One man's spam

2009-05-01

Helen Martin

Virus Bulletin, UK
Editor: Helen Martin

Abstract

'The most troublesome category of messages – that requires the most thought – are those that occupy the awkward grey area between ham and spam.' Helen Martin, Virus Bulletin


Since the advent of VB’s anti-spam testing (see p.S5), each of the VB staff members has been tasked with classifying their own incoming mail on a daily basis. This may sound tedious, but I have found that it is not such an onerous task when performed at the start of the day while sipping one's morning coffee and gradually coming to.

It is also a task that concentrates the mind – I find myself taking more time to consider the subject and/or content of many of the messages. While picking out the 'definite' ham from the list displayed in the easy-to-view web interface is extremely easy (by recognizing emails received in one’s inbox the previous day), and picking out the ‘definite’ spam is a no-brainer (e.g. messages in foreign characters, offers from online pharmacies, notifications of lottery wins or suggestions one adds an academic qualification to one's CV), other messages present more of a philosophical challenge.

First, there are the messages that are unwanted ham. For me, these include messages from online retailers from which I have previously made purchases – Amazon is a prime example, as are the various companies from which Virus Bulletin has purchased marketing materials or office equipment. I am generally happy for these companies to send me information about their latest offers, but nine times out of ten the delete button is applied to the message before it has even been opened. The same is true for numerous newsletters that I have signed up for, as well as alerts from social networking sites. All of these messages go straight into my 'deleted items' folder without even a glance at their content, yet when classifying them I am forced to admit that they are ham. I wonder whether this is an entirely fair classification.

Next, there is the curious phenomenon of spam that is of interest. I hesitate to admit to this, but occasionally there appear messages in my inbox that I know should not be there, but which pique my interest. One recent example was a message from a UK charity promoting a challenge that involves climbing the three highest mountains in the UK within 24 hours. This is not what I would call a classic example of spam, yet I have not signed up to receive messages from the charity in question, nor passed them my email address in any other way. Having absorbed the full details of the message (and decided my levels of fitness are not yet up to the challenge) I reluctantly marked it as spam.

The most troublesome category of messages – that requires the most thought – are those that occupy the awkward grey area between ham and spam. While we have available an ‘unclassified’ category for messages for which we really are unable to make a decision (for example, for messages sent to a predecessor’s email address where we cannot be sure whether or not they signed up to receive them), the use of this category as an easy way out of a tough decision is discouraged.

Being in the publishing business, I find myself at the receiving end of many press releases. PR agencies have found my email address through a variety of sources and send along information which they think will be of interest to me/my publication. Sometimes they get it right, and I receive the latest product news from the players in the IT security industry – these are not messages I have asked for or subscribed to, yet they are certainly of interest. However, others misinterpret the name ‘Virus Bulletin’ and send me releases on the latest advances in immunology or invite me to biomedical seminars, and yet others let me know about topics as diverse as the launch of a new website for a company that supplies alloy wheels, to the publication of a new book 'for the hard nosed business person to do good in the world AND make a profit' . Beyond the general amusement of reading such announcements I am not interested in them and as such would classify them as spam – but what really makes them any different from those press releases that happen to fall into my subject area of interest? One editor's spam is another's ham.

Finally, I have learned that even spam can bring a smile to an otherwise dreary Monday morning: a recent message arrived in my inbox with the subject line 'We are too lazy to change subjects every daay, please buy our products' [sic]. Now that's honesty!

twitter.png
fb.png
linkedin.png
hackernews.png
reddit.png

 

Latest articles:

Nexus Android banking botnet – compromising C&C panels and dissecting mobile AppInjects

Aditya Sood & Rohit Bansal provide details of a security vulnerability in the Nexus Android botnet C&C panel that was exploited to compromise the C&C panel in order to gather threat intelligence, and present a model of mobile AppInjects.

Cryptojacking on the fly: TeamTNT using NVIDIA drivers to mine cryptocurrency

TeamTNT is known for attacking insecure and vulnerable Kubernetes deployments in order to infiltrate organizations’ dedicated environments and transform them into attack launchpads. In this article Aditya Sood presents a new module introduced by…

Collector-stealer: a Russian origin credential and information extractor

Collector-stealer, a piece of malware of Russian origin, is heavily used on the Internet to exfiltrate sensitive data from end-user systems and store it in its C&C panels. In this article, researchers Aditya K Sood and Rohit Chaturvedi present a 360…

Fighting Fire with Fire

In 1989, Joe Wells encountered his first virus: Jerusalem. He disassembled the virus, and from that moment onward, was intrigued by the properties of these small pieces of self-replicating code. Joe Wells was an expert on computer viruses, was partly…

Run your malicious VBA macros anywhere!

Kurt Natvig wanted to understand whether it’s possible to recompile VBA macros to another language, which could then easily be ‘run’ on any gateway, thus revealing a sample’s true nature in a safe manner. In this article he explains how he recompiled…


Bulletin Archive

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.