In the fight against spam, Asia seems to be losing. Over the past few years, servers based in China and South Korea have become major sources of unwanted e-mail as spammers take advantage of loose regulation, low costs, and lax security (see BW Online, 9/13/04, "Now Spam Is Being Outsourced").
Some of the spammers are locals, others are Americans who find it easy to send out junk e-mails by taking advantage of high-speed networks in Asian countries. A lot hail from Russia and elsewhere in Europe. If spam were still largely confined to nuisance e-mails touting low-cost loans and inexpensive Viagra, it would be one thing, but more and more it's linked to hacking and phishing.
PROBLEM "IS GETTING WORSE". U.S. companies have been trying to work with Asians to crack down on the spam trade. In September, 2004, executives from companies such as Microsoft (MSFT), Time Warner's AOL (TWX), and Yahoo! (YHOO) traveled to the region to talk with Chinese officials about joint efforts to fight the problem. At the time, industry experts were hopeful that new legislation being pushed in Beijing and Seoul would help (see BW Online, 9/15/04, "At Last, China Targets Its Spammers").
More than a year later, it appears that nothing much has come from those talks, says Mikko Hypponen. He is the Helsinki-based chief research officer at F-Secure, a fast-growing Finnish company that focuses on helping computer users fight Internet viruses and other online threats (see BW, 5/22/05, "Hacker Hunters"). When it comes to China, the spam problem "is getting worse," says Hypponen. "We're seeing a clear increase in America-based rogue ISPs providing bandwidth and connectivity to spammers. They're renting space and bandwidth from Chinese ISPs that are not in Beijing but in more far-away locations." The U.S. outfits use foreign servers not just to send spam but also to host sites.
Others in the Internet-security business agree that the situation is not getting any better. According to Sophos, a British security concern that performs research on spam, the amount of junk e-mail coming from servers in China and South Korea has surged in the last year. Today, the two countries combined are the biggest source of spam in the world: China accounted for 15.7% of spam, up from 8.9% last year, and South Korea, 19.7%, vs. 11.6% last year. The U.S. remains the top single-nation source of spam.
QUICK RECOVERY. To be fair to local governments, regulators are trying to tackle the problem. And some analysts say the efforts are paying off. Suresh Ramasubramanian, manager of antispam operations at Hong Kong-based e-mail-security company Outblaze, says the number of spammers using Chinese servers has actually fallen. China's regulators "seem to be taking a fairly active role against spam right now," he says. "They're taking some action."
However, he adds, "if you build a better mousetrap, all you get are smarter rats." That means that the spammers might be fewer in number, but they're sending out more messages -- and they're able to move quickly in order to avoid detection. They also are teaming up, with foreigners getting together with local partners. "It's basic offshoring," says Ramasubramanian. "The local [company] does all the legwork for them."
So, for instance, if a spammer using a China-based Internet service provider gets cut off by the operator, the local agent soon moves to find another Chinese ISP. "They're up and running again in a matter of hours, or a day or two," Ramasubramanian says.
NEW TYPE OF THREAT. Some of that spam seems to be coming from hackers with political rather than commercial motives, Hypponen says. And they're becoming more sophisticated. For example, in late April and early May, U.S. government and military officials in the U.S. and in Hong Kong received e-mails claiming to be from The Washington Post. The attached Microsoft Word document was supposed to have new information on intellectual-property rights in China. Instead, it unleashed a virus that infected the computers of those who opened it. Not the sort of tactic hackers normally use to lure unsuspecting e-mail recipients to open messages.
"If you want to spread e-mail viruses, you claim to have photos of Britney Spears," says Hypponen. "This was a very targeted attack." Another reason for such targeted attacks is to avoid detection: Mass mailings quickly result in antivirus companies getting copies of the malware and coming out with solutions. If you only send a program to a few dozen people, it might not ever be sent to an antivirus business.
Most e-mail viruses seem to originate in other parts of the world -- particularly in the former Soviet Union countries and Eastern Europe. But Asia has become a leader in a new type of threat, viruses that target cellular handsets rather than PCs. Hypponen says most of the new mobile-phone viruses over the last 15 months have been written in Asia.
VULNERABLE SMART PHONES. The region has some of the biggest populations of mobile-phone users globally. China, of course, is No. 1, with the number of people using cell phones likely to reach 400 million soon, and it's quite easy and cheap to send short text messages. Japan and South Korea have some of the most advanced cellular markets in the world, especially when it comes to providing so-called third-generation mobile services. The Philippines possesses some of the globe's most avid users of text messaging.
Moreover, Hypponen notes, more than any other users, Asians have embraced high-end handsets that are more at risk from viruses. And, Outblaze's Ramasubramanian points out, many Chinese, Japanese and Koreans rely on their mobile phones as their primary way to access the Net.
In particular, smart phones are vulnerable because, like PCs, they're designed to facilitate easy downloads of software programs written by others and sent as attachments. Opening those attachments often results in the infections.
SPAMMING TOASTERS. To be sure, cell-phone viruses aren't nearly as widespread as those that target PCs. But that's because virus writers have only recently started doing their work: The first mobile-phone virus appeared in June last year. "It's still early days for the problem," says Hypponen. According to F-Secure, to date there have been just 80 mobile-phone viruses, with only a handful causing serious damage. In contrast, more than 140,000 PC viruses have been unleashed.
F-Secure predicts that the number of mobile viruses will soon explode. It took five years before PC viruses numbered 80. Only about 15 months passed before 80 mobile-phone viruses were counted. "We could have 100,000 mobile viruses in the next five years, instead of the 20 years that we've seen in the PC side," says Risto Siilasmaa, F-Secure president and CEO.
Asia is also at the forefront of the transition to a new generation of Internet technology called Internet Protocol Version 6 (IPv6) that will vastly increase the number of Internet addresses available. That will make it much easier for household devices to be connected to the Net -- one of the goals of visionaries who want to create the digital home.
But as Ramasubramanian says, this will prompt far more security challenges. "Just wait until your toaster and your microwave start sending out spam," he adds. As the fight against spamming and hacking moves from PCs to cell phones, Asia is likely to become even more of a battleground.
READER COMMENTS
Einhorn is a correspondent in BusinessWeek's Hong Kong bureau
CRM, SFA Software-Shelko Consulting NJ NY Area
SalesLogix is the Customer Relationship Management solution that enables businesses to acquire, retain & develop profitable customer relationships through integrated Sales, Marketing & Support automation. Shelko Consulting services NJ NYC Metro Area.
Printer-Friendly Version