Mark Hofman Reports a Surge in His Spam - Are You So Lucky?A

Mark - as the handler on duty at the Internet Storm Center - was nice enough to not only read all his spam for the week (about 2500 messages) but he also put together a nice chart showing what type of spam he was getting and from where:

Description	Email Origin
Greeting card	Germany		URL Link to exe.  28/33 AV products detected the file, three days ago it was 4.
Viagra/Cailis Mesages	Texas Latvia Paris Russia Chilli	Mount Laurel (US) US Italy Israel	Links to Canadian Pharmacy web site.
Viagra/Cailis Meds	France		Web Site Canadian Healthcare
Movie downloads (in Chinese)	Argentina		Nothing no links and nothing nasty, maybe a trial run.
Herbal remedies	USA Germany Sweden	Oman Lithuania Brazil	Products to enlarge body parts. The message contained a URL to one of three sites hosted in the same address range. The registrar owns 695 other domains, received 50 of them.
Lottery*	UK Canada Greece		So far this week I have won  about $500,000,000, not bad for not entering any lotteries.   The majority were sent from UK machines, machines at one particular facility.
Click Fraud	Spain Bolivia Poland		The links in the message are ad click redirects.
Paypal	US France		The usual phishing exercise aimed at extracting account information.
I am Lonely Tonight	Turkey		The usual I’m lonely tonight emails.  If you respond it goes into how she wants to travel and can’t you help her out.
Fake Goods	Bombay Russia Bahrain Greece Italy	Turkey Slovak Republic Thailand	Fake goods, watches, bags, etc.
Business Proposal (419 messages)	US Germany Los Angeles United Arab	Emirates The Netherlands Japan	Transfer money and get a percentage.
Work offers	Belgium		Work for a few hours per week and make thousands,  most of these linked to professional looking sites.   Typically they are recruiting for mules.
Threats	Turkey	Russia	There have been a few variants of these doing the rounds.

> Source: http://isc.sans.org/diary.html?storyid=4343

This is a lot of work that Mark has gone through but it does highlight the value of good metrics or ways of gauging how effective an anti-spam system is.

Here at the CudaMail support desk we occasionally get a client who at first is very upset that they got 5 spam messages in their inbox this morning and can't we do something about it? They are usually very thankful when we provide them with a report similar to the one below for their domain showing that tens of thousands of messages have already been blocked for them and these 5 messages are the start of a new campaign that they were lucky enough to get the first few messages from and now that they have provided us with some samples to work with we can stop this campaign in it's tracks too.

Sample CudaMail Spam Quarantine Summary

> Click CudaMail_Summary_for_Domain.pdf (12.76 KB) for to download the PDF sample

This also highlights the different perceptions we have as anti-spam specialists and the typical end-user or client. From our perspective we are fighting the good fight and our efforts are winning the war on spam. We block millions of messages a day and allow only a few 10's of thousands to be delivered to the client. Typical statistics are that on average 97 out of every 100 messages are spam and this is with a very low false positive rate (false positive = marking a wanted message as spam).

What is The Customer's Perspective On The Same Volume of Messages?

They are going about their important work without being bothered by those 97 out of 100 messages that are spam so when a few messages slip through to them all of a sudden they are being "flooded" with spam. Same numbers but a very different perspective on the issue.

What Can You - the CudaMail End-User - Do to Help Out?

1. Keep us in the loop. "One person's spam is another person's ham" as the saying goes so we don't know what you did or did not sign up for online. We maintain a number of spam traps and are always looking for new spam messages but may not be first in line when a spammer fires up his money making spam bot and sends out the latest surge. So if you are the lucky one to be fist on the spammers list and get a spam sample there are two very good ways to provide this feedback to CudaMail support.

2. Install and use the Outlook plug-in. For those of you who use Microsoft Office with the full Outlook e-mail client the Plug-in is the easiest way to send spam samples back to CudaMail support and we have blogged about this before. There are plug-ins available now for other e-mail clients (Thunderbird 2.x and Lotus Notes 6.5, 7 and 8) but these are under going beta testing right now.

You can read me Blog post about it by going here:


3. Debug-ID. For those who don't run Outlook or don't want to run a beta plug-in you can simply forward just the Debug-ID of the unwanted messages to the support@CudaMail.com address.

A quick 'How to display full headers in client x' can be found at the following URL:

• http://oit.nd.edu/email/fullheaders.shtml

While support only needs the one line with the X-ASG-Debug-ID: number on it go ahead and forward all the information in the full headers on to us. What you do not want to do is forward the spam message body along with the full headers. What happens more often than not is that the CudaMail system will take your spam sample re-processes it and block it before it gets to support. We don't know that you were trying to send us this sample and can't do any thing about it because we didn't get it in the first place. Now typically we don't respond to every message providing a spam sample but we do review each and every one of them and make sure that he system will block them in the future.

With the above two thoughts in mind - perspective and feedback - what do you - the CudaMail client - want to see from the CudaMail system? Do you want to be sent reports on a regular basis (Daily, Weekly or Monthly) or will this just add to your information overload?

We look forward to hearing from your either in the comments below or direct to support@CudaMail.com.

- Shaun

Spammers Take Advantage of the Tax Season

Spammers are continuing to use the oldest trick in the book - social engineering - to try to get you to be part of their plan. The US CERT (Computer Emergency Readiness Team) has released a number of advisories over the last few weeks on recent Spammer tricks of impersonating someone trusted like the tax department or a trusted news source to get you to click on a one of their web links.

Here are some recent samples:

IRS Rebate Phishing Scam

• www.us-cert.gov/current/archive/2008/04/25/archive.html#irs_rebate_phishing_scam
• www.us-cert.gov/current/archive/2008/03/31/archive.html#internal_revenue_service_tax_scams
  

Federal Subpoena Spear-Phishing Attack

• www.us-cert.gov/current/archive/2008/04/25/archive.html#federal_subpoena_email_scam

Radiation Leak - from a trusted news source

• www.us-cert.gov/current/archive/2008/04/11/archive.html#email_attack_circulating

The text included with the links the Spammers send may make your pulse race (I can get my Tax rebate now!) and thus they try to get the emotional part of you to take control of your mouse before the logical part of your brain (This sounds fishy - better be safe and delete this message or call them direct to confirm) kicks in.

Guess what? - By clicking on the link you played right into the Spammer's plan and you either filled in a form (Phishing) and gave them information they can use to steal your identity or money or your computer got infected and is now playing it's part in sending out Spam.

How do you keep yourself safe while on the Internet?

Install and use a good anti-virus / anti-malware product and keep it up to date.

Take the time - once in a month at least - to do a full update for security patches and then do a full anti-virus / anti-malware scan of your computer.

Use some reputable online scans to double check on your Anti-Virus.

F-Secure Health Check Online scanner

• www.f-secure.com/healthcheck/

Panda Active Scan

• www.pandasecurity.com/canada-eng/homeusers/solutions/activescan/default.htm?track=80383

Kaspersky

• http://usa.kaspersky.com/products_services/free-virus-scanner.php

Secunia's Online Scanner (checks to confirm your software is up-to-date)

• http://secunia.com/software_inspector/

(Warning - These companies use these online services to try and sell you on their products - you may have to provide an e-mail address to start one or more of these services so you may get marketing related messages after using these services)

At work you will want to use a higher-end firewall (such as a firewall from Fortinet or Secure Computing) or a dedicated web filter appliance (from Barracuda Networks) with a second layer of anti-virus / anti-malware / web content filtering between your computers and the Internet.

Spammers are the problem but we have to do our best to be part of the solution!

- Shaun

Are Anti-SPAM Solutions Failing or Are There Simply More Barbarians at the Gate?

New figures suggest that 92.3 percent of all email sent globally during the first three months of 2008 was Spam¹ and a second report indicates that the top botnets, if they worked together, are capable of sending over 100 billion Spam emails per day².

The data from Sophos also indicated that 23,300 new Spam-related web pages were created every day during the period, or one about every three seconds.

Each and every one of these 2.1 Million URL's has to be discovered and added to the 'Intent' or URL database to be able to block them all, and you wonder why a few slip through the cracks?

Building a botnet first and then building 2.1 million web pages is a lot of effort to go through to send Spam touting the 'generic blue pill' or the latest 'real genuine copy' of the latest trendy fashion item be it a 'Designer Shoes Collection from Gucci Ugg Prada Chanel Dsquared' or other.

So Why Do Spammers Go To So Much Effort?

A recent National Geographic special called Illicit: The Dark Trade revealed the impact that all of these "knock-off" drugs, clothing, and accessories is having on the world (definitely worth watching). I didn't realize that the trade in counterfeit goods is a 600 Billion Dollar (USD) a year - yes that's a B, Billion - industry³ and a lot of it is done by international crime rings.

If they get caught for a counterfeit purse or shoe the sentence they get is a lot lighter than if they were trying to sell illegal drugs but it is the same people that do both and for the same reasons - to take advantage of you and your desire for a deal. The special also showed that counterfeit goods are more than just the 'real fake watches' as everything from toothpaste, mouthwash, generic drugs, automotive and airplane parts are being counterfeited as well. You think that 'blue pill' you bought online for such a deal was the real thing? Think again - it probably contained Borax bleach, chalk and paint - if you're lucky!

It has often been said that if people just stopped buying from the Spammers then there would be no financial incentive for them to send their Spam emails.

Let's try this statement on for size - if you purchase something promoted by a Spam message that sounds too good to be true - it is likely a counterfeit item and you are directly contributing to organized crime and terrorism.

Now go out there and play safe.

- Shaun

¹ www.itnews.com.au/News/74071,new-spam-site-found-every-three-seconds.aspx

² www.secureworks.com/research/threats/topbotnets/?threat=topbotnets

³ www.iacc.org/counterfeiting/counterfeiting.php

The Register - "Security Gumshoes Locate Source of Mystery Web Compromise"

According to John Leyden (from "The Register") in his article "Security gumshoes locate source of mystery web compromise", the source of the mystery injection of more than 10,000 websites back in January has been uncovered!

He says:

"Thousands of legitimate websites were compromised at the start of the year to serve up malware, as we reported at the time.

It seemed that the exploitation of SQL Injection vulnerabilities was involved in the automated attacks. The precise mechanism was unclear until earlier this week when security researchers discovered a malicious executable later linked to the attack on a hacker site.

The hacker utility used search engines to find insecure websites that it then tried to exploit using an SQL injection attack. The exploit included an SQL statement that tried to inject a script tag into every HTML page on the website.

The tool - which had an interface written in Chinese - was programmed by default to insert a tag to the same malicious JavaScript file that featured in the January attack, solid evidence that it was at least partially behind the assault.

The tool runs a script called pay.asp, hosted on a server in China. This suggests that hackers running the attack were keeping count of the number of sites they had compromised, in order to work out how much they stand to get paid.

Further analysis of the tool by security researchers at the SANS Institute's Internet Storm Centre (ISC) is ongoing. The tool came to their attention via a tip-off from Dr Neal Krawetz. The initial attack was uncovered by security researcher Mary Landesman, of ScanSafe, who
described it as the time as a new type of compromise.

The constant, changing flux of the malicious JavaScript served up by compromised sites made initial analysis difficult. With the benefit of the hacker tool used to pull off the attack this all becomes much clearer, much like it was easier for scientists to unravel a cure for

the mystery pandemic that blighted mankind in the Twelve Monkies after they obtained a sample of the pure source.

"The nice thing about this is that we finally managed to confirm that it is SQL Injection that was used in those attacks. The tool has more functionality that we still have to analyze but this is the main purpose," writes ISC handler Bojan Zdrnja.

Website owners ought to use the discovery as a wake up call on the need to ensure that their web applications are secure, he added."

If you're worried about SQL injection and other attacks on your website then you should take a look at Barracuda Network's newest solution called the Website Firewall. For more information or to arrange for an eval unit please visit: www.BarracudaNetworks.ca/Searchresult.aspx?CategoryID=74.

My Predictions on McAfee's Global 'Spammed Persistently All Month' or S.P.A.M. Experiment

Don't get enough spam already and think you should get more? Then you will probably feel jealous of the 50 participants of McAfee's global Spammed Persistently All Month (S.P.A.M.) of April. These 50 regular Joe's ranging from 17 year old high school students (Hello Zach) to a mother of three (Zach's Mom Tracy) and a university student (Katya) among others in all areas of the globe are the guinea pigs in this experiment to run throughout April 2008.

Basically these participants have been given a dedicated laptop, a pre-paid credit card and a mission. Their mission is to do everything wrong and see what the results are. They are going to respond to Spam messages - buy the 'Genuine Replica Watches' on-line and sign up for everything they can and see what happens. William reported on Day 2 that without any protective software running he received 160 Spam messages and is getting pop-ups and browser hijacks 'on a regular basis'. The Blogs are a very interesting read.

Here Are My Predictions:

1. The laptops that these people are using will become a "willing soldier" in one of the Spam Bot armies lurking out there and may end up sending themselves (and us) more Spam. How is that for irony?

- Collectively the top botnets are capable of sending over 100 billion Spam messages per day*

2. Malware - The laptops will have to be wiped and re-installed for everyone at least once during the month. They are going to do this anyway for the participants at the end of the experiment before they get to keep them so this will be good practice. I'm not sure I would trust these laptops even after they are wiped though with the rootkits that are now being incorporated into the Bot software. Reports are coming in already that the laptops are slowing down and becoming unresponsive.

3. Massive consuption of time - the management of this Spam will take more and more time until these participants will not be able to do anything but read and reply to e-mail all day long.

4. Cyber Crime - all the participants have been given 'new identities' just like someone in the witness protection program to use online. I predict that some of these identities will be sold on the black market and thus stolen.

McAfee is of course going to use this experiment to advertise that there is a lot of Spam out there and that you need protection but I could have told you that - just look at the CudaMail statistics page. ;)

- Shaun

* Source: www.secureworks.com/research/threats/topbotnets/?threat=topbotnets

For More Information:

www.mcafeespamexperiment.com
www.echannelline.com/canada/printer.cfm?item=DLY040708-2

You Have Invested In A Spam Filter But Continue Getting Spam - What Is Wrong With This Picture?

Let's talk about what you can to do help make your e-mail both more reliable and keep Spam out of your client's mailboxes.

First, most people have this idea that e-mail is both near instant and 100% reliable - unfortunately, both of these ideas are 100% wrong!

The SMTP protocol was designed when Internet links were both unreliable and slow, therefore the protocol was built to be resilient and to retry failed messages. However, the link speeds have now increased and have become more reliable, therefore people have gotten used to their e-mail arriving really quickly and so they have come to the unreasonable expectation that e-mail is near instant and 100% reliable.

Let's look at a couple of scenarios that will show that this is not the case as well as address some ways to increase your control over your e-mail server's level of reliability.

Case 1 - Single Mail Exchanger

A lot of e-mail domains right now have only 1 Mail eXchanger (or MX record) typically pointing to a single mail server at the head office.

So what happens if your internet connection goes down or there is some "hiccup" with the mail server or your firewall (you do have a hardware firewall don't you?). Anyone who tries to e-mail you will not be able to and the sender may get an undeliverable messages (or not) from their mail server after some period of time.

The Sending mail server should be configured to retry this message to you a number of times at some interval both of which are set solely by the administrator of the sending mail server. In other words, you have no control over how often they will try again or for how long and it will be different for each and every mail server that is trying to send to you. Talk about a troubleshooting nightmare!

Case 2 - Backup Mail Exchanger

When you publish an MX record via DNS one of the properties of the record is a preference. Here is an example (fictitious) domain and the tools you would use to see what your MX record points to:

nslookup -type=mx somedomain.com
Non-authoritative answer:
somedomain.com MX preference = 10, mail exchanger =
mail.somedomain.com
somedomain.com MX preference = 99, mail exchanger =
smtp.SomedomainISP.com

What the above record is saying is that when sending e-mail to 'yourbuddy@somedomain.com' to first try sending it to the mail server named 'mail.somedomain.com' and if that fails to try and send the e-mail through the mail server named 'smtp.SomedomainISP.com'. Your ISP may even include this service for free if you ask them, however these 'store and forward' backup mail servers typically just accept and forward messages WITHOUT anti-spam processing and since they are from a trusted source (your ISP) most mail servers are configured to accept without further processing.

Guess what? The Spammers are aware of this little fact and will, in violation of the standard, try to send e-mail to your domain through your backup or secondary MX record. This is how a lot of Spam sneaks in today - it takes the back door and doesn't get challenged by the security guard at the front door - your primary anti-spam solution.

So what is the solution to this problem?

Case 3 - Spam filtered MX Backup service.

Make sure your backup or secondary MX record points to a system or systems that are as hard on Spam as the protection on or in front of your mail server. This is the reasoning behind our CudaMail MX Backup Service.

We (Optrics Engineering) have been Barracuda Diamond Partners for a number of years and have seen the above problems (Case 1 and Case 2) a number of times with the clients we deal with and are offering not just an MX backup service but a Spam Filtered MX Backup Service. We have a redundant cluster of Barracuda Spam Firewalls that we use to provide primary anti-spam protection for smaller organizations but can use these same servers to accept, scan for Spam and deliver to your mail server in the event that your anti-spam solution goes off-line or your Internet connection or firewall has an issue.

This cluster is configured to retry delivery to your mail server every 15 minutes for up to 48 hours. Those pesky Spammers who try to sneak in through the back door are going to be very surprised when they run into the CudaMail service on your secondary MX records and you now know how often and how long you have before people get an 'undeliverable' response back.

While e-mail is not 100% guaranteed the above service puts you in control and slams the door in the face of the Spammers.

Now go have a nice (Spam-free) day!

- Shaun

Happy April Fool's Day - Don't Be An E-mail Fool!

April Fool's Day is upon us - don't be an e-mail fool - as the Spammers will be trying to take advantage of our love of a good laugh.
 
As always be very careful when you get an e-mail that you don't expect. Just last week my own wife sent me a video via e-mail and the first thing I did was call her and ask if she had sent it to me. It turns out she had but it could easily be an e-mail containing Spam/malware like the latest storm being reported on by the Internet Storm Center.

Storming into April on Fools Day

http://isc.sans.org/diary.html?storyid=4222

Here are some subject lines to watch out for (there may be more variations):

• All Fools' Day
• Doh! All's Fool
• Doh! April's Fool.
• Gotcha!
• Gotcha! All Fool!
• Gotcha! April Fool!
• Happy All Fool's Day.
• Happy All Fools Day!
• Happy All Fools!
• Happy April Fool's Day.
• Happy April Fools Day!
• Happy Fools Day!
• I am a Fool for your Love
• Join the Laugh-A-Lot!
• Just You
• One who is sportively imposed upon by others on the first day of April Surprise!
• Surprise! The joke's on you.
• Today You Can Officially Act Foolish
• Today's Joke!

The e-mails either contain or have links to a nasty malware payload.

The download is a binary, also with varying names:

foolsday.exe
funny.exe
kickme.exe

In your e-mail it will look something like this:

April Fool's Day http://276.233.234.297 <= This is an invalid link intended to be harmless

CudaMail blocks .EXE attachments by default so anyone using our CudaMail managed anti-spam service is not going to be getting any of the malware payloads but some of the links may slip through.

We are blocking new variants as quickly as they are discovered but the best defense is to be educated to not click on unsolicited links.

Consider yourself educated. :)

- Shaun