How Spam is Sent

Spammers often use insuffi ciently secured systems. The trouble and cost of sending tens or hundreds of thousands of messages are transferred to third parties. You will learn what techniques spammers use and how to protect yourself.


What you will learn…

• how spammers send spam (using third party computers),


• how to protect your server from spammers,


• how the SMTP protocol works,


• what open relay, open proxy and zombie are.

What you should know…

• how to use basic tools from the Linux system.

Sending a great number of emails requires a lot of resources. A fast connection and a dedicated server are needed. Even if a spammer possesses such resources, sending can take several hours. Internet service providers are generally not happy when their networks are used for spamming. The spammer can lose a connection before sending the majority of messages, and there are serious fi nancial and legal consequences waiting for spammers who get caught. Two basic methods are used by spammers to speed up sending. The fi rst one is based on minimalising the time required for sending a message. It is known as fi re and forget, meaning send and forget. The computer used for sending spam does not wait for any response from the servers it is in contact with. The second method requires stealing resources from third parties, that either have not properly secured their systems, or have become the victims of a virus attack. The majority of costs, and often even the responsibility of sending spam, is transferred to them, leaving the spammer unpunished.

SMTP protocol

Before learning methods used by spammers, it is necessary to become familiar with the most widely used protocol for sending electronic mail – SMTP. It is based on, as most Internet protocols are, simple text commands. Phases of sending mail Electronic mail is sent in several phases (see Figure 1). For a better understanding, let us suppose we want to send an email from hakin9@hakin9.org to nobody@example.com. The user that sends the message uses the Mozilla Thunderbird program in a local network; recipient – the Outlook Express program and a dial-up connection.