[A brief digression from the usual film reviews and snarky out-of-context comic book panels.] I spend a lot of time online for my work as well as for pleasure, and consider myself a reasonably savvy computer user. Admittedly, I’ve been caught in viral traps a few times, but I didn’t just fall off the turnip truck: I don’t blithely walk into simple snares. Fortunately, my primary e-mail system defends against most spam, although a few pieces of junk jump the cyber-fence daily and have to be dispatched (to hell!) by me, personally.
The other day I received an e-mail which, although I readily identified it as bogus, piqued my interest about its nature and creation. It wasn’t one of those mass-mailings promoting a generic product or service to millions, it wasn’t even one of the more narrowly-construed spams (obviously targeted in some way to my affiliation with an educational institution, a still huge target audience but certainly smaller than the generic messages sent to the whole online world).
No, this one was not only sent to my e-mail address, but the subject line read “page for David.” That’s pretty specific—there are 3.7 million people in the USA whose first name is David, which seems like a lot, but that’s less than 10 percent of the total population, so the odds of me randomly receiving a spam e-mail labeled “page for David” don’t seem that great. But, since my name and e-mail address are publicly available on the Web, it wouldn’t be impossible for a spam-mail program to insert my first name into the subject line. It happens all the time with direct-mail marketing via snail-mail, so obviously e-mailers can do it.
However, the matter gets more complicated. The “sender’s” name was someone I actually know. Someone with whom I am no longer in touch, really, and who would never send me an unsolicited e-mail, but still...it was a shock to see that name. Even though I knew this was a spam message, when I first saw it, it elicited a frisson of...excitement? Fear? Pleasure? There’s that split-second where you think “maybe, just maybe, this person really did send me a message?” And even though that hope is almost-instantly shattered by one’s rational brain (even before opening the actual e-mail), the emotional damage has been done. Infernal Spammer, how dare you remind me of this person who at one time meant a lot to me?!
A couple of additional points. The “sent from” e-mail address (bogus, of course), had a “umw.edu” suffix, identifying the sender as affiliated with the University of Mary Washington, located in Fredericksburg, Virginia (not too terribly far from where I live). I don’t know anyone there, I have no connection with that school, and the person whose name was falsely attached to the e-mail isn’t even in the USA, so there’s no clear, direct connection at all. I’ve seen this before: sometimes I get spams with fake sender addresses containing “k-12,” a public school identifier. These are just harvested or ginned up somehow, I understand.
The actual spam e-mail originated in Romania (looking at the full e-mail header and tracing the I.P. address), although the suffix on the link included in the email itself (that’s all that was there, a link that I didn’t click on because...I’m not an idiot) was “.ru” (the Russian Federation).
So how did this all come together? I have literally never gotten a spam email like this, allegedly sent from a person known to me but not obviously from a hacked account. [I’ve occasionally received e-mails supposedly from individuals I know, whose computers were apparently hacked in some fashion--while the contents of the messages were clearly spam, the sender, sender’s address, and (in several cases) the list of additional recipients were legit.]
Somehow, the spammers assembled various pieces of information:
b) my first name (in the subject line)—btw, my full first name is not part of my e-mail address
c) the real name of someone I actually know (as “sender”)—exactly how they did this, I have no idea, particularly if neither my nor this person’s account was hacked (as they don’t appear to have been). Our names aren’t linked anywhere else on the Internet, as far as I know.
d) a completely different (and bogus) sender’s e-mail address (which, perhaps coincidentally, is linked to a university in a neighbouring state)
One has to grudgingly admire the technical ingenuity of spammers, who harvest information from multiple places and create a sort of Frankenstein’s monster of an e-mail, and...for what? On the outside chance that I’d click on a mysterious and almost definitely harmful link? (Seriously, they didn’t even bother to add any text to try and lure me into clicking it.) I realise it’s all automated data-harvesting and spam-generating programs that are doing this, but it’s still...weird.
Look, I get e-mail and snail-mail addressed to my parents (both of whom are deceased), and I shrug it off (in several cases it’s my fault, since I didn’t bother to change the names on the accounts). If I received an e-mail allegedly from them, that would be odd and mildly offensive but I wouldn’t be incensed. I'd know that this was a fake, and...spammers gonna spam, right?
But when they start toying with my emotions, stirring up long-dormant feelings, sending might-possibly-be-true-no-wait-of-course-it's-not-awww-sad-feeling e-mails, those Russian-Romanian hackers have gone too far! I might just remind them of another group of Eastern Europeans who stirred up trouble and got this message for their trouble:
I don't know who you are. I don't know what you want. If you are looking for ransom, I can tell you I don't have money. But what I do have are a very particular set of skills, skills I have acquired over a very long career. Skills that make me a nightmare for people like you. If you let my daughter go now, that'll be the end of it. I will not look for you, I will not pursue you. But if you don't, I will look for you, I will find you, and I will kill you.
[Back to film reviews and amusing comic-book panels and other such diversions soon.]
