A holistic approach to spam

In April this year, in a variety of spamming known as ‘whaling’, an email scam targeted around 20,000 senior corporate managers in San Francisco. The emails were delivered to CEOs and other high-ranking executives, and carried their full name, phone number and company name.

The messages purported to be an ‘official’ subpoena requiring them to appear before a Federal grand jury. Around 2,000 of the recipients opted to view a more detailed copy of the subpoena and were taken to a website that urged them to install a browser add-on in order to read the document.

Doing this installed a backdoor and key-logging application capable of stealing login credentials on banking and related websites. The scam was repeated several days later and some 70 additional executives were taken in.

Two points should be made here. First, it was reported that, of the top 35 anti-virus products, only eight detected the malware in the initial, larger surge. In the second attack, the total increased to 11 but remained woefully inadequate.

Second, the fact that, on a personal level, many of the executives were taken in implies a hopelessly inadequate familiarity with the way spam operates (it also presupposes extreme gullibility, but that’s another issue).

Additionally, it reveals that, on the corporate level, whatever preventative measures were in force were ineffective. Moreover, these large organisations (with no shortage of disposable funds) undoubtedly believed the anti-spam methodologies they had implemented were satisfactory.

So, if large companies are incapable of protecting themselves from spam, what can small businesses do to achieve this? Fortunately, it is possible to acquire effective protection. The answer is to use a joined-up approach that uses a variety of methods.