How spammers hijack sites

One of the major trends throughout 2008 is spammers' increased use of cloaking techniques to hide their poor reputation behind someon
e else's good reputation.

This means that instead of sending email from a known spam IP address or -- more commonly -- from an infected bot server, spammers are finding new ways to send messages using valid or known mail servers, mainly webmail accounts, which have a reputation as a legitimate email source.

There are several methods spammers use to hijack good reputation, in order to make use of it to deliver their unwanted mail.

According to a recent report from Commtouch, a security company, spammers sign up for thousands of free email accounts, through the use of compromised CAPTCHAs. CAPTCHAs (short for Completely Automated Public Turing test to tell Computers and Humans Apart) are word images used to ensure that a human being is filling out a registration form, as opposed to a machine.

Algorithms to break CAPTCHAs are readily available to purchase for illicit use, enabling spammers to generate a nearly unlimited supply of free email accounts from which to send their messages, without intervention.

In order to gain access to legitimate email accounts without registering them themselves, widespread phishing attacks can persuade enough unwary users to provide their legitimate credentials to criminals.

Spammers often use legitimate hosting sites to host their illegitimate content. They can also create multiple redirection pages on these sites using compromised CAPTCHAs. Sites put in this awkward position recently include: live.com, tripod.com, and photoshosting.com.

Source : infotech.indiatimes.com