Slashdot Mirror

← Back to Stories (view on slashdot.org)

Explaining The Business of Spam

Posted by timothy on from the wading-through-the-muck-even-now dept.

ATMAvatar writes "The IEEE Symposium on Security and Privacy hosted in Oakland nearly three weeks ago featured a study on the economics of spam. It attempts to identify and analyze the chain of businesses behind spam and the products that are featured. The goal was to take a more comprehensive look at the mechanics behind the industry in an attempt to identify better, alternative means to combat spam."

58 of 74 comments (clear)

  1. Low costs... by Hamsterdan · · Score: 2, Insightful

    ...relative to the number of emails that can be sent. So even if a low percentage of gullible people buy the crap, it's profitable.

    --
    I've got better things to do tonight than die.
    1. Re:Low costs... by MobileTatsu-NJG · · Score: 2

      It doesn't even have to be profitable, there just needs to be somebody with a message they want sent. Spammers aren't paid to push products, they are paid to deliver n-thousand messages. That's why we hear stories about it taking millions of messages to earn $100.

      --

      "I like to lick butts!" by MobileTatsu-NJG (#32700246) (Score:5, Informative)

    2. Re:Low costs... by Zakabog · · Score: 2

      Yeah I don't get why every few months there's a story discussing the Business of Spam. High speed internet access as well as computing power are just getting cheaper so sending spam is just becoming more profitable, I don't see what's left to discuss...

    3. Re:Low costs... by JWSmythe · · Score: 3, Funny

          Well, from what I've heard from people in such unsavory businesses, the profit is down. That's in conversions (convert from unknown person to paying customer) per thousand emails.

          Years ago, you could get a conversion ratio of 1:300 to 1:1,000. A few years ago, the conversion rate went to something like 1:100,000 to 1:1,000,000, depending on how "clean" your list is.

          The little guys trying to push their pharmaceuticals, porn sites, or whatever do very poorly, so it could only be one of every few million make a paying customer. The good money moved over to mainstream companies. Their "targeted marketing" (i.e., spam that they'll insist you asked for) from mainstream companies has a better look and feel, *and* makes it through most spam filters.

          You are correct. Faster machines with more memory, and larger residential pipes make a *huge* difference. I knew someone who could send out 100,000 messages/hr on a 28.8 dialup on a machine with 128MB RAM. What's your 15MB/s up FiOS line and a machine with 4GB RAM going to do? A whole lot more, if you set it up right. So they aren't hurt as much by the poor conversion rates, they just make up for it by spamming more people.

          As long as people buy from spam or "targeted marketing", the companies will continue to send it. When the sales aren't there, spam will go the way of the print department store catalogs.

      --
      Serious? Seriousness is well above my pay grade.
    4. Re:Low costs... by Anonymous Coward · · Score: 1

      If you need 4GB RAM to send out one million emails... well, you're doing it wrong.

    5. Re:Low costs... by Threni · · Score: 2

      That rule applies to more than just spam; everything, from Walmart to China...(or vice versa, in fact).

    6. Re:Low costs... by MichaelSmith · · Score: 1

      qmail FTW.

      --
      http://michaelsmith.id.au
    7. Re:Low costs... by ByOhTek · · Score: 1

      Alternatively, if people start boycotting things that are sent as spam... It could still be profitable, by driving customers away from your strongest competitor, and thus, driving some to you.

      --
      Self proclaimed typo king, and inventor of the bear destroying coffee table (patent not pending).
    8. Re:Low costs... by Inda · · Score: 1

      I don't understand why this is discussed either. My personnal spam has halved over the past few years and the trend seems to be continuing

      Not that I see any of it...

      --
      This post contains benzene, nitrosamines, formaldehyde and hydrogen cyanide.
    9. Re:Low costs... by jfengel · · Score: 1

      I wonder... is the conversion rate dropping because people are smarter, or because the sheer amount of spam has risen?

      It would seem that they'd saturated the fundamental market (stupid people) pretty quickly. You can send the stupid people more offers, but even the stupid people are only going to buy so much stuff.

      If they'd reached 90% of the stupid people with the first billion emails they sent out, they'd probably have to send 10 billion emails to reach 99% of the stupid people: a 10x rise in spam for a 10% improvement in the market size.

      Or maybe it's just a diminishing number of stupid people. That would be a nice thought.

    10. Re:Low costs... by JWSmythe · · Score: 1

      I guess you haven't done any heavy mailings, have you?

          You can serve them out slowly with a little bit of memory. If you're sending out a bunch of mail, you want it to be multithreaded. The more you send simultaneously, the more memory you need.

          But why am I explaining computing basics to a troll anyways?

      --
      Serious? Seriousness is well above my pay grade.
    11. Re:Low costs... by tehcyder · · Score: 1

      ...relative to the number of emails that can be sent. So even if a low percentage of gullible people buy the crap, it's profitable.

      Who modded this funny?. It's perfectly informative.

      --
      To have a right to do a thing is not at all the same as to be right in doing it
    12. Re:Low costs... by tehcyder · · Score: 1

      As long as people buy from spam or "targeted marketing", the companies will continue to send it.

      You might as well call all advertising/marketing spam, then. I can't see what's so terribly different about email spam compared to paper fliers through my letter box, except that the latter are harder to block.

      --
      To have a right to do a thing is not at all the same as to be right in doing it
    13. Re:Low costs... by Demonoid-Penguin · · Score: 3

      It doesn't even have to be profitable, there just needs to be somebody with a message they want sent. Spammers aren't paid to push products, they are paid to deliver n-thousand messages. That's why we hear stories about it taking millions of messages to earn $100.

      Kind of hard to believe. They used to pay children to deliver newspapers until it became too expensive checking up on deliveries - and there were too many complaints about newspapers being dumped. I could tell you I'm going to deliver 10 million spam/ads but would you pay me on my word - or on the basis of sales? Even without first-hand experience of the industry (Bulk Data's business of contract data entry for merchants and medical transcription service, and a "cosy" relationship with Melbourne IT). There's thousands of script kiddie spam king wanna-be's - but they're not the ones making the money. It's the "direct marketing" people that are making the bucks. And the idea that all these viagra merchants are getting rich without having any association with the spam that drives their sales.... bullshit. If you make money off products marketed with spam - you should lose the money - unless we can prove you are linked to the spammers - in which case you should lose the money and go to jail. And quick - before ISPs take the Post Offices line that it (junk mail) keeps people in jobs.

      Perhaps a law that says if you're caught spamming you have to go around to every household you spammed, and try and deliver that porn ad in person.

    14. Re:Low costs... by martyros · · Score: 1

      Spammers aren't paid to push products, they are paid to deliver n-thousand messages.

      If you read the paper, it goes in to quite a bit of detail. People who actually send spam are typically paid via affiliate programs: people who sell stuff make it easy for a spammer to set up a website and ship stuff, so all they have to really do is get click-throughs.

      --

      TCP: Why the Internet is full of SYN.

    15. Re:Low costs... by martyros · · Score: 1

      I can't see what's so terribly different about email spam compared to paper fliers through my letter box, except that the latter are harder to block.

      One difference is that it actually costs the sender of those leaflets a non-negligible amount per person to send those, which acts as a natural rate-limiter, and also naturally causes the people sending the leaflets to be a bit clever in who they target (i.e,. don't advertise yachts in the slums). Just imagine what your letter box would look like if those leaflets were a million for a penny.

      Another difference is that most of the spam is selling things that are illegal to purchase in the US.

      --

      TCP: Why the Internet is full of SYN.

    16. Re:Low costs... by yarnosh · · Score: 1

      We can discuss how good filtering has become and question why anyone should be getting spam at all despite the huge volume of it out there. If you still get spam in your inbox, you really need to consider changing email providers. Spam is actually far less profitable than it used to be.

    17. Re:Low costs... by WuphonsReach · · Score: 1

      I wonder... is the conversion rate dropping because people are smarter, or because the sheer amount of spam has risen?

      Yes, a bit from column A and probably a bit from column B.

      Plus, spam filters keep getting better and better, which makes it even harder for your spam to land in the respondent's mailbox.

      If, in 2001, you had to send out 100,000 spams, of which only 10,00 would land in someone's mailbox and only 500 (5%) of those would convert, you probably count that as a 200:1 ratio.

      Now, what if the spam filters block 99% of your messages? Now, only 1,000 of your 100k spam blast is seen, and people are a bit smarter so only 3% click through. You end up with only 30 suckers and have a ratio of 3333:1.

      --
      Wolde you bothe eate your cake, and have your cake?
    18. Re:Low costs... by shentino · · Score: 1

      It's easy to keep costs low when you use botnets to pilfer resources that aren't yours.

      If spammers had to send the emails on their own dime it might be a different ballgame.

    19. Re:Low costs... by JWSmythe · · Score: 1

      One difference is that it actually costs the sender of those leaflets a non-negligible amount per person to send those,

      I think you really intended to say "One difference is that postal mail spam fees are paid to the government..."

      --
      Serious? Seriousness is well above my pay grade.
    20. Re:Low costs... by jfengel · · Score: 1

      3% is still depressing, but I guess somebody's got to be two sigmas to the left on the bell curve.

    21. Re:Low costs... by Skal+Tura · · Score: 1

      So counting for 0% err correction loss (in real world atleast 10%), maximum speed constantly, meaning every receiving end SMTP answers fast etc. means that each message was 132.71 bytes on average. round it to 133bytes, you don't have room for much, even with from a@b.com to b@b.com and subject a you use 40bytes ... Now that's not real world, real world is more like sender paul@warner,com, recipient mark28@aol.com subject Great Deals, takes 65 bytes. So you have 68 bytes for your message. And that is with 0% error correct. More likely your maximum budget is 112.8bytes average per message, or 3.06k/s. So i'm calling you on your load of shit :) Maybe, just maybe, 25k messages an hour, leaving a budget of about 440 bytes per message. Now, every mailer uses a queue spool and discreet agents to do the actual sending, if i recall right. Well atleast in a case sending cannot be done immediately it's first queued up. That would mean 27.7 seeks average per second for writing. 36.1ms per seek + write of the max 200bytes. Then another for read. At least that portion can be done on that era HW :)

      --
      Pulsed Media Seedboxes
    22. Re:Low costs... by JWSmythe · · Score: 1

          Ok, you got me. My memory isn't perfect. It was a 56k modem with compression. And it may have been a little longer than an hour, but not more than a day.

      --
      Serious? Seriousness is well above my pay grade.
  2. Fine the parent company by zoomshorts · · Score: 1, Funny

    of each business 5 dollars per piece of SPAM. Real businesses will distance themselves almost instantly.

    1. Re:Fine the parent company by WrongSizeGlass · · Score: 1

      of each business 5 dollars per piece of SPAM. Real businesses will distance themselves almost instantly.

      The fine is already $16,000. From the link:

      Each separate email in violation of the CAN-SPAM Act is subject to penalties of up to $16,000, so non-compliance can be costly.

      It's just a matter of actually finding them, dragging them to your jurisdiction and squeezing blood from a stone.

    2. Re:Fine the parent company by piripiri · · Score: 1

      Nice way to fine your competitors. Just send SPAM with their product/company, grab some pop-corn, and enjoy!

  3. Charging for E-mail? by bejiitas_wrath · · Score: 2

    http://www.guardian.co.uk/technology/blog/2006/feb/05/aolyahootost

    What happened to the rumours a while ago about charging for E-mail? This might stem the tide if an E-Mail cost a very small fee to send, but considering the volumes of E-Mail sent around the world, this would not be very popular at all. There will be some bright spark out there that will come up with a solution for spam E-mails soon, but those Nigerian E-mails sure are funny...

    --
    liberare massarum ex ignorantia, clausa descendit molestie.
    1. Re:Charging for E-mail? by JWSmythe · · Score: 1

          Well, the system was horrible. I worked at a place where we sent a lot of mail. It was all customer service related, like password resets, billing confirmation, and expiration notices. They wanted a little something, but with the huge numbers of customers that we had, it would have been unmanageable. That doesn't even account for the normal business emails, exchanged between our network and customers.

          We looked at it, said "when it's been accepted by more systems, we'll use it", and that was the end of it.

          Luckily, goodmail seems to have died off.

          It would have really sucked for one of my sites. We sent a few thousand newsletters out daily (specifically requested by the users, no dirty tricks to "encourage" them to sign up). With other associated costs (server hardware, hosting, SSL cert, etc), we've been in negative cashflow for about 8 years. But we like it, our users like it, so it survives. If we had to pay per email, the newsletters would stop. And one thing I learned years ago, once you start delivering news straight to people's email, and they want it, if your newsletter doesn't even go out for *ONE* day, people start complaining.

          Sure, it'd impact spammers more (hopefully), but for us little guys, it would have killed us.

      --
      Serious? Seriousness is well above my pay grade.
    2. Re:Charging for E-mail? by WrongSizeGlass · · Score: 1

      It's kind of tough to charge back to these fake domains, shell companies and other institutions that are spread out over many countries (some of which actually don't care how their citizens or companies bring in income). If they need to pay for email in advance, well, who's going to put a gate keeper in place to check each and every email, verify they have an available balance, deduct the cost of the email and let the message through? We can't even verify the sender on most email.

      Requiring every domain to use something similar to domain keys & domain signatures would be a nice start, but those aren't free from problems or errors.

    3. Re:Charging for E-mail? by WuphonsReach · · Score: 1

      Legitimate senders would pay, sure. But...

      All those mailing lists that you belong to, for free? Where you get free technical help? Gone.

      All those spammers who use botnets, fake domains, and host their sites on other people's machines via theft of service? No effect at all.

      Not to mention the whole issue of "who would collect the money and meter the usage?".

      --
      Wolde you bothe eate your cake, and have your cake?
  4. The root of the problem by jandersen · · Score: 2, Funny

    We need to find a way of dealing with the root causes of the problem; filtering and the like is like sweeping up rat droppings, what you really need is to get rid of the rats. Perhaps if we could find a way of really making this business unprofitable.

    1. Re:The root of the problem by WrongSizeGlass · · Score: 2

      Perhaps if we could find a way of really making this business unprofitable.

      You mean actual Spam Assassins? Government sanctioned agents hunting down and eliminating the problem of 'spam'? I like the idea but I'm afraid those government agents are too busy at the moment shutting down 'dangerous' websites and chasing pirates.

    2. Re:The root of the problem by LordNacho · · Score: 1

      You're right, if we gave everyone a free 2 inches, the market for these spammers would be gone.

    3. Re:The root of the problem by erroneus · · Score: 1

      That would be unethical. We need a "War on Spam" initiative. I think that would make a dent. Send a few spammers to Guantanamo. They could come from anywhere in the world and never be heard from again.

    4. Re:The root of the problem by plunderscratch · · Score: 2

      Perhaps if we could find a way of really making this business unprofitable.

      I'm gonna do my bit and finally stop responding and 'making mine bigger', it makes the missus cry these days anyway.

      --
      Guns don't kill people! Admins do!
    5. Re:The root of the problem by tehcyder · · Score: 1

      We need to find a way of dealing with the root causes of the problem; filtering and the like is like sweeping up rat droppings, what you really need is to get rid of the rats. Perhaps if we could find a way of really making this business unprofitable.

      Abolish capitalism and the cash nexus?

      --
      To have a right to do a thing is not at all the same as to be right in doing it
    6. Re:The root of the problem by yarnosh · · Score: 1

      But if the rat droppings are the only real problem and the rats aren't otherwise being a nuisance, what's wrong with automating the removal of the rat droppings? I know in principal it would be nice if spammers/rats were completely out of business, but looking at it from an end user's perspective, what's the difference?

    7. Re:The root of the problem by mattack2 · · Score: 1

      Because you end up removing something you actually *wanted* on the floor sometimes, without knowing it... so you have to either live with that, or still manually sift through the rat droppings once in a while.

    8. Re:The root of the problem by Linuxmagic · · Score: 1

      We need to find a way of dealing with the root causes of the problem; filtering and the like is like sweeping up rat droppings, what you really need is to get rid of the rats

      Hehe.. SpamRats.com, over 100 Million detected already.. But the part comes when IPv6 rolls down the Pipe!

  5. Anti-spam industry by Anonymous Coward · · Score: 1

    "While it has engendered both widespread antipathy and a multi-billion dollar anti-spam industry"

    So at least somebody makes money on spam...

    1. Re:Anti-spam industry by ryanw · · Score: 1

      Maybe they're the ones causing spam to exist? Wouldn't put it past them.

  6. The article by Anonymous Coward · · Score: 2, Funny

    http://cseweb.ucsd.edu/%7Esavage/papers/Oakland11.pdf

  7. apropos Mencken quote by dltaylor · · Score: 2, Funny

    âoeNo one in this world has ever lost money by underestimating the intelligence of the great masses of the plain people. Nor has anyone ever lost public office thereby.â

    Henry Louis Mencken

  8. bitcoin spam!? by antivoid · · Score: 1, Funny

    Soon you will be getting spam "please give me bitcoins to address XYZ" That said... If you found my comment useful please donate to 1PDT9ujzCjYqS2Z2vTKsZJ2uBtU9EtaaXg Haha

  9. New type of spam by antivoid · · Score: 1, Funny

    Soon you will be getting spam "please give me bitcoins to address XYZ" That said... If you found my comment useful please donate to 1PDT9ujzCjYqS2Z2vTKsZJ2uBtU9EtaaXg

  10. collaborators by deodiaus2 · · Score: 1

    Don't forget to add the help of our elected officials who get lobbied to pass toothless regulations to curtail the industry. I think the current regulations are that as long as someone posts an "opt out" of future mailings, they are safe. This doesn't mean that they really have to not send you mailings, just a button which pretends to implement such a feature. And there is nothing to prevent them from selling your "valid live address" to the next mass marketeer!

  11. spam needs not to be profitable, only visible, for by Anonymous Coward · · Score: 1

    spam needs not to be profitable, only visible, for others to copycat it. if it's visible, it will appear to be profitable. groupons spam isn't profitable, but appears so.

  12. Different attack by BCW2 · · Score: 2

    Instead of going after the actual spammers why not fine the companies that hire them. If a Bank (Orchard Bank leaps to mind) hires an advertising company to push credit cards, fine the bank if their agent uses SPAM as a marketing tool. Pretty soon any reputable company will not allow their name to be tied to SPAM and anything left will be all scams.

    --
    Professional Politicians are not the solution, they ARE the problem.
    1. Re:Different attack by yarnosh · · Score: 1

      It is such a fuzzy line though between legitimate marketing email and spam. A lot of people don't consider it spam if you give the user some way to opt out (that works). Personally, I consider any unsolicited marketing email to be spam. Mass mailing lists must be opt-in. And checkboxes for such emails on registration forms must be unchecked by default.

    2. Re:Different attack by Raenex · · Score: 1

      Instead of going after the actual spammers why not fine the companies that hire them. If a Bank (Orchard Bank leaps to mind) hires an advertising company to push credit cards, fine the bank if their agent uses SPAM as a marketing tool.

      You were close to the point in the article, but you're after the wrong target (the merchants). Oddly, you picked a bank as a merchant, but it's the banks that are handling the merchant transactions. This is why the US targeted financial institutions in their online poker crackdown.

      From the article: "All told, they saw 13 banks handling 95% of the 76 orders for which they received transaction information. [..] This points to a fruitful avenue to reduce spam: go after the banks."

  13. What happens if you respond to SPAM? by elsurexiste · · Score: 1

    A few days ago, I read an article about that here. Turns out they are serious businesses. Well, at least as serious as you can get if you send SPAM :) . Just sharing with you, people.

    --
    I rarely respond to comments. Also, don't ask for clarifications: a brain and Google are faster, believe me!
  14. stopping the money by targetting the banks by capoccia · · Score: 1

    since there are nearly 40 comments already and no one is talking about the banks, i'll assume no one is reading the article.

    the main conclusion is that spam could grind to a halt if credit card companies blocked all transactions to the dozen suspicious banks. it takes the spammers long enough to set up a new bank account that the new accounts could be blocked faster than they could be set up.

    1. Re:stopping the money by targetting the banks by yarnosh · · Score: 1

      Or people could just start implementing the very good filtering solutions that are out there. I know it sounds like a bad idea to enter an arms race with spammers, but this is probably one of those rare cases where it has worked. We're winning. Filtering solutions are GOOD. Turns out the more things spammers do to try to slip through filters, the more obvious their attempts become and the easier they are to pick out.

      When was the last time you saw spam in your gmail account? I haven't seen a single instance in months except for a few messages coming through some poorly maintained mailing lists, from which I usually unsubscribe when I start getting spam.

  15. The irony of spam is... by Paul+Fernhout · · Score: 1

    The irony of spam is it results from having a tool of abundance (email, useful for building a better world, whether more of a gift economy or better designs or in other ways) in the hands of a few people obsessed with making money (ration units) in the current scarcity-based economic paradigm that emphasizes one-for-one exchange and privatizing profits while socializing costs. So, spammers poison the email system trying to get a bit of resources for themselves, and while doing so make it harder for the rest of us to bring abundance to everyone (including those who are the spammers).

    --
    A 21st century issue: the irony of technologies of abundance in the hands of those still thinking in terms of scarcity.
  16. Re:LAMP security results 4 "Phishing/Spamming" by tehcyder · · Score: 1

    What's the point of posting as Anonymous Coward when (a) your style is fairly unique and eye-catching and (b) you sign your initials at the end?
    Just curious.

    --
    To have a right to do a thing is not at all the same as to be right in doing it
  17. Re:why do people get spam any more? by HikingStick · · Score: 1

    You may not be filtering it, but I suspect someone is (e.g., your ISP).

    I manage our company's mail server. We're a small company (only around 80 employees), and there are three published email address (even though I've advised using feedback forms rather than email addresses). Our mail server is blocking tens of thousands of messages a day, and that's after setting up firewall rules to block almost everything coming in from APNIC (save for New Zealand) and parts of Africa. I've reviewed the logs: much of the junk that is trying to come in seems to be in the form of brute force attacks trying to find valid email accounts. The company has always used one standard format for how it puts together its email names, so when I see things trying to come in using combinations of letters and numbers in the user ID, I know it's a brute force attack.

    In the past, I've gone the disposable eddress route, but it just hasn't been worth it anymore. Spam filters, even at places like Hotmail, are catching more and more of the crap (either deleting it outright or dumping it into a suitable junk mail folder), and I can set up rules to automatically delete anything semi-legit or legit that I don't want to see (when the unsubscribe link or method never seemed to work, or when I didn't care to try to figure out my password to some old service).

    If you have no spam, consider yourself lucky. As for the rest of us, we'll manage.

    --
    I use irony whenever I can, but my shirts are still wrinkled...
  18. This was discussed on NPR a few weeks ago by BenSchuarmer · · Score: 1

    http://www.npr.org/2011/05/26/136690513/study-may-shed-light-on-how-to-stop-spam

  19. Does anyone here actually get spam email? by yarnosh · · Score: 1

    Seriously, who still gets spam email these days? Filtering solutions are fairly mature and effective. I might go so far as to say we're winning the battle... if it weren't for the fact that like 90% of all email is spam. Still, I publish my gmail address all over the feakin' place including usenet and I can't remember the last time I got a single piece of spam in my inbox or a missed email due to filtering. When I ran my own mail server I could filter out most spam as well using free tools and techiques. So, what's the big deal? Who is still getting spam and why haven't you changed email providers?