While the U.S. voters have now been heard and are welcoming their new president, it is important for us to remember that the spam campaign is certainly not over. Spam levels averaged in at 76.4 percent of all messages in October 2008. This spam level represents a year-on-year increase of nearly six percent since October 2007.
Over the last year, Symantec has been monitoring spam related to the U.S. presidential campaign. It all began 12 months ago when spammers cast their first votes for Republican nominee Ron Paul. With spam subject lines such as “IRS Fears Ron Paul?”, it was certainly an early indication that it was going to be an interesting year for spam related to the presidential campaigns. February 2008 saw a round of bogus links to Hillary Clinton videos that were cloaking a malicious Trojan. This tactic emulated a popular technique being used by spammers to link malicious code and spam. This trend continued in amongst other types of spam attacks during 2008.
March 2008 saw the U.S. presidential spam race heat up even further. URLs containing Hillary Clinton’s name were observed in pornography and male enhancement pill spam. After Hillary, spammers moved on to the remaining frontrunners. One spammer cast his vote for Mike Huckabee, with Barack Obama and John McCain having their names linked with "portable dewrinkle machine" spam, medical product spam and get-rich-quick spam messages.
When Obama took his trip to Europe in July, spammers followed up with a presidential spam campaign that contained spam subject lines such as “Kick-up – Obama speaks in London – video.” In August, as McCain was about to announce his VP nominee, a spam email was circulated from spammers with the subject line “McCain chooses Paris Hilton as running mate.”
These Presidential spam attacks were certainly not harmless – if the recipient opened one of these messages, they were often asked to click a URL link that hosted malware. This malicious spam is designed to infect other computers with viruses and Trojans rather than simply promoting a spam product. In October 2008, presidential gift card spam continued to be observed. Recipients were asked to complete a survey on the election with the promise of receiving a free gift card. This gift card spam attack was designed to harvest personal information.
As the race for the presidency entered its final hours, spammers were observed offering one of their last presidential spam products. Dubbed by spammers as a "Barackumentary,” spammers offered a free DVD about Barack Obama. However, in order to receive this "free" video, recipients were asked to provide personal credit card details to the sender. When the race finally concluded on November 4th, spammers persisted and issued a new Obama malicious code/spam attack. One particular message that included the subject line “Obama Wouldn’t Be First Black President” actually noted that Barack Obama had been elected the 44th President of the United States. Recipients were encouraged to click on a link to “Watch His amazing speech at November 5!”, but beware, malicious code would be downloaded if the video player is clicked. As we reflect on the presidential spam campaign of 2008, which was notable for its use of news headlines and the continuing linkage between malware and spam, it serves as a good reminder that we must remain vigilant against spam attacks that are currently in the cooking pot. Especially considering that Thanksgiving and Christmas are just around the corner.
This is what the message body looked like:
"Barack Obama Elected 44th President of United States
Barack Obama, unknown to most Americans just four years ago, will become the 44th president and the first African-American president of the United States.
Watch His amazing speech at November 5!
Proceed to the election results news page >> [malicious URL removed]2008 American Government Official Website - This site delivers information about current U.S. Foreign policy and about American life and culture."