Were it not for the greed of many email technology companies and Internet Service Providers (ISPs) who are looking for ways to capitalise on the root cause of these two transgressions (spam), a majority of the undesirable results from Sobig and MyDoom (ranging from inbox nuisance to monetary damage) could have been avoided.
Who's on my "most greedy" list? First, the ISPs through whose systems most of the Internet's email traverses. This group includes Yahoo, MSN, Earthlink and AOL, among others. Second on my list are the companies that make the email client and server technologies that send and receive email. This group includes IBM, Microsoft, Novell, and Qualcomm (makers of Eudora), to name a few.
Unfortunately, the revenue potential associated with stopping spam appears to be more seductive than the social responsibility that goes with being influential Netizens. While direct blame for the problem lies with the perpetrators, the aforementioned technology companies are now equally culpable for failing to do the right thing.
Ultimately, however, as Internet users we must share some of the blame because we haven't held those companies accountable by hitting them where it hurts most -- in their pocketbooks.
Anatomy of the modern-day attack
Now, let's look at how the MyDoom virus attack implicates email as the weak link. Perhaps the most headline-grabbing aspect of MyDoom was the way in which experts were able to predict what was going to happen next, but could do almost nothing about it. It was as if the virus were Hurricane Andrew bearing down on South Florida. We saw it coming, we knew how bad it was and where it was going to land. But, there was little that could be done to keep Andrew from wreaking havoc.
One reason MyDoom was worse than Sobig is that it took the basic email-borne virus principle of Sobig and added a DDoS component to it. In my analysis of Sobig (where I similarly held our technology companies accountable for failing to prevent it), I fell short of describing the next evolutionary step for such attacks, but dropped a pretty good hint when I said, "It's bad enough that Sobig, in DDoS fashion, is deputising thousands of systems across the Internet to send Net-artery clogging traffic."
