Stopping the spam: Home-grown threats to computer security still blight U.S. and UK computer users.
STORY HIGHLIGHTS
Most spam e-mail comes through the U.S. according to new reportsLondon is the number three global hotspot for sending out malwareHigh-speed Internet connections are why so much spam comes from the UK and U.S.Focus on external threats can leave users unaware of malicious software closer to home
(CNN) -- We all know about spam -- clogging up our inboxes with ads for Viagra and too-good-to-be-true offers from renegade African diplomats.
But who is actually responsible for sending it?
It might surprise many CNN.com readers to learn that the number one source of spam is not Nigeria, or China, but the United States, according to a report released on April 28.
The study by IT security and control firm Sophos lists the dirty dozen top spam-relaying nations and claims the United States is responsible for 13 percent of the global total, adding up to hundreds of millions of junk messages. India (7.3 percent), Brazil (6.8 percent), South Korea (4.8 percent) and Vietnam (3.4 percent) make up the top five.
China -- often blamed for cybercrime by other countries -- comes in at 15th place with responsibility for relaying just 1.9 percent of the world's spam.
A similar study earlier this year by computer security firm Symantec found that the majority of targeted malware -- malicious software that includes viruses, "Trojans" and "worms" -- sent in March 2010 originated in the U.S. based on mail server location, at 36.6 percent.
We shouldn't forget that if noone bought products sold via spam there would be a lot less incentive to send junk e-mail.
--Graham Cluley, technolgy consultant
It also placed London at number three in the list of cities sending out targeted malware attacks responsible for 14.8 percent. (The study named Shaoxing, China, as number one.)
Spam is not just annoying, it is a serious problem for many businesses and responsible for a staggering 97 percent of all e-mail received by business e-mail servers, according to Sophos, putting both a strain on resources and wasting a huge amount of time.
But why is so much of it coming from developed western economies?
Virtually all spam is sent from computers infected with malware (called "bots" or "zombies") that are then controlled by cybercriminals -- called "botherders" -- without the owners' knowledge.
PCs can become part of a botnet in a number of ways, usually via email or the Web. Often users click on malicious links posted within a spam message and unwittingly download malignant malware.
"The UK and the U.S. rank near the top of many of these lists because such a large percentage of users are online with high speed connections to the Internet," Chet Wisniewski, senior security advisor at Sophos, told CNN.
"Countries such as the USA would do well to remember that cleaning-up infected PCs in their own back yard will be an important step in fighting cybercrime," said Graham Cluley, senior technology consultant at Sophos, in a statement.
The only way to reduce the risk of being compromised is to run anti-spam and anti-malware protection and ensure all software and hardware is up to date with security patches.
"We have seen many high profile incidents in the last year with things like the Conficker worm and ZBot (Zeus) shutting down many government and corporate networks in the UK," said Wisniewski.
"One of the problems is that many people focus on attacks from outside, and may not be looking at what they are sending out.
"Most businesses have focused on stopping things at the edge of their networks and preventing stuff from forcing its way in," said Wisniewski.
"But in the interim the criminals are tricking users into requesting the malware from websites which bypasses things like corporate firewalls and mail gateways.
"Government, businesses, and individuals all are responsible, and one of the problems is you won't know you are infected if you aren't running up to date anti-virus, yet you might think you are clean and wont get viruses.
"I think the most important lesson for users is to be educated that malware and spam are very advanced criminal operations. You don't get infected only by viewing online pornography or gambling, it can happen anywhere.
"We have seen everything from embassies to football clubs, from Walmart to the U.S. Army, have their websites compromised with exploits and people must run proper security software on their PCs at all times.
"Organizations should be looking at not just traffic coming into their networks, but also going out."
The prevalence of infected computers has led to a new mindset among some businesses who acknowledge a proportion of their clients and customers will inevitably be infected, yet they must continue to work with them, therefore they place greater emphasis on back-office systems that aim to spot the fraud associated with malware. 
Ultimately though, we would be wise to remember the human aspect to all this -- and be prepared to check our own behavior online.
"We all shouldn't forget that if noone bought products sold via spam there would be a lot less incentive to send junk email," explained Cluley.
"Computer users should not just protect their computers from threats like malware and spam, they should also pledge to never, ever buy anything advertised via spam."
http://www.cnn.com/2010/TECH/05/03/spam.malware/index.html