Spam, which refers to unsolicited junk email, has plagued the internet for decades. Whether it’s annoying weight loss advertisements, harmful email attachments, or scams, nobody likes spam. Its popularity is largely due to its ease of use — sending a million spam emails is cheaper and simpler than sending even a thousand pieces of physical junk mail.
While modern email services have gotten much better at fighting spam, there are still groups that send spam all day. One of them, River City media, was just exposed. The story of its downfall is interesting, and can teach us a few things.
River City Media’s Spam Empire
Have you ever checked the box that says Yes, I agree to the terms and conditions when downloading software, creating an account on a website, or using various services — without actually reading them? Most people skip right by because terms of use are incredibly long and boring. Often, these terms contain clauses that allow the website to share your information with “select partners.” Of course, those “partners” then share it with others, so there’s no telling how far your information spreads once it’s online.
River City Media (RCM) was a small group led by two known spammers. They masqueraded as a legitimate marketing firm, pretending to handle email campaigns for real companies. Their real motives, however, were much more devious, and they obtained a massive amount of information on people using the sharing techniques discussed above, along with shadier tactics.
The spammers’ database contained full names, email addresses, and physical addresses of 1.4 billion people. That’s a lot of information all in one place, especially for people who aren’t using it for noble purposes.
RCM took full advantage of their database. From the leaked information, it’s clear that these spammers sent out a billion emails a day. They used many techniques to accomplish this astronomical number, including abusing connections to Gmail in order to funnel out spam.
RCM’s Downfall
Chris Vickery, a security researcher, happened to stumble upon a large store of information. After some investigation, he found that it was an entire dump of information from RCM, completely unprotected. It turns out that the group had attempted to perform a backup, but it failed and left the backup data exposed for anybody to find. Because it wasn’t password-protected, Vickery was able to read through and find RCM’s accounting details, production notes, and business affiliations.
After bringing in anti-spam group Spamhaus and working with law enforcement, RCM’s practices are essentially dead in the water. They’ve been completely blacklisted, so they can’t operate with their old practices anymore. Those in the group may even face arrest after the data is processed.
Of course, this doesn’t mean the end of all spam. There are certainly other groups who will learn from this and continue their dark practices. But it is a great victory for innocent email users.
What Can You Learn from This?
There are a few important bits you should take away from this story.
First, it’s incredibly important to keep strong passwords on all of your digital information. Your IT provider should be taking care of this for your business, but it’s vital that you protect your own accounts, too. Don’t use weak passwords for your email or other critical accounts.
Second, know that email spam is still a problem. Modern services are great at fighting it, but sometimes junk still gets through. You can easily identify spammy advertisements, but darker spam like CEO scams that threaten to steal from your business are alive and well. Don’t open email if you’re not certain that it’s legitimate.
Third, be careful what you agree to online. It’s not plausible to read through every set of terms and conditions, but watch where you hand out your email address and other personal details. They’re shared more often than we’d like to think.
If you have a problem with email spam or want to make sure your security is up to par, please get in contact with us today for a free assessment of your infrastructure.
Image credit: MacKeeper