(Not so) Little Lost (Spam) Robot

Little Lost Robot is a story by Issac Asimov published as part of the I, Robot collection.

Recently I've seen an odd trend - about 10% of the spam I end up doing forensics on doesn't have any apparent purpose. However, this empty spam has all the typical indications of being spam.

It's ironic. The reason I wrote an email spam blocker was so that I could avoid having to deal with unwanted email myself. Now I spend more time on spam than I did before. This is because I have to examine each unblocked message in depth - including these mysterious empty ones.

The hallmark random text is there. The message is usually sent from a known "problem network." Sometimes there are other header oddities that are almost always only found in unsolicited commercial email. All that's missing is the contact information that would make the message worthwhile to send. Without a working website, phone number or even return email address - the message is presumably worthless to the sender.

So what's going on here?

Some people have theorized that spammers are sending large numbers of these messages in an attempt to confuse collaborative spam blockers. I have a different theory.

Empty spam started showing up in mass about the same time botnets became popular with spammers. Botnets are collections of computer systems taken over by spammers or other jerks to send unsolicited email or perform malicious acts without their owners knowledge or consent.

Usually these systems belong to users who have either been duped into installing the botnet software, or had it forced upon them through a security exploit. Botnets as large as one-million computers, or "nodes" have been identified.

So what would happen if some or all of the botnet computers lost communication with their master?

Security patches or changes in network configurations might close holes that were used to manage the systems. Alternately, what if the spammer just decided to get out of the business, or abandoned the botnet due to concerns about getting caught?

Not knowing how the software was written, it's impossible to say for sure. However, it seems plausible that at least some flavors of botnet spam software might keep on sending spam, even if they didn't have the "payload" (the actual advertisement content).

The resulting spam might appear exactly like the "empty spam" so many people have been seeing as of late.

Back