Equation: How Much Money Do Spammers Rake In?
wired.com
wired.com
It's the Drake equation for spam! $7000/day is not too shabby, either...
If you'd like to learn more about this experiment, the Wired article is based off of: http://cseweb.ucsd.edu/~savage/papers/CACMSpam09.pdf
In going through this exercise were you able to come up with ideas to combat spam more effectively?
We first started experimenting with the storm botnet about six months before doing this experiment. Once we realized what their architecture allowed us to do (MITM on the botnet's C&C), it probably only took a month or two to put together the infrastructure needed to conduct the experiment. Scaling to more nodes would have been relatively trivial, as the VMs running the Storm nodes were completely unmodified and we could have easily brought more online behind our flow-modifying router if necessary.
A colleague of mine did come up with one idea called "botnet judo" (paper here: http://www.cs.ucsd.edu/~voelker/pubs/judo-ndss10.pdf) whereby we run spamming bots within a contained environment that "seems" to have SMTP connectivity but actually just sinkholes all the spam, and then we developed highly effective and specific regular expressions from each bot's spam corpus.
Was this project done as a thesis paper or was there an alternative purpose for undertaking such a long project? I'm pretty impressed with the execution of your team.
Not that I have any idea how to educate those sorts.
On the other hand, user education about the profit motive is certainly something that could bear fruit, and so the first step to educating them is figuring out what the numbers look like in the first place :). That's what we're up to, and trying to find ways to keep spam from being profitable is something we took a look at in our upcoming paper at this May's IEEE Symposium on Security and Privacy.
If all SMTP servers were required to receive and send back a token/packet before their original message was delivered, the bandwidth/cpu etc... required to send the message will have increased.
Send original to recipient server, receive from recipient server, send to recipient server. Then the mail is delivered.
Example: A single spammer can send out 50 million emails / month on current system. Introduce a 3-way & that number drops.
If the spammer wants to get back to sending 50 million / month, a significant increase in hardware will be required.
When the SMTP protocol was designed/evolved, spam and other malicious uses did not exist. They didn't even exist for many, many years afterwards.
When the spam really became a problem, everyone was already using smtp and switching the whole world to an alternative wasn't (and still isn't) possible.
Designing email protocol that would eliminate spam is not hard if you start with such goal in mind.
The people who designed smtp were very smart (it is being used decades later), but they were pioneers and unsurprisingly didn't anticipate all of the consequences. When they were designing it, there number of people using the system were in thousands. I doubt anyone in early eighties was anticipating the magnitude of smtp's success and the abuses of the system only became profitable when email started being used by millions.
That's great, but gives me absolutely no context to answer the actual question, "How much do spammers rake in." Is 7K high, low or average for a spammer? What's the total revenue of all spammers? How many spammers are there? What is a spammer- an organization of 10, 20, 100 people, or is it one guy?
For instance, if I built a twitter bot replying to anyone saying "iPad" with a link, then the page at the end of that link was absolutely filled with ads. How much money would I make?
It seems to be a somewhat viable method of getting some cash because you see a lot of those bots around.
So they assume 90.7% of messages get caught by spam filters.
Apparently they send out around 1 billion emails, 23.8% of which gets delivered. Around 2600 people read the emails, and a quarter of them will an average of $100.