Friday, May 30, 2008

This Week In The Spam Filtering World ...

Here's what's went on this week in the blogosphere in the anti spam world:

Backscatter

Use a service or server based anti spam system. Such systems employ measures that block spam and are hardened to large quantities of spam and will provide some protection from backscatter in and of themselves, however the spam ...


How much longer will anti-spam captchas be useful?

Luis von Ahn, an inventor of the anti-spam tool known as "captchas," talks with Jon Gordon about how much longer the squiggly line challenge-response tools will be useful.


TypePad launches new anti-spam tool for bloggers

TypePad AntiSpam is the product of the antispam technology Six Apart has been using in their TypePad hosted blogs since May 2007. Now the service, which is in beta, is available to anyone, open source, and free -- regardless of how ...


MySpace wins $230 million anti-spam judgment

Just saw this over at namepros, although I don't use myspace but I like to think that spammers (not only the ones spamming myspace) will think twice before doing spamming again Excite News - MySpace wins $230 million anti-spam judgment.


Social Networking Sites Also Popular With Spammers

Popular networking sites have become one of the latest targets in recent spam attacks. Cloudmark, an anti-spam enterprise, revealed that social networking sites have seen a huge rise in spam in the 6 months to March 2008. ...


Enjoy!

- Shaun

Wednesday, May 21, 2008

Start of the Memorial Day Spam Storm Coming

With the down turn in the US economy more people are turning to the web for the best deal so expect vendors to be even more aggressive in their approach to getting eyeballs on ads and this includes sending more e-mail marketing as this is the least cost advertising venue.

The spammers have been using e-mail for years now because it works and the big marketers have joined in as a scan of some of the recent subject lines processed by CudaMail shows.

Some of these are spam and some are just marketing messages:


Alarm systems.
"5 Horrible Home-Invasion Statistics."
"Secure your home today"

Pharma
"Live Life to the fullest"
"May 21st - Ready to Process Reorder"
"Cleanse your digestive system and feel great."
"Side effects include: Increased libido, decreased cellulite, and ..."

Office Supplies
"Discount printer ink and toner plus extra 10% coupon"

Social Networking
"Someone is looking for you. Find out who."

Septic Tank Insurance
"Has your Septic Tank ever backed up on you?"

Hardware and Tools
'True Value: Weekly Merchandising Newsletter - 5.20.08"

Vacations
"World Series of Poker* Invitation in Vegas for You"

Men's Clothing
"20% Off + $4.95 Flat Rate Shipping"

Women's Clothing and Swimwear
"Memorial day event - 50 items at 50% off!"

Satellite TV
"Over 40 Digital Quality channels for $19.99/mo. Get more with DISH Network"

Wedding Decorations
"Wedding Accessories on Sale"

Business Cards
"MAY MADNESS LAST DAY!!!!!"

Big Fans
"Industrial Cooling...$99"

So a warning to everyone that from our Operations Center here at CudaMail we see the volume of e-mail marketing, both legitimate and unwanted spam, is being turned up to 11 as we get closer to the long weekend in the U.S.

- Shaun

Tuesday, May 20, 2008

Natural Disasters and Phishing Scams

Fires and floods and earthquakes, oh my...

Great reminder from US Cert on protecting yourself from the opportunists that prey on the feelings and emotions of all when a natural disaster strikes. At times when your heart strings are being pulled on it is almost as if the brain get's switched off and this provides an opening for the scammers to strike and they will.

If you want to help out in a situation like this then go through the official channels and not allow yourself to be solicited via a message delivered in an e-mail even if it comes from one of your trusted friends or family.

- Shaun

> From the US Cert (Computer Emergency Readiness Team) Natural Disasters and Phishing Scams

Original release date: May 19, 2008 at 4:30 pm
Last revised: May 19, 2008 at 4:30 pm

In the past, US-CERT has received reports of an increased number of phishing scams that take advantage of natural disasters. Due to recent natural disasters, US-CERT would like to remind users to remain cautious when receiving unsolicited email that could be a potential phishing scam.

Phishing scams may appear as requests for donations from a charitable organizations asking users to click on a link that will take them to a fraudulent website that appears to be a legitimate charity. The users are then asked to provide personal information that can further expose them to future compromises.

Users are encouraged to take the following measures to protect themselves from this type of phishing scam:
  • Do not follow unsolicited web links received in email messages.
  • Review the Federal Trade Commission's Charity Checklist.
  • Verify the legitimacy of the email by contacting the organization directly through a trusted contact number. Trusted contact information can be found on the Better Business Bureau National Charity Report Index.
For additional information regarding phishing, US-CERT recommends reading the following documents:
  • Recognizing and Avoiding Email Scams (PDF)
  • Avoiding Social Engineering and Phishing Attacks
Relevant Url(s):

http://www.us-cert.gov/cas/tips/ST04-014.html

http://www.us-cert.gov/reading_room/emailscams_0905.pdf

http://www.ftc.gov/bcp/edu/pubs/consumer/telemarketing/tel01.shtm

http://charityreports.bbb.org/public/All.aspx?bureauID=9999

====

This entry is available at:

http://www.us-cert.gov/current/index.html#natural_disasters_and_phishing_scams

Wednesday, May 7, 2008

Eight Surefire Ways to Become an Identity Theft Victim

A funny but O so true write-up from SANS (www.sans.org) on what NOT to do online.

1. Practice Unsafe Surfing. When you purchase a new computer, go online without activating the firewall, or purchasing protective software.

Further expose yourself digitally by sharing a wireless connection with the entire neighborhood. Without digital encryption, you can share the contents of your hard drive with anyone on the street. For maximum risk, do some online banking on a public computer -- like the one at the library or a public cafe. Bonus points are added if your Social Security number is your user ID for any transactions.

What you should really do:
  • Use a hardware firewall at work and at home along with good AV software that is kept up to date.
  • While the desire to go 'Wireless' is high and the products make is so easy take the time to set it up properly or call in an expert to set it up for you.
  • Never do more than just check news stories on some basic searching when on an unknown and thus un-trusted computer be it at the library or even over at your friends house.
2. Skimp on anti-virus and anti-spyware protection. Courting disaster online is easy. Invite malicious code to attack your computer simply by doing nothing. Antivirus programs can be pricey, and the maintenance of constantly downloading updates is time-consuming. Combine that with the security updates from Microsoft or Apple and it's enough to seriously annoy anyone.

What you should really do:

Install a good Anti-Virus solution, most like F-Secure, come in a full protection suite and could be included free with your internet connection (Shaw includes F-Secure for example) Turn on automatic updates in Windows and if your programs can be set to do the same do so. Once a month manually check to ensure your programs are up to date with something like the online F-Secure Health Check or the Secunia Software Inspector. It wouldn't hurt to visit both Windows Update and Office Update while your at it.

3. Passwords are a pain! Make life easy for yourself by using the same password for EVERYTHING, and make it something easy to remember, like your first name or 'password'. Just in case, make sure you write it down on a yellow sticky and put it somewhere easy to see.

And don't forget to have your browser set to 'remember password' to make life easy for you - and the cyber thief.

What you should really do:
  • Use the idea of a password phrase to remember hard to guess passwords. A favorite phrase or poem can become the backbone of a secure password policy.
  • For Example the phrase 'The quick brown fox jumped over the lazy dog' can be used to easily remember a password of 'tqbfjotld'.
  • Make your password harder to guess by throwing in Capitalization, numbers and special characters.

    • If you want to keep things simple then come up with at least three or four secure passwords.
    • The first would be used only for online banking. The second would be used for your e-mail. The third would be used anywhere you have to register to use a site. The fourth could be used for questionable sites that require you to register.

4. Peek at junk email and open attachments from unknown sources. Open attachments from strangers, secret crushes, long-lost friends saying "what's up," or strangers hawking cheap drugs -- you'll never know unless you peek at that email. One of the many fun things that can happen when you open an attachment containing malicious code is infecting your computer with a Trojan horse or virus, which can easily lead to identity theft.

What you should really do:

Use a service like CudaMail to filter out all these unwanted messages. They are either marketing messages or worse, spammers trying to add your computer to their botnet. Stay away from these messages no matter how 'interesting' the spammers make them.

5. Stuff your wallet with juicy identifying tidbits. Wallets and purses are more than just handy cash-carrying devices. They often have credit cards, identification, insurance information and even Social Security cards. Obviously, more is better if you'd like to become the prey of fraudsters.

Losing or misplacing a wallet or purse can cause more problems than just the hassle of replacing all those cards and buying a new bag. Armed with your date of birth, Social Security number and mailing address, there's no limit to the damage thieves could cause.

What you should really do:
  • Keep only what you need in your wallet or purse.
  • The rest of the information should be in a safety deposit box where you can get it if you need it but the rest of the time it is locked away.
  • Check on the personal information the credit bureaus have on you to make sure it is accurate and that someone hasn't signed up for a credit card or something else in your name but using a different address.

6. Make your checks payable to criminals. If you're like most people, you wouldn't post your checking account information on your front door, though you should if you'd like to be a victim of fraud. Similarly, checks reflecting the same information can be dropped casually into unsecured mailboxes. Statistically the chances of your mailbox being targeted by criminal elements are low, but not that low. According to the 2008 Identity Fraud Survey Report from Javelin Strategy and Research, almost 1 in 10 victims of identity theft who can pinpoint the scene of the crime say that it happened at the mailbox.

7. Opt out? Opt in! While you're mailing checks from the unlocked mailbox, go ahead and get credit card companies to send you all the pre-approved offers that the postman can cram into the box. Similarly, don't get credit card statements online; leave them on the side of the road so that they're more convenient for fraudsters who lack the technical knowledge or follow-through to launch complicated hacking schemes.

What you should really do:

Don't use the mailbox by your front door as an outbox just because it is convenient. Take your bills to the bank to pay or drop them off at a real post office. Anything you do get that has your identifying information on it like a pre-filled out credit application should go through a good cross cut paper shredder before leaving your place.

8. Nothing is too good to be true. Everyone wants to feel special and maybe more importantly, filthy rich. When reading an emailed proposition from an African business tycoon, an imperiled prince or downtrodden heiress offering millions of dollars in exchange for some small measure of assistance, it's difficult not to wish it were true. Falling for the story will undoubtedly lead to unpleasantness.

What you should really do:

Don't let your greed get the better of you. While the 'I have umpteen million dollars that I'm trying to sneak out of the country' e-mail's are getting old hat people are still falling for them. What is more insidious is the 'work at home as an agent' e-mail's that make it sound so easy. All you have to do is deposit a check or two each week into your personal bank account and wire transfer the funds to 'the company'. You either end up out the entire amount when the check is returned NSF or you are working for organized crime and are a money launderer.

The internet is a wonder and scary place at the same time. Be educated and play safe.

- Shaun