Cybersecurity guide for developing countries Malefactors of all kinds have rapidly adapted to the computer age, adding hacking to the tools of their trade. They bring a frightening resourcefulness to bear on new ways of misusing this technology. II.1.8 Nuisances and malware II.1.8.1 Spam Spam is the bulk sending of unsolicited e-mail for commercial or publicity purposes, the object being to entice web users to order a product or service. Spam remains a potent nuisance, despite the enormous technical and financial resources that service providers have committed to the search for a way of blocking it, despite the announced intention of public authorities to combat it, and despite the conviction of particularly blatant spammers in the past. In September 2003, spam made up 54 per cent of all e-mail traffic. In 2005, the number of spam messages sent in the United States exceeded 12 billion, i.e. 38.7 per cent of all traffic, according to IDC. At its worst, spam comes to resemble an e-mail bombing attack, with overloaded mail servers, full user mailboxes, and the attendant inconveniences. Users may fall victim through the practice known as list linking, whereby their address is added to spammers’ lists without their consent. The only alternative to attempting to unsubscribe from the lists, which can be an arduous task, is to change one’s e-mail address. While this measure is effective, it is also highly disruptive, as it requires the user to notify all possible correspondents of the change. The exorbitant number of unsolicited, inappropriate, and sometimes shocking messages may be perceived as an intrusion into the user’s private sphere, like junk mail. In addition, however, spam is also increasingly being used as a vehicle for malicious programs (malware), which is an exponential increase in its harmfulness. II.1.8.2 Malware The principal monitors of IT security (including the Computer Emergency Response Team (CERT)12, the United States Federal Bureau of Investigation (FBI), and the French Clusif) have observed in their annual reports on cybercrime that the number of malicious and nuisance programs running on computers without their owners’ knowledge is increasing. This includes the following kinds of software: – downloaders, which are used to download and install data and programs remotely; – keyloggers, which monitor what keystrokes the user enters at the computer; there are also hardware keyloggers, invisible at the software level, which record such data; – zombies, or “bots” (short for “robots”), are programs that allow the system to be controlled remotely for the purpose of building a hidden army of computers. Every day, 25-50 new bots are discovered. They are used for spamming purposes, phishing attacks, or for the distribution of adware. In October 2005, the Netherlands police arrested three men suspected of running a network of 100 000 bot computers to launch denial-of-service attacks and target the PayPal and eBay accounts of their victims13; – adware (advertising software), used to customize business transactions; 12 www.cert.org – See statistical information for 1998-2005, at www.cert.org/stats/cert_stats.html 13 Source: Clusif Report, Panorama de la cybercriminalité, 2005: www.clusif.asso.fr/fr/production/ouvrages/pdf/PanoCrim2k5-fr.pdf 36 Cybercrime