Spammers shift to spreading malware

Around 120 billion junk messages are sent worldwide every day

Global spam volumes have doubled in the past year, showing a shift away from selling products towards spreading malware, according to new research.

The 2008 Internet Security Trends Report from IronPort Systems estimates that 98 per cent of all email traffic is now spam.

Around 120 billion junk messages are sent worldwide every day, 20 billion targeted at the UK, and the spam business is now estimated to be worth $200bn a year.

"2007 marked a turning point for threats in the UK," said Jason Steer, European product manager at IronPort Systems.

"Just when malware design seemed to have reached a plateau, new techniques have emerged which could only have been designed with sophisticated research and development."

Steer explained that new security controls designed to manage malware have only prompted spammers to change tack.

"Many of these threats underwent significant adaptation in 2007. Malware went stealth, and the sophistication increased," he said.

The research also suggests that spam has become less focused on selling products and more on growing spam networks.

IronPort's Threat Operations Centre measured a 253 per cent increase in 'dirty spam' during 2007 which contained links pointing to known malware sites.

This malware is often designed to further extend the size and scale of the botnets that originated the spam in the first place.

Steer also pointed to the increasing cost of defending against spam, viruses and malware in terms of time and money.

The average UK computer user now spends five to 10 minutes every day dealing with spam, and clean up costs after a malware attack are estimated at around $500 per incident.

IronPort's research also highlighted the increased risk of identity theft. An estimated 60 million people have had personal data exposed over the past 12 months, resulting in an estimated $20bn spent on clean-up costs and lost productivity worldwide.

In addition, 48 per cent of organisations do not have a policy for notifying customers when their private data may be at risk.

IronPort stressed that users should exercise common sense to avoid the pitfalls of spam and malware. "If it looks like spam, it probably is. Delete it, " said Steer.