but Cisco produced an estimate late last year of around 200bn junk emails a day.

Experts believe so. In Technology Guardian over the past two weeks, we have examined the current state of web security and computer security, but it remains the case that spam—in all its forms—is the main method of transmission for a wide variety of attacks.

Emails loaded with malware, where users click on a link that downloads a virus to their computer, are becoming more common, with many such attacks creating networks of compromised computers to send out yet more spam.

Phishing emails, designed to solicit logins or other personal details, are getting more convincing every day. And then there are the fraudulent products and illegal offers that most of us associate with unwanted email. Perhaps it remains crude, but the near-zero cost of sending spam messages by the billion has turned it into an intractable problem.

Though China and Russia continue to rise up the charts, the worst offender remains the US. Despite passing a law on unwanted email, the CAN-SPAM act, as long ago as 2003, it is still responsible for around 30% of all junk messages. But with improvements in filtering technology, the more pressing concern could be that spammers themselves are moving into new territory.

Fraud goes social

Some of the most damaging attacks are happening in other areas of the web, as criminals apply their experience to potentially more lucrative new arenas. “There’s an increase in spammy behaviour,” says von Ahn. “We’re talking about things like comments on blogs, or in social networking sites … even friend requests can be spam.” Spammers have spent recent years discovering a variety of new tools. Fake websites, or even networks of fake sites, are constructed in order to help them boost criminal activity, while great effort goes into polluting search engines and invading your social networking profile. Spammers have learned not only that there is more to be gained from such activities, but also that they are harder for users to fight.

“There are a few really large email providers and as long as they do a good job of stopping email spam, everybody's happy,”says von Ahn. “But with these other type of things like comments on blogs, that’s a little harder because it’s much more decentralised – all these different services, each of which can be spammed in their own little way.”

He believes that the more intimate nature of social networks means that the chances of a spam message succeeding are higher.  If receiving a spam email has become the equivalent of junk mail landing through your letterbox, social network spam is somebody ringing the bell – or even walking into your house and planting their junk mail in your hands.

The good news, if there is any, is that social networks have had unprecedented success in hitting spammers where it hurts: their pockets.  In the past 18 months both MySpace and Facebook have won spam cases – including an $873m fine against a Canadian, Adam Guerbuez, and a total of more than $1bn against Sanford Wallace, who in the 1990s dubbed himself the “spam king”.  The awards vastly outstrip the $4m fine that Wallace received for email spam in 2006.

Global standard

Spamhaus’s Cox suggests that other countries should follow the lead of Australia and New Zealand, which have tough, strictly enforced anti-spam laws and have won a series of cases against high-profile offenders.  “It’s not insoluble – there are various things that can be done that will reduce the risk and reduce the impact,” he says.

“If the UK and US would actually follow the Australia and New Zealand example, this would set up a pretty strong coalition across the world … all of a sudden there would be a standard."

He recognises the difficulty of making it happen, however. A House of Lords report on computer crime two years ago suggested the British government had an approach to spam and security that was “inefficient” and “outdated” – but pressure from campaigners has so far failed to have any impact on government policy.