Google Strengthens Anti-Spam Features

Google is continuing to fight hard to keep the email inboxes of its users free from the annoying, fraudulent and scam-peddling spam that hackers churn out. To do that, Google says it constantly changes its methods to keep up with and stay ahead of the spammers.

Now the company wants to let its users know just what it’s doing to protect them from spam and what they can do to protect themselves.

Hijacked accounts

“Although spam filters have become very powerful – in Gmail, less than 1 percent of spam emails make it into an inbox – these unwanted messages are much more likely to make it through if they come from someone you’ve been in contact with before,” wrote Mike Hearn, a Google security engineer, in a 19 February post about the topic on the Google Official Blog. “As a result, in 2010 spammers started changing their tactics – and we saw a large increase in fraudulent mail sent from Google accounts,” he said. “In turn, our security team has developed new ways to keep you safe and dramatically reduced the amount of these messages.”

A lot has changed in the spam wars over the past few years, wrote Hearn. Nowadays, instead of receiving cold call spam messages from senders (which are routinely stopped by spam filters developed over the years), the spammers have turned to hijacking old email accounts of people who users might have communicated with in the past.

To hijack the accounts, they steal or illegally buy stolen user names and passwords and then use the accounts to send out their messages. And because recipients might recognise the names of the alleged senders, they might open the messages and their attached payloads, which can be harmful.

“Have you ever gotten a plea to wire money to a friend stranded at an international airport?” wrote Hearn. “An oddly written message from someone you haven’t heard from in ages? Compared to five years ago, more scams, illegal, fraudulent or spammy messages today come from someone you know.”

To counter those kinds of spam attacks, Google has had to adjust its strategy.

“Every time you sign in to Google, whether via your web browser once a month or an email program that checks for new mail every five minutes, our system performs a complex risk analysis to determine how likely it is that the sign-in really comes from you,” wrote Hearn. “In fact, there are more than 120 variables that can factor into how a decision is made.”

New tools

That’s where Google’s specialised anti-spam tools can come into play.

“If a sign-in is deemed suspicious or risky for some reason – maybe it’s coming from a country oceans away from your last sign-in – we ask some simple questions about your account,” wrote Hearn.

Google may ask for the phone number associated with an account or the answer to the user’s security question, Hearn noted.

“These questions are normally hard for a hijacker to solve, but are easy for the real owner,” he wrote. “Using security measures like these, we’ve dramatically reduced the number of compromised accounts by 99.7 percent since the peak of these hijacking attempts in 2011.”

Users, meanwhile can do their share by maintaining and using strong, unique passwords for their Google accounts, he wrote.

Two-step authentication

Users can also upgrade their accounts to use two-step verification and can set recovery options for their accounts in case they are taken over and hijacked, wrote Hearn.

“Following these three steps can help prevent your account from being hijacked – this means less spam for your friends and contacts, and improved security and privacy for you,” he wrote.

In March 2012, Google implemented another account security feature that lets users receive a monthly “account activity” report containing password-protected insights into their use of Google services.

With the reports, users can track their Google account usage and be sure that their accounts are not being used by spammers and hackers.

Are you a security pro? Try our quiz!

Originally published on eWeek.