To show how serious they are about their attempts to eradicate spam, fifteen companies have joined forces to help fight one of the most dangerous spam tactics of all – phishing.

This collective, known as the Domain-based Message Authentication, Reporting and Conformance (DMARC), has come together to develop standards that they promise will help combat the practice of spammers sending emails that appear to come from a legitimate organization.

According to DMARC, its work:

“draws upon a history of private industry collaboration with 18 months of dedicated work, to outline an enhanced vision for email authentication that can scale up to today’s Internet needs.”

Who Is DMARC?

The group of fifteen who have dedicated resources to this fight consists of:

• Agari
• American Greetings
• AOL
• Bank of America
• Cloudmark
• Comcast
• Facebook
• Fidelity Investments
• Google
• LinkedIn
• Microsoft
• PayPal
• Return Path
• The Trusted Domain Project
• Yahoo!

And just what exactly they are trying to do is create a specification that allows senders and receivers of email messages to share information with each other about their authentication infrastructure to make sure that emails come from the organization they claim to be.

According to their website, DMARC attempts to address this by providing coordinated, tested methods for:

Domain owners to:

• Signal that they are using email authentication (SPF, DKIM),
• Provide an email address to gather feedback about messages using their domain – legitimate or not,
• A policy to apply to messages that fail authentication (report, quarantine, reject).

Email receivers to:

• Be certain a given sending domain is using email authentication,
• Consistently evaluate SPF (Sender Policy Framework) and DKIM(DomainKeys Identified Mail) along with what the end user sees in their inbox,
• Determine the domain owner’s preference (report, quarantine or reject) for messages that do not pass authentication checks,
• Provide the domain owner with feedback about messages using their domain.

So What Makes DMARC Different?

Most companies already employ some type of analysis on incoming email messages to include SPF and DKIM so this specification isn’t turning to something new. In fact, they recommend a continued approach employing other techniques such as high quality spam filters and rate limiters to form a well rounded solution to fighting spam.

What DMARC is trying to do is to standardize and streamline the process of analyzing messages because participating companies can rely on the coordination of the group to establish trust when it comes to determining whether or not a sender is legitimate.

In plain English, DMARC looks to form a conglomerate of cooperation between email senders and receivers (the organizations like Google, Microsoft, Yahoo!, etc. not the individual users themselves) who share information about the emails they send to each other. Turning to the information made available to the group, it can be easier to see whether or not an email is spoofed spam or a legitimate message worthy of delivery.

Not only is it the hope that less spam will make it through, but that resources will be streamlined as a result of these efforts as well. Large datacenters could see a positive result if all goes as planned.

The Flipside

Of course not everyone is completely sold that DMARC’s work is a panacea when it comes to ending spoofing and spam.

John Levine, one of authors of the DKIM related Author Domain Signing Practices (ADSP) standard, had this to say in an interview with Information Week:

“It’s a good thing as far as it goes, but it does have some of the chronic Internet tendency to put a steel door on a cardboard box.” Like many security standards that are not mandatory, if it’s not implemented then it won’t fail. Neither DKIM nor SPF are at the point where a recipient can say that they will only accept messages that use them. Therefore you still need to keep your eyes open.”

Using Bank of America as an example, it was pointed out in the same article that to fight phishing and spoofing in the past domains suggestive of the name Bank of America, as well as typos, were purchased en masse. Because the pool is so large, Bank of America was not able to purchase every domain available. For example, wwwbankofamerica.com is not owned by them.

So if an email arrives from support@wwwbankofamerica.com it won’t fail any of the checks from SPF or DKIM because it is not a spoofed email address. By all accounts, the sender is legitimate.

Liked this post? Get more anti-spam related news from AllSpammedUp.com!

Will DMARC Have Much Impact on Spam?

Malware developers seem to appreciate a little humor when it comes to naming their schemes. One of the latest email scams to invade inboxes everywhere is no exception, it seems, and the FBI has been quick to let businesses know that if they don’t keep their eyes open for a phishing scam originating in an email from FDIC, NACHA and the Federal Reserve, opening the mail’s attachment could be one of the most devastating choices in a young 2012. Worse yet, this new scheme appears to be linked to the Lord of the Greek gods – or its eponymous malware, anyway.

‘Game over’ is never a good thing, whether it means that your last ship has been destroyed and your quarter spent, whether it’s a lame and overused witticism that yet again has found its way into the mouth of Hollywood’s action hero du jour, and yes, even when cyber criminals are searching for just the right name for their latest piece of malware. While we’re not averse to debating the first two, our interest here is firmly with the latter. It seems the U.S. Federal Bureau of Investigation shares that interest, as evidenced by a security bulletin earlier this month that identifies a new email scam, one which cyber criminals have decided to call – what else? – Gameover.

Gameover is a phishing attack that appears in the form of spam emails spoofing the Federal Deposit Insurance Corporation (FDIC), the Federal Reserve Bank, or the National Automated Clearing House Association (NACHA). Like a multitude of others, the scheme preys on users’ fears and/or lack of vigilance, informing them that there has been a problem with their bank account or an ACH transaction (ACH stands for Automated Clearing House, a network for financial institutions in the U.S.). Sufficiently frightened, recipients are encouraged to click the included link, which instead of resolving the issue, takes the user to a malicious site where the Gameover malware is executed.

The malware has been identified as a variant of ZeuS, a notorious piece of malware which has been responsible for stealing financial information through the practice of keylogging for a number of years. Once activated, the cyber crooks can steal banking information such as account numbers and passwords.

As if that wasn’t enough…

More than just a keylogger, however, ZeuS (and coincidentally, Gameover) has an added payload. According to the FBI:

“After the perpetrators access your account, they conduct what’s called a distributed denial of service, or DDoS, attack using a botnet, which involves multiple computers flooding the financial institution’s server with traffic in an effort to deny legitimate users access to the site — probably in an attempt to deflect attention from what the bad guys are doing.”

But wait – there’s more!

In what sounds like a novel involving international intrigue, FBI investigations have been able to trace the attacks as far as to jewelers, as the stolen funds are used to purchase “precious stones and expensive watches from high-end jewelry stores”. The crooks contact the jeweler, tell them what they’d like to purchase and inform them that they will wire the money the following day. The following day, a “money mule” – a person involved in the money laundering part of the crime – shows up at the jewelry store to pick up the merchandise. The jeweler confirms that the money (the stolen money from the spam scheme) is in their account and upon doing so, turns the merchandise over to the mule, who in turn delivers the merchandise to the crooks or converts it into cash that upon being transferred, is effectively laundered.

Wow – It really is the stuff of imagination, but even more interesting is that the FBI has suggested that the mules could be unsuspecting victims of those omnipresent ‘work at home’ schemes that we see everywhere. While the federal agency has confirmed that many of the mules are willing participants, it has also noted that an increasing number are likely people who have succumbed to these schemes and have been unwittingly recruited into laundering money stolen from victims of the spam scheme.

Be on the lookout for this one and advise your staff ASAP. At very most, it could be a story worthy of a novel. At very least, it could save you and your users plenty of headaches and lost funds.

Liked this post? Get more anti-spam related news from AllSpammedUp.com!

FBI Declares ‘Gameover’, Link to ZeuS

Along with a new year, January brought with it a new wave of spam campaigns, most ofthem malicious in nature. Here’s a look at some of the top headlines for the month:

Nokia Fined For Spamming Their Customers:

http://arstechnica.com/gadgets/news/2012/01/nokia-fined-in-australia-for-spam-texting-its-own-customers.ars

Top 9 Domains Used to Send Spam:

http://betanews.com/2012/01/25/what-are-the-top-domains-used-for-spam/

New Wave of Spam Infects Just By Opening Email:

http://www.darkreading.com/security/attacks-breaches/232500660/new-drive-by-spam-infects-those-who-open-email-no-attachment-needed.html

Global Spam Levels Drop, Malware Rises:

http://www.zdnet.com/blog/btl/global-spam-declines-as-malware-encounters-pick-up-report/67858

Man Accused of Running the Kelihos Botnet Says He’s Innocent:

http://www.computerworld.com/s/article/9223820/Accused_Kelihos_botmaster_proclaims_innocence

Liked this post? Get more anti-spam related news from AllSpammedUp.com!

January Spam Roundup

People just weren’t spending as much money in the malls and department stores.

However every single study of consumer spending did show that companies with a strong online presence had a significant boost in sales this past year, including the holiday shopping season. In fact during December alone, non-store sales rose 10.6 percent from the same time one year ago. Even automobile sales online boasted a 9.5 percent increase.

To make sure they can stay competitive in the online retail sector, businesses must strive to build, and at the same time maintain, a solid reputation on the Internet.

Of course it was only a matter of time before spammers realized this as an opportunity to take advantage of this trend to dupe business owners into downloading dangerous malware.

How the Scam Works

Businesses are sent an email branded with the Better Business Bureau logo that reads:

“Thank you for supporting your Better Business Bureau (BBB). Your BBB receives more than 6,500 requests for information every day and provides reliability reports to consumers 365 days a year, 24 hours a day, and 7 days a week.

As a service to BBB Accredited Businesses, we try to ensure that the information we provide to potential customers is as accurate as possible. In order for us to provide the correct information to the public, we ask that you review the information that we have on file for your company.

We encourage you to use our ONLINE FORM to provide us with this updated information. The URL below will take you directly to this form on our website:

CLICK HERE to login to your BBB account

You may also complete the form on the reverse side of this letter and mail to PO Box 1000; DuPont, WA; 98327; or fax to (206)436-5496.

Please look carefully at your telephone and fax numbers on this sheet, and let us know any and all numbers used for your business (including 800, 900, rollover, and remote call forwarding). Our automated system is driven by telephone/fax numbers, so having accurate information is critical for consumers to find information about your business easily. In addition, many consumers may search our database using your e-mail and/or Web address, so please be sure to include this information as well. As a BBB accredited business, you receive a free hyperlink from your online reliability report to your company Web site if provided to us.

Thank you again for your support, and we look forward to receiving this updated information.

Sincerely,

Accreditation Services”

Eager to keep their information and good standing current, business owners and managers who click the link are not taken to a legitimate site hosted by the BBB. Instead their computer downloads malware and their account credentials are compromised by the phisher.

Another version of the phishing scam informs the recipient of the email that a negative review of their company has been posted to the BBB site. To refute the claim, the recipient must click on the supplied URL and address the problem. Failure to do so would result in the complaint resulting in a bad report being filed.

The URL here also directs the victim to a malicious site and has the potential for account credentials being stolen.

Fighting Back

This newest scam is the third of its kind in the last three months targeted at business owners.

Businesses have been instructed, by the BBB, to contact them directly if they receive emails claiming that they have received a negative complaint or that their information is incorrect or incomplete.

The Better Business Bureau is also taking steps to fight the problem, enlisting the help of the FBI.

“Our national organization in Arlington, Va. has been working for three months with the FBI, and I can tell you that they’ve closed down over 50 sites”, Katie Carrol, Director of Media Relations and Communications with the BBB, said.

They have also asked for business owners to help them fight this growing problem by contacting them at phishing@council.bbb.org if they received these emails, or any others like them.

IT departments should also be aware of this scam and take necessary precautions.

In house steps that can help prevent problems related to this latest attack, as well as others, include:

• Keeping anti-malware software up-to-date.
• Make sure anti-spam solutions are configured correctly and up-to-date.
• Make sure that employees are aware of this scam.
• Put procedures in place for employees who receive this email, or other spam messages, to report it.
• Teach employees how to better recognize spam and phishing attempts.

Liked this post? Get more anti-spam related news from AllSpammedUp.com!

Phishing Scam Targets Victims Using Better Business Bureau

The year’s off to a rousing start, with all sorts of interesting security news this week: Wikipedia led a temporarily successful foray against SOPA and PIPA by joining numerous websites that went dark for a day; the founder of Megaupload had his hands slapped when law enforcement officials told him resoundingly, “no, you can’t pirate copyrighted material” – insult was heaped upon injury when dozens of expensive cars were towed away to show him they were right; and Koobface – the Facebook botnet that has been harassing Zuckerberg for years – was taken down by its own creators after the Facebook gang teamed up with The New York Times to uncover and publish the identities of the worm’s owners. To round off the week, QR codes (like the one in the image here) may just be the latest form of spam, and news out of the Twitterverse suggests that Darwin’s cardinal rule is not only true, it’s actually a dire prophecy of our impending extinction.

The year’s less than a month old and it may already be shaping up as ‘the year of anything goes’. Topping the headlines was a mass protest against seemingly inevitable anti-piracy legislation SOPA (Stop Online Piracy Act) and PIPA (Protect I.P. Act), as innumerable websites intentionally went dark on January 18. Led by students’ greatest friend and perpetual source of dubious information Wikipedia, the activist movement irritated web surfers across the globe and scored one for the little guy as the bureaucrats in Washington, DC backed off the proposed legislation and shelved the bills, albeit temporarily. It’s practically inevitable that some wily spammer will take advantage of this controversy, so keep your eyes open and watch your back.

In a related story and in the spirit of fishy timing (i.e., the same week as the aforementioned protests), Megaupload founder, Kim Dotcom, was carted off along with several other geniuses who figured they would get away with providing a conduit for copyrighted material, all the while skimming millions of dollars off the illegal activity and thumbing their noses at the FBI. German national Mr. Dotcom, lamented as his lavish New Zealand mansion was raided and dozens of vintage cars were hauled away as the spoils of war. Again, there’s more here than meets the eye, especially now that Anonymous has its back up.

In an LMAO moment, individuals responsible for Koobface – a nasty piece of malware that has been frustrating Facebook and Twitter users for years – have taken down their own command and control server after Facebook teamed up with The New York Times to uncover and embarrass five of the founders – Russian nationals living in St. Petersburg, Florida. The named individuals have scrambled to scrub their online profiles, but it’s highly doubtful that erasing their cyber identities will have much of an effect in the real world, where police carry real guns and real handcuffs.

Are QR codes the newest spam threat? Some people think so. QR – or Quick Response – codes were developed in the automotive industry and have been used for a while. Slowly entering the mainstream  over the past couple of years, they are in wide use in Japan, the UK and the US, amongst other countries. Popular because of their fast readability and relatively high storage capacity (compared to bar codes), the increased use of smartphones with cameras and QR reading apps have made the codes a prime target for manufacturers and retailers; heck, even Google’s looking at getting into the game by using QR codes as a secure login method.  The problem is that QR codes can contain virtually any information, meaning that they are already being exploited by scammers and spear phishers. Keep an eye on this one, folks – and think twice before you take a picture of that code staring you in the face.

Finally, from the Twitterverse, here’s one that, no matter how much you shake your head, won’t rid that sickening feeling that the human race is on a collision course with extinction. Perhaps a case of ‘you can’t spell Twitter without ‘twit’, this recent article shows just how careless – or ignorant, or both – web users really are. Get this: over a twenty-four hour period, more than 11,000 Twitter users shared their email addies with the rest of the world. A safe practice if we were living in Thomas More’s Utopia, but it’s not the case if you reside anywhere on Earth, which is rife with people who would just love to use that information against you. This is just a guess, but it looks like spear phishing season is open and Twitter is the local watering hole.

Liked this post? Get more anti-spam related news from AllSpammedUp.com!

Week in Review: You Can’t Spell Twitter Without ‘Twit’

This week, a phishing attack landed in the inboxes of several US government agencies, spoofing the US government’s cyber security watchdog and response agency. Complete with attachments, the e-mail’s payload was a nasty little virus that has already been tracked back to Mother Russia. To make matters a little embarrassing, perhaps, it’s not enough that the agency which was spoofed in the attack has reported a disruption of its own systems, but it’s also the government body responsible for identifying and mitigating just this type of thing.

On January 11, news erupted of a rather malicious little spoof email that circulated through the mail servers of several national, state and local government agencies and even private sector employees. The scam in question was an email pretending to be the product of US-CERT, the United States Computer Emergency Readiness Team, a division of the Department of Homeland Security.

Sent with fake source addresses that included soc@us-cert.gov and the subject line Phishing incident report call number: PH000000XXXXXXX and an attachment named US-CERT Operation Center Report XXXXXXX.zip, a nasty little file which was anything but a report. In fact, after some quick investigation, the attachment – which executes a file named US-CERT Operation CENTER Reports.eml.exe – was discovered to be a variant of the infamous Zeus virus known as ‘Ice-IX’, a keylogger that steals banking and other personal information. As if that isn’t enough, the worm also bypasses firewalls and other protection schemes.

Oh, the Irony!

US-CERT responding by doing what it’s supposed to do: it posted a bulletin and notified agencies. And while not admitting that anyone at US-CERT actually opened the little bugger, an operator at the agency has stated

“difficulty receiving emails due to the phishing campaign”

according to SC Magazine. A little embarrassing, considering that this is just the type of thing US-CERT has been mandated to protect against, it’s a forgivable fumble considering that the scam artists continue to get wilier and more creative in their attacks.

In an ‘it never hurts to state the obvious’ moment, US-CERT included the following advisories in its security bulletin:

US-CERT encourages users to do the following to reduce the risks associated with this and other phishing campaigns:

• Do not open the attachments in email messages from unknown sources.
• Install anti-virus software and keep virus signatures files up-to-date.
• Refer to Recognizing and Avoiding Email Scams (pdf) documents for more information on avoiding email scams.
• Refer to the Avoiding Social Engineering and Phishing Attacks document for information on social engineering attacks.
• Refer to Recovering from Viruses, Worms, and Trojan Horses document for additional information on how to recover from malware.

From Russia with Malice

The story gets a little more interesting from here, when Nextgov.com reported on Wednesday that

“Researchers outside of US-CERT traced the malicious software to a botnet – a remotely-controlled network of infected computers – that is taking commands from computers located in Russia.”

It’s not clear why researchers outside of US-CERT traced the location – it would seem natural that US-CERT was capable of doing that sort of thing. Isn’t it logical to assume that’s what the “response” part of their name is for?

Regarding the attack and its location, there’s clearly no love here, only malice. So why was an e-mail from Russia so specifically targeted at and around US-CERT and US government agencies? It’s extremely unlikely that this was state sponsored – the method used and speed at which it was detected suggest something far too ham-handed to be anything that nefarious. So taking that into consideration, the incident still poses something of an oddity. If a group, say organized crime – which is alive and well in Mother Russia – was responsible for the attack, what could they possibly hope to gain by phishing government agencies in the US? And if it was some cyberdude named Boris, who figured he’d take time from his daily routine of scamming innocents to pry into US-CERT’s activities, he certainly isn’t the brightest cyberdude in cyberspace.

It’s very mysterious, this one, and it will be interesting to see what, if anything, comes from the follow-up investigations.

Liked this post? Get more anti-spam related news from AllSpammedUp.com!

US-CERT Hooked by US-CERT Phishing Attack

Optimists often look for the most positive events over the year to attach to the label, The Year of…, realists however, take a different approach. And while 2012 is still young and holds a lot of promise, this year could very well be known as the year of social spam.

Social spam is nothing new. In fact, spam first infiltrated Internet bulletin boards in 1994 to mark the first major commercial spam campaign when Laurence Carter and Martha Siegel, a husband and wife team of lawyers, posted bulk messages to Usenet groups advertising their immigration law services in what became known as Green Card spam.

Social interaction on today’s Internet is far more sophisticated than the simple posting of messages and hyperlinks however. Nowadays, spammers turn to social networks and guise their spam as links, content, video, audio and executable files.

The nature of social spam has also changed as the platforms that deliver these messages have also developed over time.

No longer is spam only used to deliver advertising and marketing messages alone. With a more sophisticated field on which to play, spammers have used social sites to not only deliver their advertising, but also malware that: steals credit card numbers, captures user names and passwords and turns computers into zombies.

But if social spam has been a problem for so long, why would 2012 be any different? Take a look and see…

The Facebook Example

On January 4, 2012 the Wall Street Journal reported that social spam is on the rise and to combat this, social networks are hiring more staff to help fight this problem. Facebook was named specifically because according to reports, the volume of spam on Facebook is growing faster than its user base.

On Facebook, spam usually spreads when users are tricked into liking, and then sharing, content that is spam. This practice, known as like-jacking, usually works when a user’s computer is infected with malware that allows the spammer to take control of the user’s Facebook account.

The spammer then posts a message on your friend’s profile that would be interesting to others. Commonly, free dinner coupons are used as the bait as are offers for free iPads or other give aways.

When the user’s friends click on the free offer, they are instructed to download the coupons. These coupons actually contain malware that infects the computers of the user’s friends thus continuing the cycle.

Of course the malware does more than just spread itself via Facebook. It can be used to deliver Trojan horses, keystroke loggers, or any other type of malware.

And just how prevalent are these messages? By Facebook’s own admission, they block over 200 million malicious actions every day. In 2008 the company employed four engineers working to fight malicious use of their site. The same department today, named site integrity, now has 31 team members. Additionally, there are 46 people working on security 300 focused on user issues and over 1,000 others (engineers, lawyers, risk analysts, etc.) who help to fight spam on the site in other ways.

Others Not Immune

Of course other social networks and content sharing sites are hardly immune to the problem of social spam. Twitter has long been a hot bed for spammy posts created by malicious users.

Twitter, by nature, set itself up for spam from the very beginning. As a great way to share content to other like-minded users, Twitter allowed people to share short messages that were less than 140 characters long; short, sweet and to the point.

Since URLs were often lengthy, companies – including Twitter – developed URL shorteners. Now, http://www.allspammedup.com could become http://bit.ly/3KmvyZ to save precious character space.

The problem is, no one really knows if http://bit.ly/3KmvyZ will take you to All Spammed Up or a malicious web site.

Google also out how quickly spam could infiltrate even a carefully planned social network.

Originally opened through an invite only process, Google+ users found the site a welcome break from other social sites that had turned into spam havens. Since early adopters were tech savvy, spam was quickly reported and accounts spewing spam were shut down.

Then came the public release and the ability to create business pages and spammy comments and shares began to fold the network causing one well known legitimate marketing professional to comment:

Wow, Google+ must be taking off. Spotted not one but two pieces of comment spam today.

As users find it easier than ever to share content with their friends and family, spammers will find it easier to manipulate this process. Because we have become so trusting of the content our “friends” share with us, we never consider the fact that what may be the coolest thing on someone’s wall may just wind up infecting our computer.

Liked this post? Get more anti-spam related news from AllSpammedUp.com!

Is 2012 the Year of Social Spam?

In Part 2 of our look at what you can expect in the coming year, faint rumblings out of Japan suggest that one prediction from Part 1 of this article has already come true. If the very real prospect of becoming an innocent casualty of war isn’t enough to make you run backward toward the year that just passed, these bold predictions reveal how hackers will develop an even stronger sense of camaraderie, and how mobility is sure to become a four-letter word. And if you thought spamming and Internet scams made it personal in 2011, you ain’t seen nuthin’ yet.

How about that? 2012 wasn’t even seven days old when news out of Japan this week revealed some eerie premonitions of the things to come and earmarks of a bold prediction made one week ago.  Engadget, ZD Net and other media outlets are reporting that the Japanese government has been working in concert with Fujitsu since 2008 to develop a powerful ‘cyber weapon’ – a piece of software that, upon the detection of a cyber attack (such as DDoS, for example) tracks the attack back to the source.

Sounds pretty straightforward, right? Sure, until you consider that the software also attacks and disables every machine it finds along the trail. The goal, Engadget reports:

“is to stop the spread of a malicious piece of code by finding and shutting down, not just the source, but all middleman PCs that are also now potential hosts. In some admittedly extreme scenarios this weapon could potentially spiral out of control, taking out far more computers than intended.”

Hmm… Botnets are nothing more than large numbers of unsuspecting computers carrying out their attacks at the behest of the infector and ignorance of the computer’s owner. Japan’s little toy, while it sounds like it might be fun to take for a spin, could have the unpleasant and unprecedented effect of being the cause of some serious collateral damage. Casualties of war? Here’s a tip for everyone: while you still have a chance, give that fave desktop or laptop of yours a great big hug before it’s too late.

1. Hackers of the World, Unite

Robin Hood met Mafia Boy last year as hacktivism took center stage. Indeed, 2011 was an entertaining year for anyone who followed the exploits of Anonymous and LulzSec. The drama unfolded like a kabuki play born in the mind of Ken Kesey and brought to life by a troupe of mimes with Tourette Syndrome, and there were even a few arrests along the way to make this reality show really…ahem… arresting.

Prediction: We will see some new hacking activity from these groups, with some high profile web takedowns in the process. While that’s not a stretch, this is: hacker groups like Anonymous and LulzSec will grow in size substantially, resembling an ‘occupy’ type movement that will take the war online. The civil and social unrest of 2011 will turn to face the financial behemoth that is the Internet.

2. Mobility Means Vulnerability

If we learned anything about spam in 2011, it’s that spam is like that proverbial bum of a brother-in-law who’s been living in your basement for the past two years. It’s not going away, good luck making it work for you, and you will be out-of-pocket at some point. Spammers continued to use every means at their disposal in 2011, with SMS spam becoming a real pain in the neck. Security flaws in the two most popular smartphone platforms – iOS and Android – just accented what we already suspected: that spammers and purveyors of malware had taken their show on the road.

Prediction: 2012 will see a massive increase in mobile spam, and mobile devices will become the swords upon which we will live or die unless we get mobile security under control.

3. It’s Nothing Personal…Well, Actually, It Is

A significant development in spam and phishing in 2011 was the way in which the scam artists were getting smarter; you know, smarter in much the same way that a chunk of igneous rock living at the bottom of a fetid riverbed is smarter than a rotting patch of lichen hanging for dear life to the side of an oak tree. Like it or not, the scambags are wilier, finding new and innovative ways to pick your pocket without actually residing in the same time zone.

Prediction: The scambags will become even cleverer in their assaults, finding new methods to lull people into a false sense of security. How this will occur remains to be seen, but our bold prediction is that it will most likely involve highly targeted, multilevel campaigns where the scammer will use detailed knowledge of the targets, and multiple contact methods like email, phone, SMS and even snail mail to enact their evil schemes.

Liked this post? Get more anti-spam related news from AllSpammedUp.com!

Bold Predictions for 2012 (Part 2)

In a turn of events appropriate for the most tumultuous year in cybercrime, 2011’s body is barely cold and we’re already smelling something suspicious from its decomposing carcass. Rumors of two worms, one well-known and the other relatively new on the scene, have some of us wondering what will happen next in 2012, and the year has only just begun. In an attempt to put the preceding year into perspective, we take a look at what might be in store for the new year and beyond with some bold and not so far-fetched predictions for 2012.

PREDICTION: A Shiny New Worm with Every Census Report, Tax Return and Piece of Monetary Currency

First up for 2012 is a prediction that all bets will be off when it comes to understanding the nature – and source – of some of the most insidious malware in the known universe. In fact, the threat and very nature of the state-sponsored malware will only get more confusing, and most likely more disturbing, as we discover where and how it’s being used.

Discovered in 2010, Stuxnet was in the news again in 2011. A worm designed to target and damage industrial control systems (like the kind found in nuclear plants), it has been a source of great debate over who created it and what its ultimate purpose represented; but few could argue that with more than forty percent of Stuxnet’s infections landing in Iran, the nation was most likely the target from the get-go. Russia and others wasted no time pointing the finger squarely at the United States and Israel as the benefactors of the worm, which surely must be state-sponsored.

It seemed inconceivable that anything could top the news that broke late in the year about Stuxnet’s connection to Conficker, suggesting that the latter, a notorious botnet, was used to deliver the payload for Stuxnet. If rumors are true that Stuxnet is state-sponsored, the implication that spam might have been part of the delivery method can and must only leave a bad taste in people’s mouths.

As 2011 wheezed out its last few painful breaths however, a new development occurred in this bizarre tale, as it was revealed that ongoing research by Kaspersky Labs on Stuxnet uncovered a direct link between Stuxnet and Duqu – a worm, discovered only in September, which shares many of the attributes of Stuxnet. In fact, media outlets are reporting that the worms are suggestive of an ‘arsenal’ of malware that has been in development as early as 2007. The code kernel has been dubbed ‘Tilded’, in recognition of the author’s habit of using filenames that begin with ‘~d’.

The Prediction: Keep your eyes open for Tilded. We will continue to see new pieces of the puzzle unveil, and they will point at the government of a country – or perhaps multiple countries working in concert – all but providing conclusive proof of the party (or parties) responsible for this new and nefarious form of warfare. What will make this story even more notorious, however, is when it becomes clear that an unsuspecting public has been a major delivery mechanism for this 21^st century warfare, through the use of spam, malware, and botnets. And if that is true, it could very well be the case that some of those spammers you curse on a daily basis are actually nation states using spam to mask their cyber intelligence activities.

PREDICTION: The Cloud Will Get Stormy

While the Cloud was one of those recurring themes that flew, for the most part, under the radar in 2011, companies like Apple and Microsoft continued to push it like it is a silver bullet and a cure-all for everything that ails small companies to major corporations.

The Prediction: 2012 will see at least three Cloud-based security events, most likely linked in some way to spam, malware, hack attacks or compromised mobile devices. Furthermore, they will be high profile events, targeting Fortune 1000 or Global 1000 companies, or less likely a government agency. Anonymous will take credit for at least one of the breaches, and there will be a link with one of the breaches to North Korea and/or China.

Next week, in Part 2 of this story, we’ll take a look at some other bold and controversial predictions for 2012, and how we can learn something from 2011 – but only if we’re ready and willing to listen to it.

Liked this post? Get more anti-spam related news from AllSpammedUp.com!

Looking Back At 2011 And Bold Predictions for 2012 (Part 1)

To many people, the easiest way to determine if an email message can be trusted enough to warrant opening and reading it is to look at the sender. Unfortunately, the inboxes of our family and friends can be compromised rather easily and used to send spam.

But surely the email of a large, respectable news organization would be immune to the trickery and masquerades of spammers, right?

Apparently not.

On December 28, 2011 subscribers to the New York Times received an email from the news company. The email informed these recipients that although their recent request to cancel their home delivery subscription for the newspaper had been received, the Times was appealing to them to reconsider their decision and remain on as a customer:

Our records indicate that you recently requested to cancel your home delivery subscription. Please keep in mind when your delivery service ends, you will no longer have unlimited access to NYTimes.com and our NYTimes apps.

We do hope you’ll reconsider.

As a valued Times reader we invite you to continue your current subscription at an exclusive rate of 50% off for 16 weeks. This is a limited-time offer and will no longer be valid once your current subscription ends.*

Continue your subscription and you’ll keep your free, unlimited digital access, a benefit available only for our home delivery subscribers. You’ll receive unlimited access to NYTimes.com on any device, full access to our smartphone and iPad^® apps, plus you can now share your unlimited access with a family member.^†

To continue your subscription call 1-877-698-0025 and mention code 38H9H (Monday–Friday, 8:30 a.m. to 8:30 p.m.; Saturday, 9 a.m. to 3 p.m. E.D.T.).

In a day and age where a majority of people get their news from electronic sources instead of traditional newsprint, this doesn’t sound like anything out of the ordinary.

However shortly after these emails went out, a tweet from the Times’ account went out stating:

If you received an email today about canceling your NYT subscription, ignore it. It’s not from us.

Instead of a few people being asked to reconsider their choice to cancel newspaper delivery services, the email went out 8 million people. All of them subscribers to services of the New York Times, but some of them only subscribed to the digital edition of the newspaper. They weren’t even customers of the home delivery service.

Spreading the News Over Twitter

As soon as the tweet was released, the speculation started. Although the New York Times claimed that they were, “working to coordinate a response,” many on Twitter pointed the finger at Epsilon, the email firm that was compromised last spring.

When asked by BetaBeat if this was a result of the recent breach, Epsilon spokesperson Jessica Simon stated:

“This is the first I’ve heard of it. Let me talk with our email group and get back to you.”

Jumping the Gun

Once the smoke had cleared and the fingers had been pointed and redirected, it turned out that the email actually was sent from the New York Times’ email servers. They immediately released the following statement:

An email was sent earlier today from The New York Times in error. This email should have been sent to a very small number of subscribers, but instead was sent to a vast distribution list made up of people who had previously provided their email address to The New York Times. We regret this error and we regret our earlier communication noting that this email was SPAM.

It is nice that they regret their error, however they shouldn’t regret calling their errant mass mailing spam, because that is exactly what it is.

According to WikiPedia, Spam is unsolicited bulk, or unsolicited commercial, email. It is the practice of sending unwanted email messages, frequently with commercial content, in large quantities to an indiscriminate set of recipients.

Companies, especially larger ones, need to understand that when someone trusts them with their email address they are assuming that this information is safe. Safe from cyber-criminals looking to harvest these addresses and safe from trusted employees accidentally sending out indiscriminate emails causing panic.

Had this incident in fact been caused by a security breach, the result would have been similar. Customers would have been hassled by illegitimate messages, people would have been less productive as they were forced to deal with this fake warning and resources were spent dealing with the mess.

Just because it was an email that was sent by mistake doesn’t mean the effects are any less irritating or costly.

If it walks like a duck, and sounds like a duck… well, you get the point.

Liked this post? Get more anti-spam related news from AllSpammedUp.com!

Coffee, the New York Times and Spam

While the fat man in the red suit has already signed-off on his naughty or nice list, there’s one nasty little child holed up somewhere in Russia who needs to get a large lump of coal in his stocking this year. Or if not a lump of coal, then a shiny new pair of law enforcement-grade handcuffs.

What is it about this time of the year that brings out the worst in people? Religious beliefs aside, there’s something about this time of the year that should make all people take a deep breath, send a little good will out to fellow humans, and, well… just smile, dammit. Unfortunately, for spammers and scammers, it appears that there’s no room for taking time off over the holidays and treat others with the dignity and respect that most people recognize as a necessary element of a living, breathing society.

Case in point: The Register reported earlier this month that three anti-scam sites were inundated with a massive Distributed Denial of Service (DDoS) attack over several days, effectively rendering the sites useless. According to The Register:

“The sites – 419eater.com, scamwarners.com and aa419.org (Artists Against 419) – were swamped with junk traffic for several days. During the attack the sites’ administrators turned to blogs, Facebook and other alternative channels to distribute news of newly detected fake payment sites and other urgent anti-fraud information.”

According to an anonymous Register reader:

“These websites and their users provide excellent exposure for online fraud activities and have been responsible for allowing thousands of prospective victims to detect a scam in play, and get out before losses are incurred They also work actively to kill fake bank sites, fake freight forwarding sites and other criminal resources.”

The Register reported that two of the three sites were back in working order in a few days, but the story takes a nefarious turn from here. Early speculation was that a Russian scam artist was responsible for the attacks, and not long afterwards, someone over at ScamWarners contacted The Register and divulged that the attack:

“was perpetrated by a scammer who became angry at a topic posted on 419Eater, which exposed his scam. 419Eater.com was first attacked and ScamWarners began to publicise it via Twitter and Facebook. The next day [Thursday], ScamWarners was also attacked. The scammer then sent an email to me, threatening both ScamWarners and 419Eater. We were told to cease exposing their information and reporting their Amazon sites or we would both be eradicated from cyberspace.”

If that last sentence didn’t outrage you at least a little bit, go back and read it again. Is it necessarily foolish and naïve to believe that even scammers – scumbags who invest a significant amount of time into developing malware designed to bilk little old ladies living on fixed incomes out of their precious savings – might take a little time off during Christmas, Kwanzaa, Hanukah, Ashura, or whatever religious observance you prefer to…uhm…observe? Absolutely it is. One could assume that’s what bulbous men in red tights with fist-sized lumps of coal are for. But acceptance isn’t enough. This is a time of the year “when want is keenly felt, and abundance rejoices”, as Dickens pointed out; yet the inhumanity of the deeds of a few are enough to make this writer wonder how we continue to survive the ravages of human nature – in other words, ourselves.

It’s been a year fraught with cyber crime and cyber busts, with malicious attacks and new forms of spam; with new scams and chilling suggestions of things to come. For this week, anyway, most of us will rejoice at the presence of family and friends, and sadly, many will go hungry. Here’s hoping that in 2012, we will have a chance to see more of these scammers on our little blue-green orb find the other side of steel bars.

Next week: tune in for our top 10 list of popular torture methods for 2012.

Liked this post? Get more anti-spam related news from AllSpammedUp.com!

Lump of Coal Edition: When Scammers Attack

New statistics on spam have revealed that India has shot ahead of the United States and South Korea to claim the title of biggest spam producer in the world. 12% of the spam in the world comes from India. This is largely because India is a popular home for botnets and the amount of botnets whose origins lead to India is increasing.

In a written reply in the Lok Sabha, the Minister of State for Communications and IT, Mr Sachin Pilot, said that Indian Computer Emergency Response Team in co-ordination with the industry and service providers is working towards disablement of ‘spam bots’ located in India to curb spam sources.

India is also home to a thriving economy based on human CAPTCHA solving. These companies cater to spammers, who are happy to pay them to solve CAPTCHAs by the thousands. This allows them to set up email accounts on services like Gmail and Yahoo to pump out spam from and blogs on services like Blogger for distributing email and conducting Adsense and affiliate fraud.

Computers and the internet are increasingly affordable in India, and the number of internet users there have skyrocketed to over 110 million.

In better news, the United States, once one of the top three spam producers in the world, has dropped out of the top 10 altogether. This is attributed to the efforts Microsoft and the FBI have made over the past year to crack down on spammers and take down several major botnets. This is also credited for bringing the global spam volume down to 75% of all email sent.

Liked this post? Get more anti-spam related news from AllSpammedUp.com!

India: King of Spam?

It’s the most wonderful time of the year, and what better way to take a look back at the year in spam than poke a little fun at the moronic state of the crap that invades our inboxes? In a year that saw major security breaches, several high profile botnet takedowns, and an unprecedented surge in personalized scams and mobile spam, we stop to reflect upon it all and submit a simple postulate: what if Dr. Seuss had been a spammer?

As the year winds down to a close, it’s only basic human nature to look back at the year that just passed and reflect upon it. In the world of spamming and Internet scams, that’s bound to be a painfully long look, since this has been a year fraught with new scams, major cybercrime busts, and unprecedented levels of security threats. With mobile devices providing the newest threat opportunities, and SMS spam picking up a head of steam as scammers get creative, we must be even more vigilant when fighting spam-related threats.

What’s in store for 2012? One must shudder when imagining the possibilities. If anything like 2011, next year will represent an even more dangerous landscape, cluttered with mines and booby traps the likes of which we’ve never seen.

Dire prophecies and doomsday mentality aside, it doesn’t hurt to poke fun at spam once in a while, and during the holidays, no one is more fun than the venerable Theodor Seuss Geisel, known to adoring children and former children alike as Dr. Seuss. Like many households, it’s a holiday tradition around here to watch How the Grinch Stole Christmas!, an annual ritual which inspired this writer to wonder: what if Dr. Seuss was still with us, and what if, ahem, wait for it…Dr. Seuss was a spammer?

The thought itself is sure to bring a smile to the face of anyone who has endured the miserable drivel that infests inboxes like brown marmorated stink bugs. Poorly written and replete with ludicrous stories that must have been contrived during bad acid trips, these emails often frustrate us, and occasionally make us smile by virtue of their sheer stupidity. What they do not do, however, is give us any confidence that the human race is poised to survive much longer, if this epidemic of oafishness is representative of the current state of the gene pool.

So without further ado, here’s a humble attempt at imagining what spam might be like, if written by Dr. Seuss:

The Spammer Who Stole Christmas?

Dear stranger, forgive me for this intrusion

I hope my letter will ease your confusion.

I will not, cannot state it enough

This is rough stuff, even a little tough.

There’s a Libyan prince who lost his good fortune

And my offer to you is a share of the portion.

I cannot get the funds out of my land

And I hope you will aid me by lending a hand.

You see, there are sums in excess of millions

If you give me your name, I’ll give you gazillions.

It’s okay to give me personal information

They don’t extradite criminals in my tiny nation.

Your bank account and credit cards are essential

They’re only for scamming and merely referential.

This is for good cause, I must admit

Send money now and show you commit.

I do not wish to enter a heated debate

Send it fast, send it now, it cannot wait.

The funds are for my stately Kenyan mansion

It’s in great need of a major expansion.

Happy Holidays to all!

Liked this post? Get more anti-spam related news from AllSpammedUp.com!

If Dr. Seuss Was a Spammer

Microsoft, Google, AOL, and Yahoo are all providing metadata from messages sent to their users on a daily basis to Agari. Protecting users’ privacy is of paramount importance to all of the participants. The metadata includes aggregate information on things like source IP address, subject, and sender address, but not the body of the email. Participating providers may provide URLs contained within messages that are already failing other tests so that Agari can notify the company being spoofed in the message, but no other email content is shared.

As email metadata is analyzed by Agari, who is handling over 1.5 billion messages a day, characteristics of messages that are spam or phishing messages are identified. Data is then pushed back to the participants, who can update the policies on their borders to reject spam and block phishing attacks.

There are about fifty other participants in the Agari service, including financial and e-commerce corporations. Business site LinkedIn, and social media sites Facebook and YouSendIt are also participating, which is great news for the users of these services, who are often flooded by spam messages.

It may surprise you to learn that you have probably already been protected by Agari. The company began operations in 2009, running in stealth mode. Current estimates have Agari protecting half of US consumer email users, and over 1 billion individual mailboxes.

Agari, a spinoff of Cisco Systems, is a venture capital funded company based in Palo Alto, California and led by several of the people who were responsible for creating and running Cisco’s IronPort technology. Agari promotes their technology as a cloud based infrastructure, capable of pushing out updates in response to new attacks in a matter of seconds. With an infrastructure capable of processing billions of messages per day, they are positioned to handle the ever increasing volumes of email.

Liked this post? Get more anti-spam related news from AllSpammedUp.com!

Strength in Numbers – Agari

Stuxnet, arguably the most interesting and bone chilling discovery in the history of computer security threats, is back in the news this week. This time, however, it’s brought a friend – one familiar to security experts and IT personnel alike. If the report from one of the world’s foremost experts is accurate, then it’s going to be a merry Christmas indeed for conspiracy theorists and lovers of international intrigue – and potentially a headache for a couple of governments which are being pressed to fess up about the true origins of Stuxnet and Conficker.

When its presence became known in June 2010, the mere existence of the Stuxnet worm sent shudders through international cybersecurity circles. In case you were off-world at the time of the incident, here’s the skinny: Stuxnet is spread via Microsoft Windows and targets Siemens industrial software and equipment. Although it’s not the first time hackers have targeted industrial systems, it is the first malware to spy on and compromise industrial equipment, and the first to include a programmable logic controller (PLC) rootkit.

What made Stuxnet particularly interesting to conspiracy theorists was where, specifically, it landed. 60% of occurrences of Stuxnet infections were in Iran, and five variants of the worm were discovered at various Iranian facilities, with the apparent target being Iran’s nuclear programme. Stuxnet’s ability to control Supervisory Control And Data Acquisition (SCADA) systems – the kind found in industrial plants – has wreaked havoc on the Iranian nuke programme, particularly at the country’s uranium enrichment facility at Natanz, where, according to Haarretz, “the centrifuge operational capacity has dropped over the past year by 30 percent.”

News of the industrial worm quickly became the stuff of a Tom Clancy novel or Hollywood thriller. Stuxnet’s sheer sophistication and the level of resources required to enact such an attack made it clear that Stuxnet was most likely state-sponsored. Accusations flew about the originator of the worm, and in a fine example of inductive reasoning, fingers were squarely pointed at the U.S. and Israel.

Enter Conficker

Much ado has been made of Stuxnet, and as might have been expected, nothing’s been proven about the source of the worm; but in what is sure to be only the beginning of a heated new debate, this week several media outlets have reported that a

“a celebrated ‘uber-hacker’ with 18 years of service in Special Operations and intelligence,” has linked Stuxnet to Conficker. No, that wasn’t a typo.

John Bumgarner, a retired U.S. Army special-operations veteran, former intelligence officer, and current CTO of the not-for-profit U.S. Cyber Consequences Unit, says he discovered the link between Stuxnet and Conficker only after,

“spending more than a year researching the attack on Iran and dissecting hundreds of samples of malicious code,” according to Reuters.

In case you’ve been off-world AND living under a rock, Conficker is one of the most devastating and pervasive worms, discovered in 2008 and infecting millions of computers in over 200 countries. The worm is traditionally thought to be the work of an organized crime gang in Eastern Europe, because, much like Stuxnet, Conficker is very sophisticated, probably required immense resources to create, and is extremely difficult to detect and destroy.

“Conficker was a door-kicker,” Reuters quoted Bumgarner. “It built out an elaborate smoke screen around the whole world to mask the real operation, which was to deliver Stuxnet.”

Let’s be clear: Bumgarner thinks he knows who is behind the two programs, but he’s not saying who, because the matter is “too sensitive to discuss.”

According to Reuters, “The White House and the FBI declined to comment,” and, “Prime Minister Benjamin Netanyahu’s office, which oversees Israel’s intelligence agencies, also declined comment.”

Is it really possible that the botnet propagated by Conficker was all for the purpose of setting up a state-sponsored attack?

Huh?

Things get even stranger from here. In September, Techworld reported that for the first time the Russian government has officially blamed the U.S. and Israel for Stuxnet, calling it “the only proven case of actual cyber-warfare”. And wouldn’t you know it? In related story, a water plant in Illinois was hacked in mid-November, an attack that apparently originated from Russia, and like Stuxnet, targeted the plant’s SCADA system.  In the attack, the hackers gained control of the plant’s equipment and damaged it, the first such type of attack on U.S. soil.

Confused? You should be. If we’re to glean anything from these latest developments, let’s at least take away the following: that a) Conficker may have been the delivery mechanism for Stuxnet, and b) Jerry Bruckheimer’s probably finalizing scripts at this very moment.

Liked this post? Get more anti-spam related news from AllSpammedUp.com!

Conficker Linked to Stuxnet, Conspiracy Theory Activity Up 530%

1. Counterfeit Goods: Designer bags, watches, and other knock-offs are a favorite of spammers. They hope to lure shoppers in with hard to resist deals on sought after brand names such as Rolex, Louis Vuitton, and Prada. Some of these spams are honest and actually brag about being high quality “replicas” while others do all they can to convince buyers they are getting the real thing. Remember, if it sounds too good to be true – it is!

2. Fake Delivery Notifications: This malicious spam has been around for a while and to keep right on going. Since this is the time of year people tend to ship lots of packages to distant friends and family, it’s a sure bet spammers will try and take advantage of that to trick people into downloading Trojans that will add their computers to  botnets.

3. Pharmaceutical Spam: This old favorite is still going strong as well. Expect lots of cheesy subject lines with holiday themed innuendo designed to sell a variety of male enhancement products.

4. Fake Auction Notices: This phishing scam uses emails designed to look like they’ve come from eBay. Usually they say you’ve won an item or that a buyer is trying to get in touch with you. Naturally you’ll have no idea what they are talking about because you haven’t bought or sold anything  and want to check your account. Don’t follow the links in the message! They’ll lead to a fake eBay page and when you submit your login details, they’ll go straight to a scammer, who will likely use them to hijack your account and rip people off.

5. Fake Greeting Cards: Perhaps the most popular holiday spam of all are fake, virus ridden electronic greeting cards. A good rule of thumb is if the notification doesn’t tell you who it’s from, it’s probably fake. All the major e-card sites will tell you the name of the person who sent the card in the notification email.

Liked this post? Get more anti-spam related news from AllSpammedUp.com!

Top 5 Christmas Themed Spams

To cosmologists and sci-fi enthusiasts, it’s a well-known fact that we have been beaming our sometimes questionable pop culture out into the cosmos for nearly a century; but recent findings by the scientific community suggest that it might be a prudent idea to begin development of a spam shield to enrobe the Earth in a sort of force field that would suppress interstellar transmission of our crumbling tastes – or at very least, everyone needs to dial up the parental filters, keep the Bieberites away from their keyboards, and warn failing social media websites and Russian astronomers that it’s NOT a ‘cute idea’ to say ‘hey’ to our neighbors by introducing them to what our children think and listen to these  days.

Oh, Justin Bieber. Twenty years from now, when you’re the President of the World and your lyrics are required reading in middle schools, we’ll wonder what happened to our culture and plain ol’ common sense. We’ll also wonder why that fleet of star cruisers closing in on Earth is so bent on cleansing our culture from the face of the Earth; but for now we can just wonder what the hell we were thinking when we beamed 500 messages, hand-picked from your massive throng of supporters, at a nearby star.

When the space race began, scientists realized that by reaching into the cosmos, humanity was proverbially knocking on the door to borrow a cup of sugar. Wisely enough, the scientists of the time composed some messages, mostly in binary, that might be decrypted by intelligent beings. They even included some images, and music that alien beings may be busting a move to as we speak. Voyager 1, for example, contains selected pieces by Beethoven, Mozart, Stravinsky, and even Chuck Berry.

But it’s less likely that a civilized race will ever hear those pieces, and more likely that our ‘space spam’ – like the e-mail spam we all know and hate – will simply reach them randomly. We’ve known for a while now that if there are races living on planets in other solar systems, they’re probably receiving broadcasts of I Love Lucy, Hill Street Blues, M*A*S*H and Cheers, radio signals that left our atmosphere years ago and traveled great distances before arriving at a destination where sentient beings could recognize and decode those signals. Hell, for all we know, we’ve already pissed-off some distant race, which, due to interference from a nearby pulsar, never found out who shot J.R. Surely, that’s not our fault, but one can understand how missing an episode of The Facts of Life or Gilligan’s Island might make those three suns in the sky seem a little less bright. I don’t know about you, but I certainly wouldn’t want to be around a Gronarg of Symbian V if he didn’t get his regular fix of Doogie Howser.

So while alien races fiercely debate which performance was better – Arnold Schwarzenegger in Conan the Barbarian or Arnold Schwarzenegger in Total Recall – it’s enough to know that our message is getting there, even if that message isn’t necessarily the one we should, or would prefer to, deliver. If you’ve read Douglas Adams’ The Hitchhiker’s Guide to the Galaxy, you’ll understand. Think of the G’Gugvuntts and Vl’hurgs, two distant races poised on the brink of a terrible war and meeting for the last time.

It was a cute idea, at the time…

Like our everyday spam, space spam is random, and it would be nice to keep it that way. That’s why news this week from the scientific community should make us scratch our heads and ask a resounding “why?”. Back in 2008, teenybopper site Bebo thought it would be a good idea to team up with Russian astronomer Alexander Zaitsev to send 500 Bebo user messages to the planet Gliese 581c, twenty light years away. As The Register reports, the chosen messages were exactly what one would expect of people who don’t know what a cassette tape is. Some examples: “Our bodies are made of bones … We have senses. Smell, Taste, Sight and Touch. Without any of these things, we wouldn’t live,” and “I love Television. We watch animated cartoons and real-life drama on it. I could sit and watch Television all day.” (By the way, has anyone else wondered how ‘Bebo’ and ‘Bieber’ are so similar? A conspiracy?) Mark your calendars: Tech Radar says the messages will reach the solar system in 2029.

So, wouldn’t you just know it? This week a new international study announced that planets in the Gliese system are the most habitable known worlds. Spam almost always has a nefarious purpose, but it doesn’t have to be intentional. In this instance, I wouldn’t blame the Gliesians for wanting to wipe us off the planet like the infestation that we are.

Liked this post? Get more anti-spam related news from AllSpammedUp.com!

Space Spam on the Rise, Bieberites Rejoice Impending Global Annihilation

Security researchers are warning those with Android phones and tablets, especially SMEs, to make sure they are properly locked down and protected. Studies have shown that Android-based spam and malware detections have risen nearly 500% since April. While the total volume is still quite low compared to PC-based spam and attacks, there is still a need to be concerned. The majority of the detected malware is comprised of Trojan horses and spyware. Some of it subscribes the device to premium services like texts and ringtones without permission and some even record phone calls and sends them to a remote server. (This would be a new twist on the common phishing scam. Instead of tricking someone into typing in their personal info, just record them saying it in a phone conversation! Imagine if you had that kind of malware on your phone and then used your phone to say, make a hotel reservation or check your bank balance? The scammer would be able to record it all).

Why the sudden increase? The blame for that falls squarely on Google. Unlike Apple, which forces app developers to jump through hoops and go through a very slow review process to get their apps into the App Store, Google’s Android Market has a completely opposite approach. Anyone can get an app into the app store. Like Facebook, there is no real approval or vetting process in place. The result? At last check, over 400 apps in the Amazon Marketplace contain malware.

Spam succeeds due to the lack of spam filters built into the Android OS and because links in texts can easily be made to look legit. This leads to users being tricked into clicking on malicious links and accidently downloading malicious code.

Liked this post? Get more anti-spam related news from AllSpammedUp.com!

Android Spam Rises Sharply

Activity – up; average phishing uptime – down

For starters, the group has discovered that there’s been an increase in global phishing attacks, from 42,674 in the second half of 2010 to 112,472 in the first half of 2011. To anyone following the trends in phishing activity, this isn’t earth-shattering news, but interestingly enough, even though overall activity is on the rise, the average uptime of phishing attacks has dropped significantly. In the first half of 2011, the average uptime of a phishing attack was 54 hours and 37 minutes, compared to an average uptime of 73 hours in the second half of 2010.

“The “uptimes” or “live” times of phishing attacks,” the report states, “are a vital measure of how damaging phishing attacks are, and are a measure of the success of mitigation efforts. The longer a phishing attack remains active, the more money the victims and target institutions lose.”

The report notes that the first 48 hours of a phishing attack are the most critical, as they represent the most lucrative time for the scammers, so quick takedown is an essential component of anti-phishing efforts.

More than a third of attacks involved shared servers

APWG’s report cites the increased use by phishers of shared virtual servers as a primary reason for this.

“Nearly every year we see a new tactic being used by phishers that drastically affects our Statistics,” APWG says, but this year the group has seen “a dramatic rise in what is actually an old tactic, but one that has been obscure until recently.”

As stated, the hacking of servers that host a large number of domains isn’t a new tactic, but the technique employed by the hackers is interesting, to say the least. According to APWG’s findings, the phishers, upon hacking the server, are placing a single copy of their phishing content on the server and then updating the server configuration to include that content in all the domains hosted by the server – effectively, every site on the server now has an infected section that can be accessed via a specific subdirectory.

To wit, the report states, “instead of hacking sites one at a time, the phisher can infect dozens, hundreds, or even thousands of web sites at a time, depending on the server.” The numbers are a tad staggering, according to APWG, which “identified 42,448 unique attacks that utilized this tactic, each using a different domain name. This was 37% of all phishing attacks worldwide.”

Phishers, apparently, have a hankering for Chinese

Perhaps most interesting in the new report is the massive increase in targeted activity by Chinese at Chinese.

“Attacks perpetrated largely by Chinese criminals,” APWG reports, “victimize Chinese Internet users and steal their credentials for Chinese e-commerce and banking sites.”

Attacks increased by 44% over the first half of 2011 and a mind-blowing 70% of malicious domain registrations worldwide were specifically targeted at Chinese institutions in the past six months. While APWG is identifying the source of these phishing attempts as being from China and directed at China, interestingly enough the Chinese phishers are using “free and low-priced” domain providers outside of China.

For whatever reason, the Chinese phishers have chosen to bypass the hacked domain route.

“Unlike most phishers, Chinese phishers do not use many hacked domains. Instead, they continue to register domains, on which they set up their phishing pages. Of the 11,192 domains used in 1H2011, at least 10,179 of them (91%) were maliciously registered, up from 5,895 in 2H2010.”

Interesting stuff this, and well worth the read. There’s more in the report to keep your head spinning, so head on over to APWG’s site and check out the downloadable PDF.

Liked this post? Get more anti-spam related news from AllSpammedUp.com!

APWG: Massive Surge in Phishing Targets Chinese Sites

Facebook was hit with a massive and disturbing spam attack this week. What made it disturbing was its payload. The attack wasn’t meant to sell anything, steal anything or defraud anything. Its sole goal was to disrupt the service and anger and upset its users; and it did just that, by filling newsfeeds with pornographic and gory images. The pornographic images included photoshopped photos of Justin Bieber in sexual situations and the gory ones included everything, from gruesome accident scenes to depictions of animal abuse. The images sparked outrage among Facebook users, most of who lashed out angrily and blamed the site for the problem when they should have been blaming themselves.

That’s right. Facebook’s users are to blame. The site announced in a statement that they had discovered that the attack occurred thanks to users who had copied and pasted code directly into their browser’s address bars. The code then executed and took over the user’s account, tagging them in a variety of disturbing and pornographic images and posting them under that user’s name. According to Facebook they were tricked into doing so with promises of free or deeply discounted laptops. They also announced they had located the people responsible for launching the attack but have not released any further details. One thing we do know is that hacker group Anonymous, which had been previously rumored to be planning an attack on the popular social networking site, was not involved in this one.

I was fortunate in that my newsfeed was only hit with one image from the attack – a shocking photo of a dog whose face had been literally blown off after his owner had shoved lit fireworks into its mouth. It was gruesome and heartbreaking.  If your newsfeed got flooded with disturbing or pornographic images, don’t be angry at Facebook. Instead, make sure you and your friends know to never ever copy and paste code directly into your browser. No legit site will ever ask a user to do so.

Liked this post? Get more anti-spam related news from AllSpammedUp.com!

Anonymous Not Linked to Facebook Spam Attack