July 28th, 2009
Spammers go multilingual, use automatic translation services
For years spammers relied on basic mass marketing concepts in an attempt to target everyone, everywhere, thereby sacrificing quality for quantity.
Things changed, at least for some of them. Realizing the advantages of market segmentation, certain spammers started segmenting the databases of harvested or emails based on their country of origin, followed by an attempt to go local in terms of spamming by using the native language of the prospective recipients.
Nowadays, spam is not just going multilingual, on demand translation services exclusively marketed to cybercriminals are prone to change the name of the game, allowing them to easily localize the messages for their upcoming malware/spam/phishing campaign to the native language of the targeted audience.
According to the just released MessageLabs Intelligence report for July, around 5% of the overall spam volume was in the native language of the targeted audience, with the majority of the messages translated using automatic services:
Globally, the majority of spam is in English, and in July around 5%, or 1 in every 20 spam messages, was in non-English language as highlighted in Figure 1. On analyzing the proportion of spam in non-English countries, the volume of English-language spam can often be much less in than English-language countries, suggesting that spammers are targeting countries correctly rather than sending all countries English language spam. For instance, in Germany 46.5% of all spam is in German and 2.5% in French. In The Netherlands, 25% of spam is in the Dutch language while in France, 53% is in French and 4% in German. In Japan, 62.3% of the spam is found to be in Oriental non-English languages and in China, this number is 54.7%.
The ongoing localization as a trend was also confirmed in McAfee’s Global S.P.A.M Diaries experiment conducted in 2008 (page 12), where the same countries once again topped the charts for receiving most of the localized spam messages.
- Go through related posts - With or without McColo, spam volume increasing again; Atrivo/Intercage’s disconnection briefly disrupts spam levels; Google: Spam volume for Q1 back to pre-McColo levels; Overall spam volume unaffected by 3FN/Pricewert’s ISP shutdown; Inside an affiliate spam program for pharmaceuticals
Despite the easy of use and free nature of automatic translation services, their use is prone to decline due to the questionable quality of the translated messages, which could potentially undermine the efforts the spammers are putting in the first place. Cultural diversity cannot be achieved automatically, but just like everything else in the underground marketplace nowadays, the process is available as a service.
One such service which I’ve been monitoring since October 2008, remains active and due to its evident partnership with a particular cybercrime-facilitating community can be easily considered the de facto choice for quality-conscious spammers who care about their anonymity - the service keeps no logs for any interaction with prospective customers.
What do you think, would spammers continue using the mass marketing approach and achieve results such as 28 sales based on 350 million spam messages without localization based on the end user’s old habit of clicking on spam links, or would they embrace professional translation services on a large scale?
Talkback.
Dancho Danchev is an independent security consultant and cyber threats analyst, with extensive experience in open source intelligence gathering, malware and cybercrime incident response. He's been an active security blogger since 2007, and maintains a popular security blog. See his full profile and disclosure of his industry affiliations.
Subscribe to Zero Day via Email alerts or RSS.
