The internet is a wonderful place - just perfect for picking up a PDF infection.

PDF Flaw Exposes All to Botnet Attempts

Adobe revealed that a flaw exists even in fully up-to-date versions of Adobe Reader 8.1.2 that 'could potentially allow an attacker to take control of the affected system' This is similar to other bugs that have been utilized recently by the "Bot Herders" to take over Millions of PC's to add to their herds to later be used to send spam to you and your friends.

---

Adobe's bulletin and service patch:

http://www.adobe.com/support/security/bulletins/apsb08-15.html

SANS Internet Storm Center (ISC) recommends that you update sooner rather than later.

http://isc.sans.org/diary.html?storyid=4616

---

While the SANS article mentions that the vulnerability will soon appear on a malware spreading website we at CudaMail expect the "Bot Herders" to start sending millions of messages with links to these malware sites and to use 'social engineering' to get you to interested enough to click on this unsolicited link.

So what can you do to protect yourself?

Update all your programs on a regular basis. Make sure you have a tested backup of all your important information for when - not if - you get infected and have to format and re-install your operating system (the only way to be 100% sure that you don't have a nasty infection) and don't click on links you are unsure about the origins of.

What else can we do as an anti-spam service to protect you?

While we do watch for outbreaks like this closely and will be blocking any messages that have links to known infected sites we always have to be careful to not step over the line and start blocking legitimate links. We could easily write a rule that blocks any PDF file or even any link to any PDF file but this format is used by billions of people to send all sorts of legitimate information every day and so we can't do that except in the case of a major outbreak and then for only a very short while.

So here is a question to you, our dear readers:

Would you prefer to have 100% protection from a new malware outbreak like we expect even if some legitimate messages may be blocked or would you like all your legitimate e-mail's to come through even if a few malware links also come through?

At CudaMail we have a third option - the per-user quarantine - where we can send every messages with a PDF attachment or a link to a PDF into your personal quarantine area. This would require that you take the effort to check this quarantine area and deliberately release the wanted PDF's. Is that a viable option for you?

We want to hear from you!

- Shaun

This Week In The Spam Filtering World ...

Here's what's went on this week in the blogosphere in the anti spam world:

Backscatter

Use a service or server based anti spam system. Such systems employ measures that block spam and are hardened to large quantities of spam and will provide some protection from backscatter in and of themselves, however the spam ...

How much longer will anti-spam captchas be useful?

Luis von Ahn, an inventor of the anti-spam tool known as "captchas," talks with Jon Gordon about how much longer the squiggly line challenge-response tools will be useful.

TypePad launches new anti-spam tool for bloggers

TypePad AntiSpam is the product of the antispam technology Six Apart has been using in their TypePad hosted blogs since May 2007. Now the service, which is in beta, is available to anyone, open source, and free -- regardless of how ...

MySpace wins $230 million anti-spam judgment

Just saw this over at namepros, although I don't use myspace but I like to think that spammers (not only the ones spamming myspace) will think twice before doing spamming again Excite News - MySpace wins $230 million anti-spam judgment.

Social Networking Sites Also Popular With Spammers

Popular networking sites have become one of the latest targets in recent spam attacks. Cloudmark, an anti-spam enterprise, revealed that social networking sites have seen a huge rise in spam in the 6 months to March 2008. ...

Enjoy!

- Shaun

Are Anti-SPAM Solutions Failing or Are There Simply More Barbarians at the Gate?

New figures suggest that 92.3 percent of all email sent globally during the first three months of 2008 was Spam¹ and a second report indicates that the top botnets, if they worked together, are capable of sending over 100 billion Spam emails per day².

The data from Sophos also indicated that 23,300 new Spam-related web pages were created every day during the period, or one about every three seconds.

Each and every one of these 2.1 Million URL's has to be discovered and added to the 'Intent' or URL database to be able to block them all, and you wonder why a few slip through the cracks?

Building a botnet first and then building 2.1 million web pages is a lot of effort to go through to send Spam touting the 'generic blue pill' or the latest 'real genuine copy' of the latest trendy fashion item be it a 'Designer Shoes Collection from Gucci Ugg Prada Chanel Dsquared' or other.

So Why Do Spammers Go To So Much Effort?

A recent National Geographic special called Illicit: The Dark Trade revealed the impact that all of these "knock-off" drugs, clothing, and accessories is having on the world (definitely worth watching). I didn't realize that the trade in counterfeit goods is a 600 Billion Dollar (USD) a year - yes that's a B, Billion - industry³ and a lot of it is done by international crime rings.

If they get caught for a counterfeit purse or shoe the sentence they get is a lot lighter than if they were trying to sell illegal drugs but it is the same people that do both and for the same reasons - to take advantage of you and your desire for a deal. The special also showed that counterfeit goods are more than just the 'real fake watches' as everything from toothpaste, mouthwash, generic drugs, automotive and airplane parts are being counterfeited as well. You think that 'blue pill' you bought online for such a deal was the real thing? Think again - it probably contained Borax bleach, chalk and paint - if you're lucky!

It has often been said that if people just stopped buying from the Spammers then there would be no financial incentive for them to send their Spam emails.

Let's try this statement on for size - if you purchase something promoted by a Spam message that sounds too good to be true - it is likely a counterfeit item and you are directly contributing to organized crime and terrorism.

Now go out there and play safe.

- Shaun

¹ www.itnews.com.au/News/74071,new-spam-site-found-every-three-seconds.aspx

² www.secureworks.com/research/threats/topbotnets/?threat=topbotnets

³ www.iacc.org/counterfeiting/counterfeiting.php

Happy April Fool's Day - Don't Be An E-mail Fool!

April Fool's Day is upon us - don't be an e-mail fool - as the Spammers will be trying to take advantage of our love of a good laugh.
 
As always be very careful when you get an e-mail that you don't expect. Just last week my own wife sent me a video via e-mail and the first thing I did was call her and ask if she had sent it to me. It turns out she had but it could easily be an e-mail containing Spam/malware like the latest storm being reported on by the Internet Storm Center.

Storming into April on Fools Day

http://isc.sans.org/diary.html?storyid=4222

Here are some subject lines to watch out for (there may be more variations):

• All Fools' Day
• Doh! All's Fool
• Doh! April's Fool.
• Gotcha!
• Gotcha! All Fool!
• Gotcha! April Fool!
• Happy All Fool's Day.
• Happy All Fools Day!
• Happy All Fools!
• Happy April Fool's Day.
• Happy April Fools Day!
• Happy Fools Day!
• I am a Fool for your Love
• Join the Laugh-A-Lot!
• Just You
• One who is sportively imposed upon by others on the first day of April Surprise!
• Surprise! The joke's on you.
• Today You Can Officially Act Foolish
• Today's Joke!

The e-mails either contain or have links to a nasty malware payload.

The download is a binary, also with varying names:

foolsday.exe
funny.exe
kickme.exe

In your e-mail it will look something like this:

April Fool's Day http://276.233.234.297 <= This is an invalid link intended to be harmless

CudaMail blocks .EXE attachments by default so anyone using our CudaMail managed anti-spam service is not going to be getting any of the malware payloads but some of the links may slip through.

We are blocking new variants as quickly as they are discovered but the best defense is to be educated to not click on unsolicited links.

Consider yourself educated. :)

- Shaun

Will Robert Soloway's Guilty Plea Mean Less Spam?

Notorious 'spam king' Robert Soloway has pleaded guilty to additional charges (fraud and tax evasion) related to his previous conviction for sending out huge volumes of Spam.
 
US Department of Justice indictment against Soloway:

> www.usdoj.gov/usao/waw/press/2007/may/soloway.html

Seattle times article on Soloway's guilty plea on the new charges:

> http://seattletimes.nwsource.com/html/localnews/2004283998_spamking15m.html 

The question to the reader therefore is 'Do you think that this sentence will result in less spam to your inbox?'
 
Sadly the answer is probably 'no' as the trend in Spam is still increasing and human nature, on both sides of the equation, being what it is won't change.
 
There are a number of sites you can go to if you want to look at Spam trends and one such site is Barracuda Central:

www.barracudacentral.com/index.cgi?p=spam
 
You can go there if you want to look at the pretty graphs but the number that jumps out at me is that worldwide the number of messages processed by all Barracuda Anti-Spam Firewalls yesterday was over 2 Billion. 2,277,470,908 to be exact and of that number the vast majority or 2,170,841,992 (95.32%) were blocked as Spam. This is in contrast to the same statistics a year ago where the number of messages processed per day was around 1 Billion per day and the Spam percentage was around 92%.
 
Sadly, the Spam mix is still about 50% off-brand pharmaceuticals and about 25% knockoff products which tells you what is profitable to the Spammers. If people stopped responding to these advertisements and voted with their cash then the Spammers would not be profitable and would have to look elsewhere for their next easy meal.

Will human nature change overnight?
 
Probably not. Consumers want a good deal and are not likely to change and the Spammers have found a financial niche that they fit into so expect the volume of Spam to continue and even increase as the effectiveness of anti-spam solutions like the Barracuda appliances, which CudaMail is powered by, makes the Spammers job that much harder. They will ramp up their efforts to sneak Spam past such solutions rather than change their nature.
 
- Shaun

The Wild Wild West of a Civilized World

A recent report that Spammers are taking advantage of the interest in the US Elections to try and peddle Viagra along with the other things that Spammers are taking advantage of - like Valentines day - make me think that things are getting worse instead of better and also makes me wonder if we are going to have to go to some form of 'walled city' for our e-mail.

The SMTP standard was designed to be open and people at that time (about 30 years ago now) wanted such an open system that there are now gaping holes that Spammers are using to send a deluge of Spam to our users.
 
What the Spammers are doing at the moment must be effective because I review the daily logs from our systems and this is really brought to light when on a Sunday, not a typical business day, our systems processs in excess of 1.5 million messages. Out of that number less than 13,000 or LESS than 1% (0.866%) were allowed through to the mail servers. Now we don't claim that we can block 100% of Spam so there is a very small percentage that get's through so let's say that 1/10 of 1% of the 13,000 is Spam. That means that out of 1.5 million messages only 13 Spam messages got through to our users.
 
This brings up two interesting questions:

1. How many people are buying from Spammers?

- If only a handful of messages are getting through the Spammers must have a high close ratio and a high margin to make this make economic sense.
 
2. Are we going about solving the Spam problem the wrong way?

- Why should we have to process 1.5 million messages when less than 1% are legitimate?
 
Some organizations have to be more open to whom they accept e-mail from because that is the nature of their business - online sales from almost anyone - but what about those organization that only get a few e-mail messages from a few select partners? Could they setup a closed e-mail system where there is a process to be added to their accept list and reject all other e-mails? They could even setup 2 e-mail domains. The first with a few common e-mail addresses like sales@ support@ and billing@ for their public mail presence and the second - by invite only - domain for their real mail boxes?
 
The first domain will get a ton of Spam but will act like a switchboard with only a few select people having to review the messages and forward them internally to the people that will take action on them. The second domain will not accept e-mail from just any domain so it will be very easy to track down the source of any "Spammy" messages and stop them.
 
What do you think? Have you thought of or implemented a 'walled city' plan for your e-mail? Let us know in the comments.
 
- Shaun

Don't Get Tricked By e-Card Spam!

According to this article at the Internet Storm Center (http://isc.sans.org/diary.html?storyid=4054) the bot handlers are working to build up their Spam sending bot network by sending out e-Card spam.

These seemingly harmless e-mail's claim that there is something special for you, either a joke or a surprise and more often than not will trick you into opening it.

Be part of the solution and don't get tricked by these e-Cards. If you know the sender then confirm with them (not by e-mail) that they really sent it to you.

If they didn't send it or if it is sent anonymously then don't open it no matter how curious you are. There are a lot of other joke sites on the Internet or you can always go have a chat with your Grandpa. :)

- Shaun

3.8 Viruses on the Decline - Social Networks the Next Target

AVG Research has released an interesting report on the changing malware landscape. According to AVG, viruses now account for less than 15% of total threats, with phishing scams, backdoor worms, Trojans, keyloggers, spyware, adware and web-based exploits making up the rest.

For 2008 AVG predicts an increase in the number of web attacks on legitimate web sites, particularly social network sites, in order to use these sites for the illegal capture of user data and for the propagation of malware. Folks, over the last year I have been advising you to run your browser in a sandbox or with reduced rights. This is one of the reasons why. In the future you may not be able to assume that those "trusted" websites you visit have not been temporarily compromised.

http://www.avg.com.au/index.cfm?section=news&feature=83

- Shaun

Spam and Love Notes

As Valentines day draws ever closer the flood of e-mail's designed to trick you (Classic Social Engineering) into clicking on a link that will infect and take over your computer start coming fast and furious.

Here is a write-up on the latest variation of the Spam Worm (should we change it's name to the Love Worm? that uses such subject lines as:

"Valentines Day"
"Sweetest things Aren't things!"

and my personal favorite ...

"The Love Train"

http://isc.sans.org/diary.html?storyid=3979

The Storm worm continues to be a menace to all of us who spend any time on the Internet so practice safe surfing habits.

Top Ten Cyber Security Menaces for 2008

Browser vulnerabilities and botnets head threat list.

SANS has released the full article on their website:

Twelve cyber security veterans, with significant knowledge about emerging attack patterns, worked together to compile a list of the attacks most likely to cause substantial damage during 2008.

Participants included Stephen Northcutt, Ed Skoudis, Marc Sachs, Johannes Ullrich, Tom Liston, Eric Cole, Eugene Schultz, Rohit Dhamankar, Amit Yoran, Howard Schmidt, Will Pelgrin, and Alan Paller.

Here's their consensus list in ranked order:

Sans.Org 2008 Menaces

The Register links to the same information:

http://www.theregister.co.uk/2008/01/14/sans_threat_list/

- Shaun