How SPAM Came to Be - The Main Booster of Cybercrime

[Man]

Do you like canned food? Or Viagra? You can buy them from us!

Today we want to tell you about spam - how it appeared, how they tried to fight it and how this criminal industry developed. We will also discuss why spam became the driving force behind the development of cybercrime all over the world. And perhaps without it there would be no modern world of cybersecurity. But first things first!

❯ 1. Telegrams, canned goods and intrusive advertising​

Where does spam come from? There are two answers to this question because it contains two questions.

The first question concerns the first advertising message that was imposed. On May 31, 1864, a British Member of Parliament received a telegram that was clearly an advertisement, inviting him to visit a dentist at the address: "Dr. Gabriel, 27 Harley Street, Cavendish Square. Dr. Gabriel's office hours are 10 a.m. to 5 p.m." The recipient did not know the doctor and had no interest in his hours. He was outraged at being disturbed and wrote to the newspaper about it.

Although he hoped that something like this would not happen again, his actions only increased the advertising effect for the doctor and made it clear to other advertisers that it might be worth repeating this method of attracting attention.

The second question is related to the word "spam" itself. SPAM is an abbreviation that can mean "Shoulder of Pork and Ham" or "SPiced Ham". The exact definition is not given, but it is a canned product that has been sold since 1936 and is still being sold today.

But what does canned food have to do with this? It's simple: their advertising has become so intrusive that the name of this product has become a household word.

During World War II, these canned foods were actively used as dry rations for the US Army and distributed by ration cards among the population of allied countries, including Lend-Lease supplies to the USSR. After the end of the war, the demand for them dropped significantly, since eating the same thing was not very pleasant. However, a lot of canned food accumulated in warehouses, and the company that made money from the war invested heavily in their advertising.

The advertising was so aggressive that it appeared everywhere: on posters, billboards, radio, television, magazines and newspapers. In 1969, the famous comedy group Monty Python made fun of this advertising in their legendary sketch "SPAM", in which the word "SPAM" was used 108 times. Since then, any intrusive, unnecessary and useless advertising has been called exactly this.

By the way, in 2007, the canned food company Hormel Foods tried to sue the software company Spam Arrest, which fights spam (letters!), for using their name. However, the court sided with the anti-spam company, finally establishing the word "SPAM" as a common noun.

Sometimes you don't expect to see SPAM, but there it is!) Deadpool eats it in the latest movie.

❯ 2. Calls and the first email spam, which spread from group chats to email​

However, in addition to canned spam, people encountered other unpleasant phenomena in the era of the Internet's inception. At that time, as in the pre-Internet era, many were irritated by advertising calls. This problem is still relevant today. Nowadays, many calls are made by robots, and, as a rule, to mobile phones. But in the past, regular call center operators called both home and work phones. Potential clients did not like this, but this practice was and remains effective.

By 2003, the US had partially solved the problem of unwanted calls by creating the "National Do Not Call Registry." If you added your number to this registry, all legal advertising calls to it were prohibited. And meaningless, but we'll talk about meaning later.

What about spam via digital channels?​

The first known case occurred in 1978, when Gary Turek, a young aggressive marketer at Digital Equipment Corporation, decided to send out a commercial advertisement to every email address he knew on the West Coast of the United States that was connected to an early version of the Internet. His message reached several hundred people, and while not everyone was thrilled with the mailing, it still brought in about $14 million in sales for the company!

However, the first case of publicly condemned chat spam occurred in 1994, when two Arizona lawyers, Lawrence Kanter and Martha Siegel, tried to push their services as mediators in the US visa lottery in Usenet discussion groups. Their service consisted of simply sending documents for "clients" by mail, but they planned to charge hundreds of dollars for it. And these "generous" offers were sent by the fraudulent lawyers to all 6,000 discussion groups!

The backlash against this ad was truly loud. Recipients of the spam called and insulted, sent useless junk mail to fill the mailbox they needed for work, and newspapers wrote exposés. But even so, according to information from interviews, the scammers' scheme worked, and they made about a hundred thousand dollars.

❯ 3. First thoughts about protection​

The registry was successful in dealing with telephone spam, but there was no solution for digital channels. It would seem an obvious idea to create an email registry similar to the registry for calls. But fortunately, it was not implemented.

The key difference between phone and email spam is the cost. Phone calls of that time required operator labor, so each call cost a certain amount. Companies engaged in advertising calls were interested in calling only those who showed interest in buying. Calling a phone number from a register would not only be unprofitable, but would also cause negativity among customers. The higher the conversion of calls to purchases, the more profitable this type of advertising becomes.

In the case of email spam, the costs are minimal. Even if the conversion of letters into purchases is very low, for example, one purchase per 10,000 letters, sending them in millions will still be profitable. And the presence of an email in any registry can even worsen the situation: if the address is in the registry, it means that it belongs to a real person. Therefore, spam would be sent to such a registry first. That is why the registry for email was never created.

❯ 4. An effective tactic is counter-spam​

In the early 2000s, Blue Security came up with an original and very radical method to combat spam. Here's how they did it:

Imagine a company has sent out marketing emails and is now waiting for a response to process the customers who responded and close the deal. What if almost all of the customers respond? You'd think that would be a cause for celebration. But no.

Blue Security offered its customers to install special software that would send a complaint in response to any spam messages. As a result, spam companies were forced to process thousands of automatic responses from security software to find real responses from those who were actually interested in the ads. In effect, Blue Security responded to spam with spam!

By 2006, the company had about half a million customers who had installed their anti-spam solution. However, not all information security experts of the time supported such an aggressive tactic. Many noted that innocent companies could suffer due to the inevitable false positives. Some wondered about the ethics of this approach, while others believed that this was the right thing to do.

❯ 5. Underestimating the enemy and starting a war​

However, by early 2006, the spam industry had become big business, and Blue Security apparently failed to take into account the seriousness of the enemy. At that time, letters were already being tracked, and thousands of computers around the world were needed for effective distribution. It was for the distribution of spam that the first botnets and Trojans with remote access functions began to be created.

Spam allowed hacking to turn from a hobby into a profitable business. It was an easy way to monetize a lot of hacked devices, and the process became widespread.

Who paid for such advertising? Some of the main advertisers were sellers of illegal goods, especially uncertified and counterfeit mass-market goods: "branded" handbags, watches and uncertified drugs. One of the most popular products of that time was Viagra, produced in makeshift laboratories in India at a price hundreds of times lower than the pharmacy price. And even if you need a prescription drug - please, just pay.

Spam network advertising was used for both phishing and fraud, but it was the “black pharmacies” that were always at the top, occupying leading positions.

In March 2006, many Blue Security customers received an alarming letter threatening to significantly increase their spam volume unless they stopped using the product. The sender did not give his name, but many sources claimed that it was a spammer known as Pharmamaster. Given the nickname, it is not difficult to guess the purpose of his mailings. Many experts also noted that the hacker was Russian-speaking.

How Pharmamaster obtained the company's customer data remains unclear. It sent emails to most of its existing customers, but not all. There may have been a vulnerability that allowed emails to be checked to see if they belonged to a customer base. The company assured its customers that there was no reason to worry and that the hacker's threats were just a bluff.

❯ 6. Associated losses​

However, Pharmamaster decided to attack not the clients, but the company itself. On May 1, 2006, a DDoS attack was launched against Blue Security servers. At the time, such attacks were nothing new, and the company was not surprised, although they were difficult to maintain for a long time. Blue Security expected that the attack would stop on its own after a couple of days, since the attacker could use the botnet for other purposes or simply lose interest.

However, it was at this point that the company made a serious mistake. In order to be able to respond to their customers, they redirected traffic from their website to their blog, hosted on Six Apart. A DDoS attack hit the hosting service, which was not even warned about it! As a result, thousands of websites and blogs of other hosting clients stopped working. They became “collateral damage”, just like in a real war.

Blue Security's downright stupid move was widely criticized, the company was forced to apologize and justify itself, and its reputation was seriously damaged. However, Blue Security still believed that it could survive the attack. In fact, they believed that the severity of the attack only demonstrated how effective their reverse spam protection system was!

❯ 7. Capitulation​

Days passed, and the attack on Blue Security continued. Neither side was going to give in. At this tense moment, professionals entered the picture — Prolexic, a company specializing in repelling DDoS attacks. The effectiveness of the attack was significantly reduced.

However, on May 16, Pharmamaster struck back. They discovered a vulnerability in the protection method used by Prolexic. This vulnerability made the DDoS attack so effective against the anti-DDoS solution itself that all clients of this protection system suffered! Once again, many companies were among the "collateral damage", and Blue Security could not withstand it.

On May 17, 2006, Blue Security management announced its decision to leave the battlefield and stop fighting spam. It was a capitulation, and Pharmamaster won. The official reason for leaving the anti-spam business was double “collateral damage” and criticism. Although there were rumors online that the company’s management and their families were being threatened offline, there was no confirmation of this.

❯ 8. What consequences did the spam phenomenon cause?​

Beyond the canned food meme, spam has become an integral part of the development of organized cybercrime. Along with carding, it has demonstrated the financial benefits of online criminal activity, opening up new opportunities to monetize hacks and create botnets.

During the heyday of the spam and carding industry, there was a division of attackers into different specializations. Some were engaged in sending phishing letters and hacking computers, others created and modified malicious software, others administered and developed C&C servers for effective botnet management. And, of course, there were those who were responsible for "black contracts", increasing the efficiency of spam mailings or withdrawing and laundering funds.

All these criminal business processes later turned into "Spam Nation" described in the book by Brian Krebs, and then into the modern RaaS (Ransomware as a Service) scheme. However, this is a completely different, more modern story.

The thing is that such advertising has always been and remains effective! As long as people believe dubious letters and give in to tempting offers, the industry will flourish.

Remember that once upon a time, cybercrime was treated as hooliganism, not taken seriously. And this is what it led to.

P.S. Perhaps this article will be the first in the "spam cycle", where we will analyze individual people, for example, the Pharmamaster personality and modern realities. But this is not certain.[/I]

Source