What malicious things can happen when clicking on links in email?

Question

I've received a spam from one of my friends (well I'm sure he didn't send it). so there's this link, and i'd thought what exactly would be the implications of clicking the link (i've not clicked it yet)?

Answer 1

The common reasons for links in spam email are:

• verification that your email address is valid and that it is read which makes the email address more valuable for address brokers (the link needs to have some individual part, that can be a number, but it can also just be unique word from the dictionary). This kind of link may be labeld "unsubscribe".
• the link may point to a phishing site, pretending to be from well-known-company such as eBay, but just wanting to trick you into entering your username and password for that side (e. g. "your account needs to be verified"). Please note two things: In HTML emails the displayed link text and the actual link target can be distinct. There are some special characters that look like normal ones
• the link may point to a website which tries to exploit your browser or plugins to get access to your computer, or trick you to manually execute malicious code (e. g. "get this video codec", "you computer is infected, get anti virus for free").
• the spammer might want to get people to visit his or her website to advertise his products or opinions, manipulate polls, etc.

Uncommon:

• the spammer may try to flood the target with lots of visitors. This is not effective as a distributed denial of service attack because the email is a lot larger than the data send by the browser to the target server. Reflective DDoS usually use DNS where a small query with a faked sender address can result in a much larger reply to the target site. But it may be effective to exploit some pay per click advertisement programs.

More than one point may be true.

Answer 2

Just to expand on one item in @Hendrik's list, the exploitation item:

It is much easier to write an exploit which requires a user to click on something than to fully automate the attack from a position of no contact. All that link has to point at is an exploit for a vulnerability that isn't patched on the user's machine and the results could include things like a keylogger or rootkit being installed, the computer becoming part of a botnet etc.