Hijacked Email Addresses and Identity Theft

by Luigi Canali De Rossi
September 2002

Someone has hijacked my email address and is sending emails loaded with viruses to other people with high risks of ruining my company reputation and credibility. How can this happen?

Many people like me have found themselves victims of the tidal wave of spam and junk e-mail that is increasingly daily or inbox load. Not only many of us, especially the ones who own or manage Web sites in which e-mail addresses are publicly displayed, but also innocent and timid Internet surfers are not excluded from this terrible epidemic.

Fact is that most of this spam and junk e-mail originates from three different situations:

1) Unscrupulous marketers (or for that matter, naive and uneducated marketing people in respectable organizations) who utilise automatic harvesting software to "grab" e-mail addresses from selected Web sites, and utilize them to build their direct marketing distribution list.

2) Companies that sell bulk e-mail lists of addresses, including yours and mine, which have been created and assembled with the most disparate methods. These lists sell as low as $ 50 for several millions of worldwide email addresses. Also in this case it is the use from unscrupulous marketers or from naive and uneducated marketing staff that makes the purchase and use of such information a destructive, unfair and detrimental issue for all of us.

3) E-mail viruses like Klez in all of its variants, which utilize your e-mail distribution list (meaning your Outlook Contact list) as a trampoline from which to launch itself to other computers. Some of the strands of this virus are even able to replace the From address of the infected email being sent out with your very own email address, making it appear as if YOU were the actual sender of whatever message, ad, or nonsense the virus is sending and spreading around.

It is a pretty bad situation, mostly because we all pay in terms of time wasted filtering good emails from bad ones, it also damages all of us because Internet bandwidth is everybody's wealth and spam and junk email add incredibly to the amount of traffic that travels across the Internet backbones daily.

Not last there is now a whole industry that has to devote itself to analyze, research, study and development of tools, methods and techniques that can help us limit, control and improve this terrible situation. We are all bearing the costs of this new industry which each one of us will need to finance in order to survive (information-wise). Unless we all have some form of professional and reliable anti-virus we can't turn on our PCs anymore. This is reality. Soon, I will not be able to manage anymore the quantity of spam and junk email I am receiving and it will take me more than 20 or 30 minutes per day to clean up this useless information flow.

Differently from traditional direct mail marketing, in which people pay to send promotional and marketing materials to other people on the Internet the cost of entry to send out one million emails maybe indeed very low. And since the law of numbers says that indeed by spamming enough of a large group of people, somebody will be interested and will actually buy the product or service you are promoting. So it goes that inexperienced marketers and people who have no ethics or value for civilized electronic communications make a rapid calculation that goes like this:

Direct marketing history and statistics tell us that by mailing people with an interesting offer about 0.5 to 1% of them will actually respond positively to it. So, if I can make my audience pool large enough to convert that 0.5% into a few thousands people, well "bingo!", I should become rich in a few days. So many new online marketers set out to email millions of unsuspecting email owners like you and me, as a 0.5% of one million is already 5000 people!!! Multiply that for even a few bucks of margin and you see how easy it is to fall prey of this miserable money mirage.

How low we have fallen.

Anyway, there is little I can do in the way of stopping or limiting this widespread phenomenon, outside of telling you why it is not good and what negative consequences it brings with it.

Its main drawbacks are:

1) Lots of your time gets being spent by cleaning up useless e-mails. This is like having a domestic appliance that purposely spreads and blows dust and paper debris throughout your apartment while you are not there. For a large corporation or organizations this means serious money being throw out of the window.

Add up all of those 20 minutes of junk email clean up and see what it makes in a month inside an organization of 3000 people (20x3000=60,000 mins x 20days = 120,000 mins = 2000 hours! That makes for a whopping 24,000 hours in a year or about 3000 8-hour days. Overall it is like giving up the work of about 9-10 people in one year).

2) Lots of good resources, time and money has to be invested in protecting and limiting this phenomenon, further derailing us from our own key goals and objectives.

3) People and companies that do not protect themselves properly from this plague can indeed loose large quantities of data and information due to a malicious virus. This can be a fatal blow for small and medium organizations that are not prepared for this kind of situations.

4) Internet bandwidth gets used up for purposes and reasons that are far removed from what we originally wanted and designed the Internet for.

5) Further spreading of junk email, spam and email-based viruses will provoke and bring out more controls, security checks and tracking and monitoring mechanism that are supposedly put in place to limit this phenomenon. In reality more security and privacy controls may further hinder our freedom to communicate and freely exchange as we have come to appreciate it in these pioneers years of online communication.

6) Governments and other political bodies will attempt to regulate, control and even filter email communications with the justification of preventing further spread of this plague and to warrant safety to companies and organizations. Of all the negative consequences of junk email, spam and email-based viruses this is by far the one that could be most detrimental and difficult to revert once in place.