GPEN practice question 15 of 35

Peter, a malicious hacker, obtains e-mail addresses by harvesting them from postings, blogs, DNS listings, and Web pages. He then sends large number of unsolicited commercial e-mail (UCE) messages on these addresses. Which of the following e-mail crimes is Peter committing?

Full set: 385 questions
Answer options
A: E-mail spoofing
B: E-mail Spam Correct answer
C: E-mail bombing
D: E-mail Storm
Correct Answer:
B. E-mail Spam
Explanation

The scenario describes the act of sending a large volume of Unsolicited Commercial E-mail (UCE) to a list of harvested email addresses. This is the precise definition of e-mail spam. The key elements that identify the activity as spam are the unsolicited nature of the messages, their commercial content, and the bulk distribution method to a wide audience. The initial step of harvesting email addresses from public sources is a common precursor to a spam campaign.

Why Incorrect

A. E-mail spoofing: This involves forging the sender's address to make the message appear to come from someone else, a detail not mentioned in the scenario.
C. E-mail bombing: This is a denial-of-service attack that targets a single address or server with a massive volume of mail to overwhelm it.
D. E-mail Storm: This is an accidental, sudden surge of "reply all" messages on a large distribution list, which is not a deliberate malicious act.

References

1. Microsoft Corporation. (2023). Anti-spam protection in Exchange Online Protection (EOP). Microsoft Learn. In the "Spam filtering" section, spam is defined as unsolicited and unwanted email, which directly aligns with the UCE described in the question. Retrieved from https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spam-protection-eop-about.

2. Indiana University, University Information Technology Services (UITS). (2023). What are email spam, phishing, and spoofing? Knowledge Base. The document defines spam as "unsolicited, unwanted email, sent in bulk to a large number of recipients." This perfectly matches the actions of the hacker, Peter. Retrieved from https://kb.iu.edu/d/arsf.

3. Massachusetts Institute of Technology (MIT). (n.d.). Spam (unsolicited email). Information Systems and Technology. MIT defines spam as "unsolicited, bulk email," noting that it is often commercial in nature. This supports the identification of Peter's actions as spam. Retrieved from https://kb.mit.edu/confluence/display/istcontrib/Spam+(unsolicited+email).

4. Guzella, T. S., & Caminhas, W. M. (2009). A review of machine learning approaches to Spam filtering. Expert Systems with Applications, 36(7), 10206-10222. In Section 1, "Introduction," the paper defines spam as "the electronic version of junk mail. It involves sending unsolicited messages, which can be of a commercial or non-commercial nature, to a large number of recipients." (p. 10206). https://doi.org/10.1016/j.eswa.2009.02.037

Scroll to Top