Spam Beacons

Figure 1 shows the message that the user sees in Outlook when Exchange delivers the drop file that Listing 2 shows. I used a known sender in the From field to make sure recipients open the message. The embedded beacon URL (which you can see at callout D in Listing 2) creates a connection to an IIS server, activating the spdemo.asp script, which Listing 3, page 4, shows.

Spdemo.asp reads the user's email address information from parameters embedded in the URL, generates an email message, then makes an SMTP connection to an Exchange server to deliver 10 copies of this message to the user's mailbox, as Web Figure 2 shows.

The messages contain a timestamp specifying when the recipient opened the original spam demo, as well as an explanation of the demo. The timestamp helps reinforce to users that the 10 messages were generated as a direct response to their actions—perhaps helping them understand the consequences of opening real spam. . . .