Students paid to send spam e-mail

Spamming companies have been paying Tufts students to send unsolicited junk mail through their computers and the administration is beginning to consider taking disciplinary action against involved students.

Companies "essentially tunnel into university networks by paying students $15 to $20 to $25 a month," explained Doug Herrick, the associate director of Data Network Operations for Tufts Computing and Communication Services (TCCS). The students downloaded programs to their computers that spammers used to relay mail.

Early reports indicate that the students actively sought out the company and were not individually targeted. "Somehow these students found this sort of offer -- somewhere on the Internet," said John Fontana of the online magazine NetworkWorldFusion. "They just decided to sign on to this thing and see what... would happen."

Use of the relaying software violates the University's Information Technology Responsible Use Policy.

One student is currently in the beginning stages of the disciplinary process, and several others are suspected of participating in the scheme as well. The identities of all of the involved students are being kept confidential and a detailed account of the case will not be available until the process is over.

Dean of Judicial Affairs Veronica Carter is handling the case for the Dean of Students Office. No decisions have been made as to the direction of the disciplinary process. "It has been referred to me but it has not been finalized," Carter said.

Though only one student is currently under review, "other students have engaged in a similar arrangement" with spam companies to a lesser extent, said Lesley Tolman, TCCS's Director of Networks and Telecommunications.

Aside from the possible disciplinary consequences, giving spamming companies access to their computers entails other dangers. The most frequently used program to spread spam, Mailsafe.exe, gives the company almost total access to the student's computer. "It really puts the student in jeopardy not knowing how their computer is being used," Herrick said.

Relaying spam through university computers is "still a fairly new scam," Herrick said, and the scheme is hard to detect for a number of reasons. Since spamming companies go through electronic avenues not usually used for sending mail, the e-mails can be hard to track.

Another difficulty in detecting the spam programs is the small size of the messages they send. Spam is often "small messages that point to a URL or have a graphic," Herrick said. These e-mails are also "not heavy enough volume to be detected" by TCCS's anti-spam techniques, Herrick said.

The scheme was ultimately discovered at Tufts because the spamming company increased the volume of its messages.

Given the small size of these spam e-mails, the University's high-speed Internet connection is probably not what attracted spammers to solicit students. Instead, spam companies seek out "groups that they know need the money, like students who will spread the word to their friends," Herrick said.

The spamming scheme was fairly simple to shut down once it was detected, however. "We had complaints from people saying our domain was the source of spam," Tolman said in an article in NetworkWorldFusion. "We checked the logs, identified the IP address the spam was coming from, matched that with a [media access control] address and went to the kid's dorm room," she said.

Herrick stressed the importance of identifying the source of the schemes because they "hide [the company's] identity and puts the focus on [Tufts]." TCCS is currently working to address the issue by improving search techniques.

Even now, spam relayers are "not impossible to catch," Herrick said.

"There will come a time fairly soon where we'll be able to anticipate it," he said. "We do a pretty good job of protecting our network."