Editor's note: The spam data cited in this post is drawn from the network of Google email security and archiving services, powered by Postini, that process more than 3 billion email messages per day. More than 50,000 businesses and 22 million users use Google Postini Services to protect themselves from a range of email and web-borne threats.

Q3’10 spam and virus trends confirm that spammers are still hard at work distributing malicious content in new and creative ways. August saw a massive 241% increase in virus volume over July, representing the greatest recorded surge in viral activity since 2008. Overall, payload virus volume increased 42% over Q2’10 and 10% over Q3’09, while spam levels decreased 16% and 24% over the same periods, respectively. The spike in malware attacks during August suggests that we might see higher levels of spam moving forward into Q4 as botnet “seeds” planted during this time begin to take action.

By the numbers
Overall, spam volume stayed relatively constant throughout Q3, with a slight dip in August and September. In comparison to the same time in 2009, spam levels are down 24%. This may be attributed to some recent botnet takedowns, such as the partial Pushdo shut down, or point to a generally slower summer season for spam.

Enterprise Holdings is the largest rental car company in North America and operates Alamo Rent A Car, Enterprise Rent-A-Car and National Car Rental. They manage over 1.1 million cars, 68,000 employees and 7,600 locations around the world. When Enterprise Holdings wanted to add more security to their corporate e-mail, they chose Google Postini Services.

Join us for a free webinar on September 28, where Michael Preuss, Manager of Windows Engineering for Enterprise Holdings, will discuss why his company chose a cloud-based message security solution and how Postini’s powerful spam filtering technology was able to help them address their email security challenges. Adam Swidler, Senior Manager with Google Enterprise, will also provide an overview of Google’s security solutions and facilitate a deep-dive discussion into best-in-class practices for organizations interested in enterprise-grade protection.

A live Q & A session will follow. We hope you can join us!

Message Security in the Cloud
Tuesday, September 28th, 2010
10 a.m. PDT / 1 p.m. EDT / 6 p.m. GMT
Register here

Posted by Adrian Soghoian, Google Postini Services team

Editor's note: The spam data cited in this post is drawn from the network of Google email security and archiving services, powered by Postini, which processes more than 3 billion email connections per day in the course of providing email security to more than 50,000 businesses and 15 million business users.

Back in 2007, we saw the first variants of a big virus attack later labeled the "Storm" virus. During that summer, Storm attacked with force, pushing payload spam activity to then-unprecedented levels and sustaining them for several months. The security community eventually caught up, and payload spam activity fell to nominal levels and held there. That is, until this year: Q2'09 saw a significant surge in payload spam activity, and now Q3'09 levels have made the 2007 Storm virus attack look small in comparison. Postini data centers have blocked more than 100 million viruses every day during what has so far been the height of the attack.

The majority (55%) of these viruses are messages like the one you see below, a fake notice of underreported income from the IRS (which the IRS distributed an alert on earlier this week). Another large contingent (33%) have come in the form of fake package tracking attachments, which were already on the rise in Q2. You might think a spoofed IRS notice or package tracking email is obviously spam, and wonder who would fall for it and actually click on the attachment.

However, at these volumes, it takes only a tiny fraction of the recipients being fooled for the spammers to add hundreds of computers to their botnets every day.

Our "Spam Trend" update last quarter summarized the rise in both levels and types of spam, with new players and techniques entering the market. This quarter, proliferation continues, with an unpredictable pattern of drops and spikes as 2009 moves along. Overall, spam is measurably up: Q2'09 average spam levels are 53% higher than in Q1'09 and 6% higher than in Q2'08.
Evidence of the resurgence in image spam can be seen in the graph below, which shows that the actual size of spam messages, measured in bytes, is back on the rise:

Posted by Amanda Kleha, Google security and archiving team

[Ed. Note: The spam data cited in this post is drawn from the Postini Message Security network, which processes and culls spam from more than 2 billion enterprise email connections per day, giving Google strong insight into the state of the spam industry overall. For a discussion of what Google is doing to keep spam out of your Gmail inboxes on the consumer side, check out this post.]

In November 2008 a large source of the world's spam, the McColo network, was taken offline. Prior to that, spam levels had been holding relatively constant. But when McColo went offline, we saw spam drop by 70% compared with previous levels. However, spammers are recovering with vigor.

While spam is still down overall, it's important to note its rate of growth. Spam levels are up by 156% since November 2008. As spammers recover, the increased rate of spam growth will likely have total spam volumes back to pre-McColo levels within a few months.



Although McColo received a lot of attention, the highest volume of spam in 2008 actually came on April 23, which was an all-time high spam level for Google Message Security data centers. That day, the average number of spam messages blocked per user was 194. This peak was driven by an unprecedented number of non-delivery receipt (NDR) attacks we saw in April. One customer who was the target of a specific NDR attack said that their users were receiving an average of 100 emails every minute.

As spammers fill the void left by McColo, it's reasonable to anticipate a decreasing rate of growth as spam reaches November 2008 levels. However, since the November levels weren't even the peak for the year, and since spammers appear to be quickly recovering, the question remains: Where will spam volume top out in 2009? Will it be near the November 2008 level? the April 2008 level? Or higher?



One way to approach that question might be to compare 2008 overall levels with previous years. Spam threats rose visibly in 2008, reflecting the overall trend of rising attacks. Even with the drop in November 2008, spam levels climbed 25% over 2007. Our statistics show that the average unprotected user would have received 45,000 spam messages in 2008 (up from 36,000 in 2007). All indicators suggest this trend will continue as virus, malware, and link-based attacks become both more frequent and more ingenious.



Looking ahead to the rest of 2009, we expect viruses sent via email and in blended attacks (email and web) to continue to be a serious threat. During the second half of 2008, virus volume increased six-fold from the first half of the year. These spam messages would often try to fool users by mimicking legitimate emails such as package tracking notifications or invoices that included virus attachments. Another popular technique in 2008 was emailing spoofed news alerts with URLs that would link to a website hosting the virus.

We can also expect that viruses and malware will continue to be a key tool and area of focus for spammers to upgrade their platforms. Even though virus attachment volumes have been low so far this year, we expect spammers to work hard to rebuild their networks to replace what was lost in the McColo shutdown.

Of course, the only thing we can really say with certainty about 2009 is that spam and viruses will continue to be unpredictable. And given that uncertainty, virus detection and blocking technologies become even more important. Last year we released advanced new anti-virus heuristics that specifically targeted zero-hour vulnerability (the period of time between when a new virus enters the wild and the release of the anti-virus signature file). When the zero-hour protection identifies a suspicious message, the message is scanned using the new anti-virus heuristics, and if confirmed as a virus, the message is quarantined.

The chart below is an example of our new heuristic virus detection and blocking at work. On October 1, 2008, our automated technology detected a viral message pattern (later identified as new strain of the Downloader-AAP!zip) in the wild and started quarantining messages with this virus. Five hours later we received the new virus signature file from one of our anti-virus partners and the signature-based blocks began to take effect.



As seen from the roller-coast ride of spam and viruses in 2008, spam has again demonstrated its resiliency. Despite eliminating a major source, spam keeps coming back. Spammers are re-investing with increasing speed to evolve their systems into decentralized, harder-to-detect ecosystems. If you'd like to know more about Google's anti-spam solution for businesses, visit us at www.google.com/a/security.

Posted by Amanda Kleha, Google Message Security Team

In today's economic climate you need to be more efficient with your IT budget. And since email is a key tool for almost every businesses, keeping spam and malware out of inboxes remains a top priority. In our experience, companies often overlook the productivity costs that spam and viruses have on their business. This simple ROI calculator lets you see how much spam can impact expenses and productivity, particularly if your current anti-spam solution is waning in effectiveness.

Once you quantify how much spam is costing your company, it makes sense to re-evaluate the IT options for managing spam. The first, and perhaps biggest, decision is whether to keep spam filtering in-house or use a hosted service. It can be difficult to add up the true expenses of each solution. On the surface, the cost of an appliance may seem reasonable, but the up-front costs are just the beginning in a complete cost-of-ownership calculation.

At Google, we believe that email security makes sense as a hosted service for several cost-related reasons:

* A cloud computing solution provides you with a predictable expense. A spike in spam can hit at any time, and companies using an in-house solution may find themselves dealing with the unexpected capital expense of a new appliance to deal with the load.

* You save on maintenance costs. After installation, most in-house appliances require regular upgrades and maintenance. With a hosted solution, all the updates are handled through the cloud. Nothing to worry about or budget for.

* Using the cloud makes email security more effective. With a hosted service such as Google Message Security, you tap into a network of intelligence that spans more than 40,000 businesses and 14 million users, reaping the benefits of the economies of scale that come with that.

To help you understand the whole cost of spam, we're introducing a TCO (total cost of ownership) calculator, which lets you compare expenses for in-house appliances versus hosted services. Using a three-year time horizon and considering both start-up and maintenance costs, companies can save thousands by choosing a hosted service. The graph below models the results of one cost scenario, for a 100-user company:



Let's look at a customer who was re-evaluating their spam solution last year: Gaines, Wolter, & Kinney, P.C. is a civil litigation firm in Birmingham, Alabama, that specializes in tort defense. They needed a solution that would reduce the inflow of network traffic and be cost effective. David Hebert, an IT administrator for GW&K, recalls, "Our limits on connection bandwidth meant that a service that filtered out spam was a no-brainer decision." But David needed data to convince management that a change was essential. He used a ROI calculator and found that they were losing 122 hours per employee in productivity each year to spam. With the hourly rate of their lawyers, this meant that choosing Google Message Security paid for itself in 1 day.

If your business is interested in learning more about how hosted services like Google Message Security can save you money and increase productivity, visit us at www.google.com/a/security.

Posted by Amanda Kleha, Google Security and Compliance Team

Last week, a web hosting service that was a significant source of spam was taken offline by the combined efforts of Security Fix and several Internet providers. Google would like to congratulate Security Fix for leading this effort and striking another blow in the battle to stamp out spam on the web. The removal of this service helps "clean up" the web for everyone, and dovetails with efforts like Google's to make web communications safer and more secure in all of the ways that people use it.

We'll continue to monitor spam traffic, as we always do, but here's what we've seen in the past few days:

On November 11, when the spam source was taken down, we saw a 70% drop in spam from levels seen at the beginning of the month. However, we've seen drops like this before. In late July this year there was a similar drop that was reversed within a few days.


Gmail servers, which also noticed a drop in spam on November 11, are now showing an upward trend as new sources of spam, as always, continue to emerge.
The team at Google stays "on guard" as the fight continues!

Posted by Amanda Kleha, Google Security and Compliance Team

In their recently released Magic Quadrant for Email Security Boundaries (published September 11, 2008), Gartner Inc., an information technology research and advisory company, placed Google in the "Leaders Quadrant." Quadrant leaders, as Gartner defines them, are "performing well today, have a clear vision of market direction, and are actively building competencies to sustain their leadership position in the market." Quadrant leaders also "offer a comprehensive and proficient range of email security functionality, and show evidence of superior vision and execution for current and anticipated customer requirements.

Leaders typically have relatively high market share and/or strong revenue growth, own a good portion of their threat or content-filtering capabilities, and demonstrate positive customer feedback for anti-spam efficacy, and related service and support." The report goes on to say that "The email security market is rapidly maturing, yet continues to show strong growth and remains a 'must have' security purchase."
The Gartner Magic Quadrant is copyrighted 2008 by Gartner, Inc., and is reused with permission. The Magic Quadrant is a graphical representation of a marketplace at and for a specific time period. It depicts Gartner’s analysis of how certain vendors measure against criteria for that marketplace, as defined by Gartner. Gartner does not endorse any vendor, product or service depicted in the Magic Quadrant, and does not advise technology users to select only those vendors placed in the "Leaders" quadrant. The Magic Quadrant is intended solely as a research tool, and is not meant to be a specific guide to action. Gartner disclaims all warranties, express or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

Posted by Adam Swidler, Google Enterprise Product Marketing

Posted by Amanda Kleha, Google Apps Security & Compliance Team

In July, our Postini datacenters saw the biggest volume of email virus attacks so far in 2008, with a peak of nearly 10 million messages on July 24. One of the more prominent attacks in the month involved a spoofed UPS package-tracking link that was intended to lure recipients into clicking on it and downloading malware. Our zero-hour virus protection technology first started catching these emails on July 20.



Many of the viruses we see follow a similar format, in which an email with an embedded website link in the message is changed from what the link displays. Another recent example was a spoofed CNN newsletter sent out by spammers. In this case, the content included current news stories with numerous links in the message. The majority of the links were valid, but there were some that were replaced with malicious links. As soon as our technology started detecting these messages, we implemented a filter to stop these elusive viruses and voila! -- all of our 14 million business users were protected. This network effect and rapid protection against these new tactics is why businesses are increasingly moving their email security into the cloud.

Viruses tend to increase during the summer months, and August is already showing some new types of viruses. On August 5, we saw a large inflow of messages with an encrypted .RAR attachment. The overall 2008 trend has been a decrease in the use of attachments, so this new virus is confirmation that spam doesn't follow trends for long.