Subject: Re: 2. Spam Analysis - Economics (was Re: spammer economics; was: RE: [Asrg] hiring challenge responders)

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 14 Aug 2003 12:01:32 -0400

At 06:22 AM 8/14/2003, Matt Sergeant wrote:
>On Thursday, Aug 14, 2003, at 00:50 Europe/London, Yakov Shafranovich wrote:
>
>>Take into account the use of hijacked computers and the whole economics 
>>model is blown to bits since using those computers does not incur any 
>>cost. Combine that with the 70% figure provided by MessageLabs for use of 
>>hijacked computers and we are all in deep trouble.
>
>The majority of the hijacked computer sent spam we see is just plain old 
>open proxies. Using an open proxy doesn't give you any extra bandwidth, 
>it's just an anonymising tool.

Matt, I was not aware of that fact - the article quiting the Message Labs 
report made it clear that the 70% figure refered to regular hijacked 
computers. Perhaps you can provide us with an extract from that report or a 
link to it? Also, for the people doing spam analysis, adding the delivery 
method or vector to the analysis might be useful.

Yakov  

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Matt Sergeant <[email-masked]>
Date: Thu, 14 Aug 2003 18:04:31 +0100

On Thursday, Aug 14, 2003, at 17:01 Europe/London, Yakov Shafranovich 
wrote:

>> The majority of the hijacked computer sent spam we see is just plain 
>> old open proxies. Using an open proxy doesn't give you any extra 
>> bandwidth, it's just an anonymising tool.
>
> Matt, I was not aware of that fact - the article quiting the Message 
> Labs report made it clear that the 70% figure refered to regular 
> hijacked computers.

What is a "regular" hijacked computer to you?

> Perhaps you can provide us with an extract from that report or a link 
> to it?

It's probably on our web site somewhere. Unfortunately I use a Mac and 
the web site isn't viewable in Safari, my browser of choice :-)

Matt.

---

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 14 Aug 2003 13:05:56 -0400

At 01:04 PM 8/14/2003, Matt Sergeant wrote:
>On Thursday, Aug 14, 2003, at 17:01 Europe/London, Yakov Shafranovich wrote:
>
>>report made it clear that the 70% figure refered to regular hijacked computers.
>

A computer that has been hijacked by a virus or a trojan horse, as opposed 
to a computer that has been misconfigured into an open-proxy.

---

From: Matt Sergeant <[email-masked]>
Date: Fri, 15 Aug 2003 16:02:51 +0100

On Thursday, Aug 14, 2003, at 18:05 Europe/London, Yakov Shafranovich 
wrote:

> A computer that has been hijacked by a virus or a trojan horse, as 
> opposed to a computer that has been misconfigured into an open-proxy.

We don't distinguish. Both are the result of clueless users :)

Matt.