CudaMail Blog http://www.cudamail.com/blog/ Anti-Spam and Spam Solution Discussion http://www.CudaMail.com/images/CudaMail-Logo.gif CudaMail Blog http://www.cudamail.com/blog/ en-us Optrics Inc. Wed, 07 May 2008 17:44:12 GMT newtelligence dasBlog 1.9.7174.0 info@CudaMail.com info@CudaMail.com http://www.cudamail.com/blog/Trackback.aspx?guid=79bbe48a-6393-42ff-8efb-d2efd0f47bb3 http://www.cudamail.com/blog/pingback.aspx http://www.cudamail.com/blog/PermaLink,guid,79bbe48a-6393-42ff-8efb-d2efd0f47bb3.aspx Site Admin http://www.cudamail.com/blog/CommentView,guid,79bbe48a-6393-42ff-8efb-d2efd0f47bb3.aspx http://www.cudamail.com/blog/SyndicationService.asmx/GetEntryCommentsRss?guid=79bbe48a-6393-42ff-8efb-d2efd0f47bb3

A funny but O so true write-up from SANS (www.sans.org) on what NOT to do online.

1. Practice Unsafe Surfing. When you purchase a new computer, go online without activating the firewall, or purchasing protective software.

Further expose yourself digitally by sharing a wireless connection with the entire neighborhood. Without digital encryption, you can share the contents of your hard drive with anyone on the street. For maximum risk, do some online banking on a public computer -- like the one at the library or a public cafe. Bonus points are added if your Social Security number is your user ID for any transactions.

What you should really do:
  • Use a hardware firewall at work and at home along with good AV software that is kept up to date.
  • While the desire to go 'Wireless' is high and the products make is so easy take the time to set it up properly or call in an expert to set it up for you.
  • Never do more than just check news stories on some basic searching when on an unknown and thus un-trusted computer be it at the library or even over at your friends house.

2. Skimp on anti-virus and anti-spyware protection. Courting disaster online is easy. Invite malicious code to attack your computer simply by doing nothing. Antivirus programs can be pricey, and the maintenance of constantly downloading updates is time-consuming. Combine that with the security updates from Microsoft or Apple and it's enough to seriously annoy anyone.

What you should really do:

Install a good Anti-Virus solution, most like F-Secure, come in a full protection suite and could be included free with your internet connection (Shaw includes F-Secure for example) Turn on automatic updates in Windows and if your programs can be set to do the same do so. Once a month manually check to ensure your programs are up to date with something like the online F-Secure Health Check or the Secunia Software Inspector. It wouldn't hurt to visit both Windows Update and Office Update while your at it.

3. Passwords are a pain! Make life easy for yourself by using the same password for EVERYTHING, and make it something easy to remember, like your first name or 'password'. Just in case, make sure you write it down on a yellow sticky and put it somewhere easy to see.

And don't forget to have your browser set to 'remember password' to make life easy for you - and the cyber thief.

What you should really do:
  • Use the idea of a password phrase to remember hard to guess passwords. A favorite phrase or poem can become the backbone of a secure password policy.
  • For Example the phrase 'The quick brown fox jumped over the lazy dog' can be used to easily remember a password of 'tqbfjotld'.
  • Make your password harder to guess by throwing in Capitalization, numbers and special characters.
    • If you want to keep things simple then come up with at least three or four secure passwords.
    • The first would be used only for online banking. The second would be used for your e-mail. The third would be used anywhere you have to register to use a site. The fourth could be used for questionable sites that require you to register.

4. Peek at junk email and open attachments from unknown sources. Open attachments from strangers, secret crushes, long-lost friends saying "what's up," or strangers hawking cheap drugs -- you'll never know unless you peek at that email. One of the many fun things that can happen when you open an attachment containing malicious code is infecting your computer with a Trojan horse or virus, which can easily lead to identity theft.

What you should really do:

Use a service like CudaMail to filter out all these unwanted messages. They are either marketing messages or worse, spammers trying to add your computer to their botnet. Stay away from these messages no matter how 'interesting' the spammers make them.

5. Stuff your wallet with juicy identifying tidbits. Wallets and purses are more than just handy cash-carrying devices. They often have credit cards, identification, insurance information and even Social Security cards. Obviously, more is better if you'd like to become the prey of fraudsters.

Losing or misplacing a wallet or purse can cause more problems than just the hassle of replacing all those cards and buying a new bag. Armed with your date of birth, Social Security number and mailing address, there's no limit to the damage thieves could cause.

What you should really do:
  • Keep only what you need in your wallet or purse.
  • The rest of the information should be in a safety deposit box where you can get it if you need it but the rest of the time it is locked away.
  • Check on the personal information the credit bureaus have on you to make sure it is accurate and that someone hasn't signed up for a credit card or something else in your name but using a different address.

6. Make your checks payable to criminals. If you're like most people, you wouldn't post your checking account information on your front door, though you should if you'd like to be a victim of fraud. Similarly, checks reflecting the same information can be dropped casually into unsecured mailboxes. Statistically the chances of your mailbox being targeted by criminal elements are low, but not that low. According to the 2008 Identity Fraud Survey Report from Javelin Strategy and Research, almost 1 in 10 victims of identity theft who can pinpoint the scene of the crime say that it happened at the mailbox.

7. Opt out? Opt in! While you're mailing checks from the unlocked mailbox, go ahead and get credit card companies to send you all the pre-approved offers that the postman can cram into the box. Similarly, don't get credit card statements online; leave them on the side of the road so that they're more convenient for fraudsters who lack the technical knowledge or follow-through to launch complicated hacking schemes.

What you should really do:

Don't use the mailbox by your front door as an outbox just because it is convenient. Take your bills to the bank to pay or drop them off at a real post office. Anything you do get that has your identifying information on it like a pre-filled out credit application should go through a good cross cut paper shredder before leaving your place.

8. Nothing is too good to be true. Everyone wants to feel special and maybe more importantly, filthy rich. When reading an emailed proposition from an African business tycoon, an imperiled prince or downtrodden heiress offering millions of dollars in exchange for some small measure of assistance, it's difficult not to wish it were true. Falling for the story will undoubtedly lead to unpleasantness.

What you should really do:

Don't let your greed get the better of you. While the 'I have umpteen million dollars that I'm trying to sneak out of the country' e-mail's are getting old hat people are still falling for them. What is more insidious is the 'work at home as an agent' e-mail's that make it sound so easy. All you have to do is deposit a check or two each week into your personal bank account and wire transfer the funds to 'the company'. You either end up out the entire amount when the check is returned NSF or you are working for organized crime and are a money launderer.

The internet is a wonder and scary place at the same time. Be educated and play safe.

- Shaun
This weblog is sponsored by CudaMail. Eight Surefire Ways to Become an Identity Theft Victim http://www.cudamail.com/blog/PermaLink,guid,79bbe48a-6393-42ff-8efb-d2efd0f47bb3.aspx http://www.CudaMail.com/blog/2008/05/07/EightSurefireWaysToBecomeAnIdentityTheftVictim.aspx Wed, 07 May 2008 17:44:12 GMT <p> A funny but O so true write-up from SANS (<a href="http://www.sans.org" target=_blank>www.sans.org</a>) on what NOT to do online. </p> <p> <b>1. Practice Unsafe Surfing</b>. When you purchase a new computer, go online without activating the firewall, or purchasing protective software. </p> <p> Further expose yourself digitally by sharing a wireless connection with the entire neighborhood. Without digital encryption, you can share the contents of your hard drive with anyone on the street. For maximum risk, do some online banking on a public computer -- like the one at the library or a public cafe. Bonus points are added if your Social Security number is your user ID for any transactions. </p> <b>What you should really do:</b> <br> <ul> <li> Use a hardware firewall at work and at home along with good AV software that is kept up to date. <li> While the desire to go 'Wireless' is high and the products make is so easy take the time to set it up properly or call in an expert to set it up for you. <li> Never do more than just check news stories on some basic searching when on an unknown and thus un-trusted computer be it at the library or even over at your friends house.</li> </ul> <p> <b>2. Skimp on anti-virus and anti-spyware protection</b>. Courting disaster online is easy. Invite malicious code to attack your computer simply by doing nothing. Antivirus programs can be pricey, and the maintenance of constantly downloading updates is time-consuming. Combine that with the security updates from Microsoft or Apple and it's enough to seriously annoy anyone. </p> <b>What you should really do:</b> <br> <p> Install a good Anti-Virus solution, most like <a href="http://www.optrics.com/f-secure.aspx" target=_blank>F-Secure</a>, come in a full protection suite and could be included free with your internet connection (Shaw includes F-Secure for example) Turn on automatic updates in Windows and if your programs can be set to do the same do so. Once a month manually check to ensure your programs are up to date with something like the online F-Secure Health Check or the Secunia Software Inspector. It wouldn't hurt to visit both Windows Update and Office Update while your at it. </p> <p> <b>3. Passwords are a pain!</b> Make life easy for yourself by using the same password for EVERYTHING, and make it something easy to remember, like your first name or 'password'. Just in case, make sure you write it down on a yellow sticky and put it somewhere easy to see. </p> <p> And don't forget to have your browser set to 'remember password' to make life easy for you - and the cyber thief. </p> <b>What you should really do:</b> <br> <ul> <li> Use the idea of a password phrase to remember hard to guess passwords. A favorite phrase or poem can become the backbone of a secure password policy. <li> For Example the phrase 'The quick brown fox jumped over the lazy dog' can be used to easily remember a password of 'tqbfjotld'. <li> Make your password harder to guess by throwing in Capitalization, numbers and special characters. <ul> <li> If you want to keep things simple then come up with at least three or four secure passwords. <li> The first would be used only for online banking. The second would be used for your e-mail. The third would be used anywhere you have to register to use a site. The fourth could be used for questionable sites that require you to register. </li> </ul> </li> </ul> <p> <b>4. Peek at junk email and open attachments</b> from unknown sources. Open attachments from strangers, secret crushes, long-lost friends saying "what's up," or strangers hawking cheap drugs -- you'll never know unless you peek at that email. One of the many fun things that can happen when you open an attachment containing malicious code is infecting your computer with a Trojan horse or virus, which can easily lead to identity theft. </p> <b>What you should really do:</b> <br> <p> Use a service like <a href="http://www.CudaMail.com" target=_blank>CudaMail</a> <GRIN> to filter out all these unwanted messages. They are either marketing messages or worse, spammers trying to add your computer to their botnet. Stay away from these messages no matter how 'interesting' the spammers make them. </p> <p> <b>5. Stuff your wallet with juicy identifying tidbits</b>. Wallets and purses are more than just handy cash-carrying devices. They often have credit cards, identification, insurance information and even Social Security cards. Obviously, more is better if you'd like to become the prey of fraudsters. </p> <p> Losing or misplacing a wallet or purse can cause more problems than just the hassle of replacing all those cards and buying a new bag. Armed with your date of birth, Social Security number and mailing address, there's no limit to the damage thieves could cause. </p> <b>What you should really do:</b> <br> <ul> <li> Keep only what you need in your wallet or purse. <li> The rest of the information should be in a safety deposit box where you can get it if you need it but the rest of the time it is locked away. <li> Check on the personal information the credit bureaus have on you to make sure it is accurate and that someone hasn't signed up for a credit card or something else in your name but using a different address.</li> </ul> <p> <b>6. Make your checks payable to criminals</b>. If you're like most people, you wouldn't post your checking account information on your front door, though you should if you'd like to be a victim of fraud. Similarly, checks reflecting the same information can be dropped casually into unsecured mailboxes. Statistically the chances of your mailbox being targeted by criminal elements are low, but not that low. According to the 2008 Identity Fraud Survey Report from Javelin Strategy and Research, almost 1 in 10 victims of identity theft who can pinpoint the scene of the crime say that it happened at the mailbox. </p> <p> <b>7. Opt out? Opt in!</b> While you're mailing checks from the unlocked mailbox, go ahead and get credit card companies to send you all the pre-approved offers that the postman can cram into the box. Similarly, don't get credit card statements online; leave them on the side of the road so that they're more convenient for fraudsters who lack the technical knowledge or follow-through to launch complicated hacking schemes. </p> <b>What you should really do:</b> <br> <p> Don't use the mailbox by your front door as an outbox just because it is convenient. Take your bills to the bank to pay or drop them off at a real post office. Anything you do get that has your identifying information on it like a pre-filled out credit application should go through a good cross cut paper shredder before leaving your place. </p> <p> <b>8. Nothing is too good to be true</b>. Everyone wants to feel special and maybe more importantly, filthy rich. When reading an emailed proposition from an African business tycoon, an imperiled prince or downtrodden heiress offering millions of dollars in exchange for some small measure of assistance, it's difficult not to wish it were true. Falling for the story will undoubtedly lead to unpleasantness. </p> <b>What you should really do:</b> <br> <p> Don't let your greed get the better of you. While the 'I have umpteen million dollars that I'm trying to sneak out of the country' e-mail's are getting old hat people are still falling for them. What is more insidious is the 'work at home as an agent' e-mail's that make it sound so easy. All you have to do is deposit a check or two each week into your personal bank account and wire transfer the funds to 'the company'. You either end up out the entire amount when the check is returned NSF or you are working for organized crime and are a money launderer. </p> <p> The internet is a wonder and scary place at the same time. Be educated and play safe. </p> - Shaun ><img width="0" height="0" src="http://www.cudamail.com/blog/aggbug.ashx?id=79bbe48a-6393-42ff-8efb-d2efd0f47bb3" /> <br /> <hr /> This weblog is sponsored by <a href="http://www.CudaMail.com" title="CudaMail Managed Spam Filtering">CudaMail</a>. http://www.cudamail.com/blog/CommentView,guid,79bbe48a-6393-42ff-8efb-d2efd0f47bb3.aspx Anti-Spam CudaMail Identity Theft http://www.cudamail.com/blog/Trackback.aspx?guid=022f26b9-e315-44da-b676-d613bc858518 http://www.cudamail.com/blog/pingback.aspx http://www.cudamail.com/blog/PermaLink,guid,022f26b9-e315-44da-b676-d613bc858518.aspx Scott Young http://www.cudamail.com/blog/CommentView,guid,022f26b9-e315-44da-b676-d613bc858518.aspx http://www.cudamail.com/blog/SyndicationService.asmx/GetEntryCommentsRss?guid=022f26b9-e315-44da-b676-d613bc858518 Mark Hofman Reports a Surge in His Spam - Are You So Lucky? http://www.cudamail.com/blog/PermaLink,guid,022f26b9-e315-44da-b676-d613bc858518.aspx http://www.CudaMail.com/blog/2008/04/28/MarkHofmanReportsASurgeInHisSpamAreYouSoLucky.aspx Mon, 28 Apr 2008 19:51:12 GMT Mark - as the handler on duty at the Internet Storm Center - was nice enough to not only read all his spam for the week (about 2500 messages) but he also put together a nice chart showing what type of spam he was getting and from where:<br> <br> <table class="MsoTableGrid" style="border: medium none ; border-collapse: collapse;" border="1" cellpadding="0" cellspacing="0" height="681" width="521"> <tbody> <tr> <td style="border: 1pt solid black; padding: 0cm 5.4pt; width: 100px;" valign="top"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <strong><span style="font-size: 10pt;">Description<o:p></o:p> </span></strong> </p> </td> <td style="border-style: solid solid solid none; border-color: black black black -moz-use-text-color; border-width: 1pt 1pt 1pt medium; padding: 0cm 5.4pt; width: 191px;" colspan="2" valign="top"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <strong><span style="font-size: 10pt;">Email Origin<o:p></o:p> </span></strong> </p> </td> <td style="border-style: solid solid solid none; border-color: black black black -moz-use-text-color; border-width: 1pt 1pt 1pt medium; padding: 0cm 5.4pt; width: 204px;" valign="top"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <strong><span style="font-size: 10pt;"> <o:p>&nbsp;</o:p> </span></strong> </p> </td> </tr> <tr> <td style="border-style: none solid solid; border-color: -moz-use-text-color; border-width: medium 1pt 1pt; padding: 0cm 5.4pt; width: 100px;" valign="top"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">Greeting card</font> <o:p></o:p> </span> </p> </td> <td style="border-style: none none solid; border-color: -moz-use-text-color; border-width: medium medium 1pt; padding: 0cm 5.4pt; width: 100px;" valign="top"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">Germany</font> <o:p></o:p> </span> </p> </td> <td style="border-style: none solid solid none; border-color: -moz-use-text-color; border-width: medium 1pt 1pt medium; padding: 0cm 5.4pt; width: 59.2pt;" valign="top" width="79"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"> <o:p> <font style="font-size: 9pt;">&nbsp;</font> </o:p> </span> </p> </td> <td style="border-style: none solid solid none; border-color: -moz-use-text-color; border-width: medium 1pt 1pt medium; padding: 0cm 5.4pt; width: 204px;" valign="top"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">URL Link to exe.<span>&nbsp; </span>28/33 AV products detected the file, three days ago it was 4.</font> <o:p></o:p> </span> </p> </td> </tr> <tr> <td style="border-style: none solid solid; border-color: -moz-use-text-color; border-width: medium 1pt 1pt; padding: 0cm 5.4pt; width: 100px;" valign="top"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">Viagra/Cailis Mesages</font></span> </p> </td> <td style="border-style: none none solid; border-color: -moz-use-text-color; border-width: medium medium 1pt; padding: 0cm 5.4pt; width: 100px;" valign="top"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">Texas<br> Latvia<br> Paris<br> Russia<br> Chilli</font> <o:p></o:p> </span> </p> </td> <td style="border-style: none solid solid none; border-color: -moz-use-text-color; border-width: medium 1pt 1pt medium; padding: 0cm 5.4pt; width: 59.2pt;" valign="top" width="79"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">Mount Laurel (US)<br> US<br> Italy<br> Israel</font> <o:p></o:p> </span> </p> </td> <td style="border-style: none solid solid none; border-color: -moz-use-text-color; border-width: medium 1pt 1pt medium; padding: 0cm 5.4pt; width: 204px;" valign="top"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">Links to Canadian Pharmacy web site. </font> <o:p></o:p> </span> </p> </td> </tr> <tr> <td style="border-style: none solid solid; border-color: -moz-use-text-color; border-width: medium 1pt 1pt; padding: 0cm 5.4pt; width: 100px;" valign="top"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">Viagra/Cailis Meds</font> <o:p></o:p> </span> </p> </td> <td style="border-style: none none solid; border-color: -moz-use-text-color; border-width: medium medium 1pt; padding: 0cm 5.4pt; width: 100px;" valign="top"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">France</font> <o:p></o:p> </span> </p> </td> <td style="border-style: none solid solid none; border-color: -moz-use-text-color; border-width: medium 1pt 1pt medium; padding: 0cm 5.4pt; width: 59.2pt;" valign="top" width="79"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"> <o:p> <font style="font-size: 9pt;">&nbsp;</font> </o:p> </span> </p> </td> <td style="border-style: none solid solid none; border-color: -moz-use-text-color; border-width: medium 1pt 1pt medium; padding: 0cm 5.4pt; width: 204px;" valign="top"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">Web Site Canadian Healthcare</font> <o:p></o:p> </span> </p> </td> </tr> <tr> <td style="border-style: none solid solid; border-color: -moz-use-text-color; border-width: medium 1pt 1pt; padding: 0cm 5.4pt; width: 100px;" valign="top"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">Movie downloads </font><span style="font-size: 8pt; font-family: 'Arial','sans-serif';"> <o:p></o:p> </span><font style="font-size: 9pt;"> <br> (in Chinese)</font> <o:p></o:p> </span> </p> </td> <td style="border-style: none none solid; border-color: -moz-use-text-color; border-width: medium medium 1pt; padding: 0cm 5.4pt; width: 100px;" valign="top"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">Argentina</font> <o:p></o:p> </span> </p> </td> <td style="border-style: none solid solid none; border-color: -moz-use-text-color; border-width: medium 1pt 1pt medium; padding: 0cm 5.4pt; width: 59.2pt;" valign="top" width="79"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"> <o:p> <font style="font-size: 9pt;">&nbsp;</font> </o:p> </span> </p> </td> <td style="border-style: none solid solid none; border-color: -moz-use-text-color; border-width: medium 1pt 1pt medium; padding: 0cm 5.4pt; width: 204px;" valign="top"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">Nothing no links and nothing nasty, maybe a trial run.</font> <o:p></o:p> </span> </p> </td> </tr> <tr> <td style="border-style: none solid solid; border-color: -moz-use-text-color; border-width: medium 1pt 1pt; padding: 0cm 5.4pt; width: 100px;" valign="top"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">Herbal remedies </font> <o:p></o:p> </span> </p> </td> <td style="border-style: none none solid; border-color: -moz-use-text-color; border-width: medium medium 1pt; padding: 0cm 5.4pt; width: 100px;" valign="top"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">USA</font><span style="font-size: 8pt; font-family: 'Arial','sans-serif';"> <o:p></o:p> </span><font style="font-size: 9pt;"> <br> Germany</font> <o:p></o:p> </span><span style="font-size: 9pt; font-family: 'Arial','sans-serif';"><span style="font-family: 'Arial','sans-serif';"> <br> Sweden</span> <o:p></o:p> </span> </p> </td> <td style="border-style: none solid solid none; border-color: -moz-use-text-color; border-width: medium 1pt 1pt medium; padding: 0cm 5.4pt; width: 59.2pt;" valign="top" width="79"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">Oman</font><span style="font-size: 8pt; font-family: 'Arial','sans-serif';"> <o:p></o:p> </span><font style="font-size: 9pt;"> <br> Lithuania</font> <o:p></o:p> </span><span style="font-size: 9pt; font-family: 'Arial','sans-serif';"> <br> Brazil<o:p></o:p> </span> </p> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"> <o:p> <font style="font-size: 9pt;">&nbsp;</font> </o:p> </span> </p> </td> <td style="border-style: none solid solid none; border-color: -moz-use-text-color; border-width: medium 1pt 1pt medium; padding: 0cm 5.4pt; width: 204px;" valign="top"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">Products to enlarge body parts.</font> <o:p></o:p> </span> </p> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">The message contained a URL to one of three sites hosted in the same address range. </font> <o:p></o:p> </span> </p> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">The registrar owns 695 other domains, received 50 of them.</font> <o:p></o:p> </span> </p> </td> </tr> <tr> <td style="border-style: none solid solid; border-color: -moz-use-text-color; border-width: medium 1pt 1pt; padding: 0cm 5.4pt; width: 100px;" valign="top"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">Lottery*</font> <o:p></o:p> </span> </p> </td> <td style="border-style: none none solid; border-color: -moz-use-text-color; border-width: medium medium 1pt; padding: 0cm 5.4pt; width: 100px;" valign="top"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">UK </font><span style="font-size: 8pt; font-family: 'Arial','sans-serif';"> <o:p></o:p> </span><font style="font-size: 9pt;"> <br> Canada</font> <o:p></o:p> </span><span style="font-size: 9pt; font-family: 'Arial','sans-serif';"> <br> Greece<o:p></o:p> </span> </p> </td> <td style="border-style: none solid solid none; border-color: -moz-use-text-color; border-width: medium 1pt 1pt medium; padding: 0cm 5.4pt; width: 59.2pt;" valign="top" width="79"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"> <o:p> <font style="font-size: 9pt;">&nbsp;</font> </o:p> </span> </p> </td> <td style="border-style: none solid solid none; border-color: -moz-use-text-color; border-width: medium 1pt 1pt medium; padding: 0cm 5.4pt; width: 204px;" valign="top"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">So far this week I have won<span>&nbsp; </span>about $500,000,000, not bad for not entering any lotteries.<span>&nbsp;&nbsp; </span>The majority were sent from UK machines, machines at one particular facility.</font> <o:p></o:p> </span> </p> </td> </tr> <tr> <td style="border-style: none solid solid; border-color: -moz-use-text-color; border-width: medium 1pt 1pt; padding: 0cm 5.4pt; width: 100px;" valign="top"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">Click Fraud</font> <o:p></o:p> </span> </p> </td> <td style="border-style: none none solid; border-color: -moz-use-text-color; border-width: medium medium 1pt; padding: 0cm 5.4pt; width: 100px;" valign="top"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">Spain</font><span style="font-size: 8pt; font-family: 'Arial','sans-serif';"> <o:p></o:p> </span><font style="font-size: 9pt;"> <br> Bolivia</font> <o:p></o:p> </span><span style="font-size: 9pt; font-family: 'Arial','sans-serif';"> <br> Poland<o:p></o:p> </span> </p> </td> <td style="border-style: none solid solid none; border-color: -moz-use-text-color; border-width: medium 1pt 1pt medium; padding: 0cm 5.4pt; width: 59.2pt;" valign="top" width="79"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"> <o:p> <font style="font-size: 9pt;">&nbsp;</font> </o:p> </span> </p> </td> <td style="border-style: none solid solid none; border-color: -moz-use-text-color; border-width: medium 1pt 1pt medium; padding: 0cm 5.4pt; width: 204px;" valign="top"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">The links in the message are ad click redirects. </font> <o:p></o:p> </span> </p> </td> </tr> <tr> <td style="border-style: none solid solid; border-color: -moz-use-text-color; border-width: medium 1pt 1pt; padding: 0cm 5.4pt; width: 100px;" valign="top"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">Paypal</font> <o:p></o:p> </span> </p> </td> <td style="border-style: none none solid; border-color: -moz-use-text-color; border-width: medium medium 1pt; padding: 0cm 5.4pt; width: 100px;" valign="top"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">US</font> <o:p></o:p> </span> </p> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">France</font> <o:p></o:p> </span> </p> </td> <td style="border-style: none solid solid none; border-color: -moz-use-text-color; border-width: medium 1pt 1pt medium; padding: 0cm 5.4pt; width: 59.2pt;" valign="top" width="79"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"> <o:p> <font style="font-size: 9pt;">&nbsp;</font> </o:p> </span> </p> </td> <td style="border-style: none solid solid none; border-color: -moz-use-text-color; border-width: medium 1pt 1pt medium; padding: 0cm 5.4pt; width: 204px;" valign="top"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">The usual phishing exercise aimed at extracting account information. </font> <o:p></o:p> </span> </p> </td> </tr> <tr> <td style="border-style: none solid solid; border-color: -moz-use-text-color; border-width: medium 1pt 1pt; padding: 0cm 5.4pt; width: 100px;" valign="top"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">I am Lonely Tonight</font> <o:p></o:p> </span> </p> </td> <td style="border-style: none none solid; border-color: -moz-use-text-color; border-width: medium medium 1pt; padding: 0cm 5.4pt; width: 100px;" valign="top"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">Turkey</font> <o:p></o:p> </span> </p> </td> <td style="border-style: none solid solid none; border-color: -moz-use-text-color; border-width: medium 1pt 1pt medium; padding: 0cm 5.4pt; width: 59.2pt;" valign="top" width="79"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"> <o:p> <font style="font-size: 9pt;">&nbsp;</font> </o:p> </span> </p> </td> <td style="border-style: none solid solid none; border-color: -moz-use-text-color; border-width: medium 1pt 1pt medium; padding: 0cm 5.4pt; width: 204px;" valign="top"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">The usual I’m lonely tonight emails.<span>&nbsp; </span>If you respond it goes into how she wants to travel and can’t you help her out. </font><span><font style="font-size: 9pt;">&nbsp;</font></span> <o:p></o:p> </span> </p> </td> </tr> <tr> <td style="border-style: none solid solid; border-color: -moz-use-text-color; border-width: medium 1pt 1pt; padding: 0cm 5.4pt; width: 100px;" valign="top"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">Fake Goods</font> <o:p></o:p> </span> </p> </td> <td style="border-style: none none solid; border-color: -moz-use-text-color; border-width: medium medium 1pt; padding: 0cm 5.4pt; width: 100px;" valign="top"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">Bombay</font><span style="font-size: 8pt; font-family: 'Arial','sans-serif';"> <o:p></o:p> </span><font style="font-size: 9pt;"> <br> Russia</font> <o:p></o:p> <font style="font-size: 9pt;"> <br> Bahrain </font><span style="font-size: 8pt; font-family: 'Arial','sans-serif';"> <o:p></o:p> </span><font style="font-size: 9pt;"> <br> Greece</font> <o:p></o:p> </span><span style="font-size: 8pt; font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;"> <br> Italy</font> <o:p></o:p> </span> </p> </td> <td style="border-style: none solid solid none; border-color: -moz-use-text-color; border-width: medium 1pt 1pt medium; padding: 0cm 5.4pt; width: 59.2pt;" valign="top" width="79"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">Turkey</font> <o:p></o:p> <font style="font-size: 9pt;"> <br> Slovak Republic</font> <o:p></o:p> </span> </p> <pre><span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">Thailand</font> <o:p></o:p> </span></pre> </td> <td style="border-style: none solid solid none; border-color: -moz-use-text-color; border-width: medium 1pt 1pt medium; padding: 0cm 5.4pt; width: 204px;" valign="top"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">Fake goods, watches, bags, etc.</font><span><font style="font-size: 9pt;">&nbsp; </font></span> <o:p></o:p> </span> </p> </td> </tr> <tr> <td style="border-style: none solid solid; border-color: -moz-use-text-color; border-width: medium 1pt 1pt; padding: 0cm 5.4pt; width: 100px;" valign="top"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">Business Proposal (419 messages)</font> <o:p></o:p> </span> </p> </td> <td style="border-style: none none solid; border-color: -moz-use-text-color; border-width: medium medium 1pt; padding: 0cm 5.4pt; width: 100px;" valign="top"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">US<br> Germany<br> Los Angeles</font></span><font style="font-size: 9pt;"> <br> </font><span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">United Arab </font> <o:p></o:p> </span> </p> </td> <td style="border-style: none solid solid none; border-color: -moz-use-text-color; border-width: medium 1pt 1pt medium; padding: 0cm 5.4pt; width: 59.2pt;" valign="top" width="79"> <pre><span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">Emirates</font> <o:p></o:p> </span></pre> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">The Netherlands</font><span style="font-size: 8pt; font-family: 'Arial','sans-serif';"> <o:p></o:p> </span><font style="font-size: 9pt;"> <br> Japan</font> <o:p></o:p> </span> </p> </td> <td style="border-style: none solid solid none; border-color: -moz-use-text-color; border-width: medium 1pt 1pt medium; padding: 0cm 5.4pt; width: 204px;" valign="top"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">Transfer money and get a percentage. </font> <o:p></o:p> </span> </p> </td> </tr> <tr> <td style="border-style: none solid solid; border-color: -moz-use-text-color; border-width: medium 1pt 1pt; padding: 0cm 5.4pt; width: 100px;" valign="top"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">Work offers</font> <o:p></o:p> </span> </p> </td> <td style="border-style: none none solid; border-color: -moz-use-text-color; border-width: medium medium 1pt; padding: 0cm 5.4pt; width: 100px;" valign="top"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">Belgium</font> <o:p></o:p> </span> </p> </td> <td style="border-style: none solid solid none; border-color: -moz-use-text-color; border-width: medium 1pt 1pt medium; padding: 0cm 5.4pt; width: 59.2pt;" valign="top" width="79"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"> <o:p> <font style="font-size: 9pt;">&nbsp;</font> </o:p> </span> </p> </td> <td style="border-style: none solid solid none; border-color: -moz-use-text-color; border-width: medium 1pt 1pt medium; padding: 0cm 5.4pt; width: 204px;" valign="top"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">Work for a few hours per week and make thousands,<span>&nbsp; </span>most of these linked to professional looking sites.<span>&nbsp;&nbsp; </span>Typically they are recruiting for mules. </font> <o:p></o:p> </span> </p> </td> </tr> <tr> <td style="border-style: none solid solid; border-color: -moz-use-text-color; border-width: medium 1pt 1pt; padding: 0cm 5.4pt; width: 100px;" valign="top"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">Threats</font> <o:p></o:p> </span> </p> </td> <td style="border-style: none none solid; border-color: -moz-use-text-color; border-width: medium medium 1pt; padding: 0cm 5.4pt; width: 100px;" valign="top"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">Turkey</font></span> </p> </td> <td style="border-style: none solid solid none; border-color: -moz-use-text-color; border-width: medium 1pt 1pt medium; padding: 0cm 5.4pt; width: 59.2pt;" valign="top" width="79"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">Russia</font> <o:p></o:p> </span> </p> </td> <td style="border-style: none solid solid none; border-color: -moz-use-text-color; border-width: medium 1pt 1pt medium; padding: 0cm 5.4pt; width: 204px;" valign="top"> <p class="MsoNormal" style="margin-bottom: 0pt; line-height: normal;"> <span style="font-family: 'Arial','sans-serif';"><font style="font-size: 9pt;">There have been a few variants of these doing the rounds.</font></span> </p> </td> </tr> </tbody> </table> <br> <blockquote>&gt; Source: <a href="http://isc.sans.org/diary.html?storyid=4343">http://isc.sans.org/diary.html?storyid=4343</a> <br> </blockquote> <br> This is a lot of work that Mark has gone through but it does highlight the value of good metrics or ways of gauging how effective an anti-spam system is. <br> <br> Here at the <a href="http://www.CudaMail.com">CudaMail</a> support desk we occasionally get a client who at first is very upset that they got 5 spam messages in their inbox this morning and can't we do something about it? They are usually very thankful when we provide them with a report similar to the one below for their domain showing that tens of thousands of messages have already been blocked for them and these 5 messages are the start of a new campaign that they were lucky enough to get the first few messages from and now that they have provided us with some samples to work with we can stop this campaign in it's tracks too.<br> <br> <i>Sample CudaMail Spam Quarantine Summary</i> <br> <br> <div align="center"><img src="http://www.cudamail.com/blog/content/binary/SampleCudaMailReport1.JPG" border="0"> <br> </div> <br> <div align="center">&gt; Click <a href="http://www.cudamail.com/blog/content/binary/CudaMail_Summary_for_Domain.pdf">CudaMail_Summary_for_Domain.pdf (12.76 KB)</a> for to download the PDF sample<br> </div> <br> This also highlights the different perceptions we have as anti-spam specialists and the typical end-user or client. From our perspective we are fighting the good fight and our efforts are winning the war on spam. We block millions of messages a day and allow only a few 10's of thousands to be delivered to the client. Typical statistics are that on average 97 out of every 100 messages are spam and this is with a very low false positive rate (false positive = marking a wanted message as spam).<br> <br> <b>What is The Customer's Perspective On The Same Volume of Messages? </b> <br> <br> They are going about their important work without being bothered by those 97 out of 100 messages that are spam so when a few messages slip through to them all of a sudden they are being "flooded" with spam. Same numbers but a very different perspective on the issue.<br> <br> <b>What Can You - the CudaMail End-User - Do to Help Out? </b> <br> <br> 1. <i>Keep us in the loop</i>. "One person's spam is another person's ham" as the saying goes so we don't know what you did or did not sign up for online. We maintain a number of spam traps and are always looking for new spam messages but may not be first in line when a spammer fires up his money making spam bot and sends out the latest surge. So if you are the lucky one to be fist on the spammers list and get a spam sample there are two very good ways to provide this feedback to CudaMail support. <br> <br> 2. <i>Install and use the Outlook plug-in.</i> For those of you who use Microsoft Office with the full Outlook e-mail client the Plug-in is the easiest way to send spam samples back to CudaMail support and we have <a href="http://www.cudamail.com/blog/2008/02/28/WhatIsTheBarracudaCudaMailOutlookPluginHowDoIUseItToReduceTheLevelOfSPAMIGet.aspx">blogged</a> about this before. There are plug-ins available now for other e-mail clients (Thunderbird 2.x and Lotus Notes 6.5, 7 and 8) but these are under going beta testing right now.<br> <br> You can read me Blog post about it by going <a href="http://www.cudamail.com/blog/2008/02/28/WhatIsTheBarracudaCudaMailOutlookPluginHowDoIUseItToReduceTheLevelOfSPAMIGet.aspx">here</a>:<br> <br> <br> 3. <i>Debug-ID</i>. For those who don't run Outlook or don't want to run a beta plug-in you can simply forward just the Debug-ID of the unwanted messages to the <a href="mailto:support@CudaMail.com">support@CudaMail.com</a> address. <br> <br> A quick 'How to display full headers in client x' can be found at the following URL:<br> <ul> <li> <a href="http://oit.nd.edu/email/fullheaders.shtml">http://oit.nd.edu/email/fullheaders.shtml</a> </li> </ul> While support only needs the one line with the X-ASG-Debug-ID: number on it go ahead and forward all the information in the full headers on to us. What you do not want to do is forward the spam message body along with the full headers. What happens more often than not is that the CudaMail system will take your spam sample re-processes it and block it before it gets to support. We don't know that you were trying to send us this sample and can't do any thing about it because we didn't get it in the first place. Now typically we don't respond to every message providing a spam sample but we do review each and every one of them and make sure that he system will block them in the future.<br> <br> With the above two thoughts in mind - perspective and feedback - what do you - the CudaMail client - want to see from the CudaMail system? Do you want to be sent reports on a regular basis (Daily, Weekly or Monthly) or will this just add to your information overload?<br> <br> We look forward to hearing from your either in the comments below or direct to <a href="mailto:support@CudaMail.com">support@CudaMail.com</a>.<br> <br> - Shaun<br> <p> </p> <img width="0" height="0" src="http://www.cudamail.com/blog/aggbug.ashx?id=022f26b9-e315-44da-b676-d613bc858518" /> <br /> <hr /> This weblog is sponsored by <a href="http://www.CudaMail.com" title="CudaMail Managed Spam Filtering">CudaMail</a>. http://www.cudamail.com/blog/CommentView,guid,022f26b9-e315-44da-b676-d613bc858518.aspx Anti-Spam CudaMail False Spam Outlook Plug-In Spam Filtering Service http://www.cudamail.com/blog/Trackback.aspx?guid=7e42f257-e208-4de0-8c78-3670e357c4eb http://www.cudamail.com/blog/pingback.aspx http://www.cudamail.com/blog/PermaLink,guid,7e42f257-e208-4de0-8c78-3670e357c4eb.aspx Scott Young http://www.cudamail.com/blog/CommentView,guid,7e42f257-e208-4de0-8c78-3670e357c4eb.aspx http://www.cudamail.com/blog/SyndicationService.asmx/GetEntryCommentsRss?guid=7e42f257-e208-4de0-8c78-3670e357c4eb Spammers are continuing to use the oldest trick in the book - social engineering - to try to get you to be part of their plan. The US CERT (Computer Emergency Readiness Team) has released a number of advisories over the last few weeks on recent Spammer tricks of impersonating someone trusted like the tax department or a trusted news source to get you to click on a one of their web links.

Here are some recent samples:

IRS Rebate Phishing Scam
Federal Subpoena Spear-Phishing Attack
Radiation Leak - from a trusted news source
The text included with the links the Spammers send may make your pulse race (I can get my Tax rebate now!) and thus they try to get the emotional part of you to take control of your mouse before the logical part of your brain (This sounds fishy - better be safe and delete this message or call them direct to confirm) kicks in.

Guess what? - By clicking on the link you played right into the Spammer's plan and you either filled in a form (Phishing) and gave them information they can use to steal your identity or money or your computer got infected and is now playing it's part in sending out Spam.

How do you keep yourself safe while on the Internet?

Install and use a good anti-virus / anti-malware product and keep it up to date.

Take the time - once in a month at least - to do a full update for security patches and then do a full anti-virus / anti-malware scan of your computer.

Use some reputable online scans to double check on your Anti-Virus.

F-Secure Health Check Online scanner
  • www.f-secure.com/healthcheck/
Panda Active Scan
  • www.pandasecurity.com/canada-eng/homeusers/solutions/activescan/default.htm?track=80383
Kaspersky

Secunia's Online Scanner (checks to confirm your software is up-to-date)
(Warning - These companies use these online services to try and sell you on their products - you may have to provide an e-mail address to start one or more of these services so you may get marketing related messages after using these services)

At work you will want to use a higher-end firewall (such as a firewall from Fortinet or Secure Computing) or a dedicated web filter appliance (from Barracuda Networks) with a second layer of anti-virus / anti-malware / web content filtering between your computers and the Internet.

Spammers are the problem but we have to do our best to be part of the solution!

- Shaun

This weblog is sponsored by CudaMail. Spammers Take Advantage of the Tax Season http://www.cudamail.com/blog/PermaLink,guid,7e42f257-e208-4de0-8c78-3670e357c4eb.aspx http://www.CudaMail.com/blog/2008/04/25/SpammersTakeAdvantageOfTheTaxSeason.aspx Fri, 25 Apr 2008 21:47:58 GMT Spammers are continuing to use the oldest trick in the book - social engineering - to try to get you to be part of their plan. The US CERT (<u>C</u>omputer <u>E</u>mergency <u>R</u>eadiness <u>T</u>eam) has released a number of advisories over the last few weeks on recent Spammer tricks of impersonating someone trusted like the tax department or a trusted news source to get you to click on a one of their web links.<br> <br> <u><b>Here are some recent samples:</b></u> <br> <br> <b>IRS Rebate Phishing Scam</b> <br> <ul> <li> <a href="http://www.us-cert.gov/current/archive/2008/04/25/archive.html#irs_rebate_phishing_scam">www.us-cert.gov/current/archive/2008/04/25/archive.html#irs_rebate_phishing_scam</a> </li> <li> <a href="http://www.us-cert.gov/current/archive/2008/03/31/archive.html#internal_revenue_service_tax_scams">www.us-cert.gov/current/archive/2008/03/31/archive.html#internal_revenue_service_tax_scams</a> <br> </li> </ul> <b><font color="#000000">Federal Subpoena Spear-Phishing Attack</font></b> <br> <ul> <li> <a href="http://www.us-cert.gov/current/archive/2008/04/25/archive.html#federal_subpoena_email_scam">www.us-cert.gov/current/archive/2008/04/25/archive.html#federal_subpoena_email_scam</a> </li> </ul> <b>Radiation Leak - from a trusted news source</b> <br> <ul> <li> <a href="http://www.us-cert.gov/current/archive/2008/04/11/archive.html#email_attack_circulating">www.us-cert.gov/current/archive/2008/04/11/archive.html#email_attack_circulating</a> </li> </ul> The text included with the links the Spammers send may make your pulse race (I can get my Tax rebate now!) and thus they try to get the emotional part of you to take control of your mouse before the logical part of your brain (This sounds fishy - better be safe and delete this message or call them direct to confirm) kicks in.<br> <br> <i><b>Guess what</b><b>?</b></i> - By clicking on the link you played right into the Spammer's plan and you either filled in a form (Phishing) and gave them information they can use to steal your identity or money or your computer got infected and is now playing it's part in sending out Spam. <br> <br> <u><b>How do you keep yourself safe while on the Internet?</b></u> <br> <br> Install and use a good anti-virus / anti-malware product and keep it up to date.<br> <br> Take the time - once in a month at least - to do a full update for security patches and then do a full anti-virus / anti-malware scan of your computer.<br> <br> Use some reputable online scans to double check on your Anti-Virus.<br> <br> <b>F-Secure Health Check Online scanner</b> <br> <ul> <li> www.f-secure.com/healthcheck/</li> </ul> <b>Panda Active Scan</b> <br> <ul> <li> www.pandasecurity.com/canada-eng/homeusers/solutions/activescan/default.htm?track=80383</li> </ul> <b>Kaspersky</b> <br> <ul> <li> <a href="http://usa.kaspersky.com/products_services/free-virus-scanner.php">http://usa.kaspersky.com/products_services/free-virus-scanner.php</a> </li> </ul> <br> <b>Secunia's Online Scanner (checks to confirm your software is up-to-date)</b> <br> <ul> <li> <a href="http://secunia.com/software_inspector/">http://secunia.com/software_inspector/</a> </li> </ul> (<i>Warning</i> - These companies use these online services to try and sell you on their products - you may have to provide an e-mail address to start one or more of these services so you may get marketing related messages after using these services)<br> <br> At work you will want to use a higher-end firewall (such as a firewall from <a href="http://www.firewallshop.com/fortinet.aspx">Fortinet</a> or <a href="http://www.firewallshop.com/secure-computing.aspx">Secure Computing</a>) or a dedicated web filter appliance (from <a href="http://www.barracudanetworks.ca/website-firewall.aspx">Barracuda Networks</a>) with a second layer of anti-virus / anti-malware / web content filtering between your computers and the Internet.<br> <p> </p> Spammers are the problem but we have to do our best to be part of the solution!<br> <br> - Shaun<br> <img width="0" height="0" src="http://www.cudamail.com/blog/aggbug.ashx?id=7e42f257-e208-4de0-8c78-3670e357c4eb" /> <br /> <hr /> This weblog is sponsored by <a href="http://www.CudaMail.com" title="CudaMail Managed Spam Filtering">CudaMail</a>. http://www.cudamail.com/blog/CommentView,guid,7e42f257-e208-4de0-8c78-3670e357c4eb.aspx Barracuda Networks Fortinet Secure Computing Spam Filtering Service http://www.cudamail.com/blog/Trackback.aspx?guid=3d14b5be-41c4-465a-b39d-3a0f136048e4 http://www.cudamail.com/blog/pingback.aspx http://www.cudamail.com/blog/PermaLink,guid,3d14b5be-41c4-465a-b39d-3a0f136048e4.aspx Scott Young http://www.cudamail.com/blog/CommentView,guid,3d14b5be-41c4-465a-b39d-3a0f136048e4.aspx http://www.cudamail.com/blog/SyndicationService.asmx/GetEntryCommentsRss?guid=3d14b5be-41c4-465a-b39d-3a0f136048e4 New figures suggest that 92.3 percent of all email sent globally during the first three months of 2008 was Spam1 and a second report indicates that the top botnets, if they worked together, are capable of sending over 100 billion Spam emails per day2.

The data from Sophos also indicated that 23,300 new Spam-related web pages were created every day during the period, or one about every three seconds.

Each and every one of these 2.1 Million URL's has to be discovered and added to the 'Intent' or URL database to be able to block them all, and you wonder why a few slip through the cracks?

Building a botnet first and then building 2.1 million web pages is a lot of effort to go through to send Spam touting the 'generic blue pill' or the latest 'real genuine copy' of the latest trendy fashion item be it a 'Designer Shoes Collection from Gucci Ugg Prada Chanel Dsquared' or other.

So Why Do Spammers Go To So Much Effort?

A recent National Geographic special called Illicit: The Dark Trade revealed the impact that all of these "knock-off" drugs, clothing, and accessories is having on the world (definitely worth watching). I didn't realize that the trade in counterfeit goods is a 600 Billion Dollar (USD) a year - yes that's a B, Billion - industry3 and a lot of it is done by international crime rings.

If they get caught for a counterfeit purse or shoe the sentence they get is a lot lighter than if they were trying to sell illegal drugs but it is the same people that do both and for the same reasons - to take advantage of you and your desire for a deal. The special also showed that counterfeit goods are more than just the 'real fake watches' as everything from toothpaste, mouthwash, generic drugs, automotive and airplane parts are being counterfeited as well. You think that 'blue pill' you bought online for such a deal was the real thing? Think again - it probably contained Borax bleach, chalk and paint - if you're lucky!

It has often been said that if people just stopped buying from the Spammers then there would be no financial incentive for them to send their Spam emails.

Let's try this statement on for size - if you purchase something promoted by a Spam message that sounds too good to be true - it is likely a counterfeit item and you are directly contributing to organized crime and terrorism.

Now go out there and play safe.

- Shaun

1www.itnews.com.au/News/74071,new-spam-site-found-every-three-seconds.aspx

2www.secureworks.com/research/threats/topbotnets/?threat=topbotnets

3www.iacc.org/counterfeiting/counterfeiting.php


This weblog is sponsored by CudaMail. Are Anti-SPAM Solutions Failing or Are There Simply More Barbarians at the Gate? http://www.cudamail.com/blog/PermaLink,guid,3d14b5be-41c4-465a-b39d-3a0f136048e4.aspx http://www.CudaMail.com/blog/2008/04/18/AreAntiSPAMSolutionsFailingOrAreThereSimplyMoreBarbariansAtTheGate.aspx Fri, 18 Apr 2008 15:06:46 GMT New figures suggest that 92.3 percent of all email sent globally during the first three months of 2008 was Spam<sup>1</sup> and a second report indicates that the top botnets, if they worked together, are capable of sending over 100 billion Spam emails per day<sup>2</sup>.<br> <br> The data from Sophos also indicated that 23,300 new Spam-related web pages were created every day during the period, or one about every three seconds.<br> <br> Each and every one of these 2.1 Million URL's has to be discovered and added to the 'Intent' or URL database to be able to block them all, and you wonder why a few slip through the cracks?<br> <br> Building a botnet first and then building 2.1 million web pages is a lot of effort to go through to send Spam touting the 'generic blue pill' or the latest 'real genuine copy' of the latest trendy fashion item be it a 'Designer Shoes Collection from Gucci Ugg Prada Chanel Dsquared' or other. <br> <br> <b>So Why Do Spammers Go To So Much Effort? </b> <br> <br> A recent <a href="http://www.pbs.org/illicit/" target="_blank">National Geographic</a> special called <a href="http://www.pbs.org/illicit/" target="_blank">Illicit: The Dark Trade</a> revealed the impact that all of these "knock-off" drugs, clothing, and accessories is having on the world (definitely worth watching). I didn't realize that the trade in counterfeit goods is a 600 Billion Dollar (USD) a year - yes that's a B, Billion - industry<sup>3</sup> and a lot of it is done by international crime rings. <br> <br> If they get caught for a counterfeit purse or shoe the sentence they get is a lot lighter than if they were trying to sell illegal drugs but it is the same people that do both and for the same reasons - to take advantage of you and your desire for a deal. The special also showed that counterfeit goods are more than just the 'real fake watches' as everything from toothpaste, mouthwash, generic drugs, automotive and airplane parts are being counterfeited as well. You think that 'blue pill' you bought online for such a deal was the real thing? Think again - it probably contained Borax bleach, chalk and paint - if you're lucky!<br> <br> It has often been said that if people just stopped buying from the Spammers then there would be no financial incentive for them to send their Spam emails.<br> <br> Let's try this statement on for size - if you purchase something promoted by a Spam message that sounds too good to be true - it is likely a counterfeit item and you are directly contributing to organized crime and terrorism. <br> <br> Now go out there and play safe.<br> <br> - Shaun<br> <br> <sup>1</sup> <a href="http://www.itnews.com.au/News/74071,new-spam-site-found-every-three-seconds.aspx" target="_blank">www.itnews.com.au/News/74071,new-spam-site-found-every-three-seconds.aspx </a> <br> <br> <sup>2</sup> <a href="http://www.secureworks.com/research/threats/topbotnets/?threat=topbotnets" target="_blank">www.secureworks.com/research/threats/topbotnets/?threat=topbotnets</a> <br> <br> <sup>3</sup> <a href="http://www.iacc.org/counterfeiting/counterfeiting.php" target="_blank">www.iacc.org/counterfeiting/counterfeiting.php</a> <br> <br> <p> </p> <img width="0" height="0" src="http://www.cudamail.com/blog/aggbug.ashx?id=3d14b5be-41c4-465a-b39d-3a0f136048e4" /> <br /> <hr /> This weblog is sponsored by <a href="http://www.CudaMail.com" title="CudaMail Managed Spam Filtering">CudaMail</a>. http://www.cudamail.com/blog/CommentView,guid,3d14b5be-41c4-465a-b39d-3a0f136048e4.aspx Black Market Illicit Trade National Geographic Sophos Spam Filtering Service Threats http://www.cudamail.com/blog/Trackback.aspx?guid=780855d2-bcb3-4ebd-abd2-c87dbe050246 http://www.cudamail.com/blog/pingback.aspx http://www.cudamail.com/blog/PermaLink,guid,780855d2-bcb3-4ebd-abd2-c87dbe050246.aspx Scott Young http://www.cudamail.com/blog/CommentView,guid,780855d2-bcb3-4ebd-abd2-c87dbe050246.aspx http://www.cudamail.com/blog/SyndicationService.asmx/GetEntryCommentsRss?guid=780855d2-bcb3-4ebd-abd2-c87dbe050246 According to John Leyden (from "The Register") in his article "Security gumshoes locate source of mystery web compromise", the source of the mystery injection of more than 10,000 websites back in January has been uncovered!

He says:

"Thousands of legitimate websites were compromised at the start of the year to serve up malware, as we reported at the time.

It seemed that the exploitation of SQL Injection vulnerabilities was involved in the automated attacks. The precise mechanism was unclear until earlier this week when security researchers discovered a malicious executable later linked to the attack on a hacker site.

The hacker utility used search engines to find insecure websites that it then tried to exploit using an SQL injection attack. The exploit included an SQL statement that tried to inject a script tag into every HTML page on the website.

The tool - which had an interface written in Chinese - was programmed by default to insert a tag to the same malicious JavaScript file that featured in the January attack, solid evidence that it was at least partially behind the assault.

The tool runs a script called pay.asp, hosted on a server in China. This suggests that hackers running the attack were keeping count of the number of sites they had compromised, in order to work out how much they stand to get paid.

Further analysis of the tool by security researchers at the SANS Institute's Internet Storm Centre (ISC) is ongoing. The tool came to their attention via a tip-off from Dr Neal Krawetz. The initial attack was uncovered by security researcher Mary Landesman, of ScanSafe, who described it as the time as a new type of compromise.

The constant, changing flux of the malicious JavaScript served up by compromised sites made initial analysis difficult. With the benefit of the hacker tool used to pull off the attack this all becomes much clearer, much like it was easier for scientists to unravel a cure for the mystery pandemic that blighted mankind in the Twelve Monkies after they obtained a sample of the pure source.

"The nice thing about this is that we finally managed to confirm that it is SQL Injection that was used in those attacks. The tool has more functionality that we still have to analyze but this is the main purpose," writes ISC handler Bojan Zdrnja.

Website owners ought to use the discovery as a wake up call on the need to ensure that their web applications are secure, he added."

If you are worried about SQL injection and other attacks on your website then you should take a look at Barracuda Network's newest solution called the Website Firewall. For more information or to arrange for an eval unit please visit: www.BarracudaNetworks.ca/Searchresult.aspx?CategoryID=74.


This weblog is sponsored by CudaMail. The Register - "Security Gumshoes Locate Source of Mystery Web Compromise" http://www.cudamail.com/blog/PermaLink,guid,780855d2-bcb3-4ebd-abd2-c87dbe050246.aspx http://www.CudaMail.com/blog/2008/04/16/TheRegisterSecurityGumshoesLocateSourceOfMysteryWebCompromise.aspx Wed, 16 Apr 2008 15:34:07 GMT According to John Leyden (from "The Register") in his article "<a href="http://www.theregister.co.uk/2008/04/16/mystery_web_compromise_unpicked/" rel="_blank">Security gumshoes locate source of mystery web compromise</a>", the source of the mystery injection of more than 10,000 websites back in January has been uncovered!<br> <br> He says:<br> <br> "Thousands of legitimate websites were compromised at the start of the year to serve up malware, as we <a href="http://www.theregister.co.uk/2008/01/11/mysterious_web_infection" target="_blank">reported</a> at the time. <p> It <a href="http://isc.sans.org/diary.html?storyid=3834" target="_blank">seemed</a> that the exploitation of SQL Injection vulnerabilities was involved in the automated attacks. The precise mechanism was unclear until earlier this week when security researchers discovered a malicious executable later linked to the attack on a hacker site. </p> <p> The hacker utility used search engines to find insecure websites that it then tried to exploit using an SQL injection attack. The exploit included an SQL statement that tried to inject a script tag into every HTML page on the website. </p> <p> The tool - which had an interface written in Chinese - was programmed by default to insert a tag to the same malicious JavaScript file that featured in the January attack, solid evidence that it was at least partially behind the assault. </p> <p> The tool runs a script called pay.asp, hosted on a server in China. This suggests that hackers running the attack were keeping count of the number of sites they had compromised, in order to work out how much they stand to get paid. </p> <p> Further analysis of the tool by security researchers at the SANS Institute's Internet Storm Centre (ISC) is ongoing. The tool came to their attention via a tip-off from Dr Neal Krawetz. The initial attack was uncovered by security researcher Mary Landesman, of ScanSafe, who described it as the time as a new type of compromise. </p> <p> The constant, changing flux of the malicious JavaScript served up by compromised sites made initial analysis difficult. With the benefit of the hacker tool used to pull off the attack this all becomes much clearer, much like it was easier for scientists to unravel a cure for the mystery pandemic that blighted mankind in the <a href="http://www.imdb.com/title/tt0114746" target="_blank"><em>Twelve Monkies</em></a> after they obtained a sample of the pure source. </p> <p> "The nice thing about this is that we finally managed to confirm that it is SQL Injection that was used in those attacks. The tool has more functionality that we still have to analyze but this is the main purpose," writes ISC handler Bojan Zdrnja. </p> Website owners ought to use the discovery as a wake up call on the need to ensure that their web applications are secure, he added."<br> <br> If you are worried about SQL injection and other attacks on your website then you should take a look at Barracuda Network's newest solution called the <a href="http://www.barracudanetworks.ca/Searchresult.aspx?CategoryID=74">Website Firewall</a>. For more information or to arrange for an eval unit please visit: <a href="http://www.BarracudaNetworks.ca/Searchresult.aspx?CategoryID=74">www.BarracudaNetworks.ca/Searchresult.aspx?CategoryID=74</a>.<br> <p> </p> <img width="0" height="0" src="http://www.cudamail.com/blog/aggbug.ashx?id=780855d2-bcb3-4ebd-abd2-c87dbe050246" /> <br /> <hr /> This weblog is sponsored by <a href="http://www.CudaMail.com" title="CudaMail Managed Spam Filtering">CudaMail</a>. http://www.cudamail.com/blog/CommentView,guid,780855d2-bcb3-4ebd-abd2-c87dbe050246.aspx Barracuda Networks Barracuda Website Firewall SQL Injection http://www.cudamail.com/blog/Trackback.aspx?guid=82846fe2-45f0-48ce-8e96-ddcae66f56d8 http://www.cudamail.com/blog/pingback.aspx http://www.cudamail.com/blog/PermaLink,guid,82846fe2-45f0-48ce-8e96-ddcae66f56d8.aspx Scott Young http://www.cudamail.com/blog/CommentView,guid,82846fe2-45f0-48ce-8e96-ddcae66f56d8.aspx http://www.cudamail.com/blog/SyndicationService.asmx/GetEntryCommentsRss?guid=82846fe2-45f0-48ce-8e96-ddcae66f56d8 Don't get enough spam already and think you should get more? Then you will probably feel jealous of the 50 participants of McAfee's global Spammed Persistently All Month (S.P.A.M.) of April. These 50 regular Joe's ranging from 17 year old high school students (Hello Zach) to a mother of three (Zach's Mom Tracy) and a university student (Katya) among others in all areas of the globe are the guinea pigs in this experiment to run throughout April 2008.

Basically these participants have been given a dedicated laptop, a pre-paid credit card and a mission. Their mission is to do everything wrong and see what the results are. They are going to respond to Spam messages - buy the 'Genuine Replica Watches' on-line and sign up for everything they can and see what happens. William reported on Day 2 that without any protective software running he received 160 Spam messages and is getting pop-ups and browser hijacks 'on a regular basis'. The Blogs are a very interesting read.

Here Are My Predictions:

1. The laptops that these people are using will become a "willing soldier" in one of the Spam Bot armies lurking out there and may end up sending themselves (and us) more Spam. How is that for irony?

- Collectively the top botnets are capable of sending over 100 billion Spam messages per day*

2. Malware - The laptops will have to be wiped and re-installed for everyone at least once during the month. They are going to do this anyway for the participants at the end of the experiment before they get to keep them so this will be good practice. I'm not sure I would trust these laptops even after they are wiped though with the rootkits that are now being incorporated into the Bot software. Reports are coming in already that the laptops are slowing down and becoming unresponsive.

3. Massive consuption of time - the management of this Spam will take more and more time until these participants will not be able to do anything but read and reply to e-mail all day long.

4. Cyber Crime - all the participants have been given 'new identities' just like someone in the witness protection program to use online. I predict that some of these identities will be sold on the black market and thus stolen.

McAfee is of course going to use this experiment to advertise that there is a lot of Spam out there and that you need protection but I could have told you that - just look at the CudaMailstatistics page. ;)

- Shaun

* Source: www.secureworks.com/research/threats/topbotnets/?threat=topbotnets

For More Information:

www.mcafeespamexperiment.com
www.echannelline.com/canada/printer.cfm?item=DLY040708-2


This weblog is sponsored by CudaMail. My Predictions on McAfee's Global 'Spammed Persistently All Month' or S.P.A.M. Experiment http://www.cudamail.com/blog/PermaLink,guid,82846fe2-45f0-48ce-8e96-ddcae66f56d8.aspx http://www.CudaMail.com/blog/2008/04/10/MyPredictionsOnMcAfeesGlobalSpammedPersistentlyAllMonthOrSPAMExperiment.aspx Thu, 10 Apr 2008 21:32:21 GMT Don't get enough spam already and think you should get more? Then you will probably feel jealous of the 50 participants of McAfee's global<i> Spammed Persistently All Month</i> (S.P.A.M.) of April. These 50 regular Joe's ranging from 17 year old high school students (Hello Zach) to a mother of three (Zach's Mom Tracy) and a university student (Katya) among others in all areas of the globe are the guinea pigs in this experiment to run throughout April 2008. <br> <br> Basically these participants have been given a dedicated laptop, a pre-paid credit card and a mission. Their mission is to do everything wrong and see what the results are. They are going to respond to Spam messages - buy the 'Genuine Replica Watches' on-line and sign up for everything they can and see what happens. William reported on Day 2 that without any protective software running he received 160 Spam messages and is getting pop-ups and browser hijacks 'on a regular basis'. The Blogs are a very interesting read.<br> <br> <b>Here Are My Predictions:</b> <br> <br> 1. The laptops that these people are using will become a "willing soldier" in one of the Spam Bot armies lurking out there and may end up sending themselves (and us) more Spam. How is that for irony? <br> <br> - Collectively the top botnets are capable of sending over 100 billion Spam messages per day*<br> <br> 2. <i>Malware </i>- The laptops will have to be wiped and re-installed for everyone at least once during the month. They are going to do this anyway for the participants at the end of the experiment before they get to keep them so this will be good practice. I'm not sure I would trust these laptops even after they are wiped though with the rootkits that are now being incorporated into the Bot software. Reports are coming in already that the laptops are slowing down and becoming unresponsive.<br> <br> 3. <i>Massive consuption of time </i>- the management of this Spam will take more and more time until these participants will not be able to do anything but read and reply to e-mail all day long.<br> <br> 4. <i>Cyber Crime</i> - all the participants have been given 'new identities' just like someone in the witness protection program to use online. I predict that some of these identities will be sold on the black market and thus stolen.<br> <br> McAfee is of course going to use this experiment to advertise that there is a lot of Spam out there and that you need protection but I could have told you that - just look at the <a href="http://www.CudaMail.com">CudaMail</a> <a href="http://www.cudamail.com/results/">statistics page</a>. ;)<br> <br> - Shaun<br> <br> * <i>Source</i>: <a href="http://www.secureworks.com/research/threats/topbotnets/?threat=topbotnets">www.secureworks.com/research/threats/topbotnets/?threat=topbotnets</a> <br> <br> <b>For More Information:</b> <br> <br> <a href="http://www.mcafeespamexperiment.com">www.mcafeespamexperiment.com</a> <br> <a href="http://www.echannelline.com/canada/printer.cfm?item=DLY040708-2">www.echannelline.com/canada/printer.cfm?item=DLY040708-2</a> <p> </p> <img width="0" height="0" src="http://www.cudamail.com/blog/aggbug.ashx?id=82846fe2-45f0-48ce-8e96-ddcae66f56d8" /> <br /> <hr /> This weblog is sponsored by <a href="http://www.CudaMail.com" title="CudaMail Managed Spam Filtering">CudaMail</a>. http://www.cudamail.com/blog/CommentView,guid,82846fe2-45f0-48ce-8e96-ddcae66f56d8.aspx Anti-Spam CudaMail McAfee S.P.A.M. Spam Stats http://www.cudamail.com/blog/Trackback.aspx?guid=b557a9f3-d4df-4ce5-958f-5cf2ea83d5ec http://www.cudamail.com/blog/pingback.aspx http://www.cudamail.com/blog/PermaLink,guid,b557a9f3-d4df-4ce5-958f-5cf2ea83d5ec.aspx Scott Young http://www.cudamail.com/blog/CommentView,guid,b557a9f3-d4df-4ce5-958f-5cf2ea83d5ec.aspx http://www.cudamail.com/blog/SyndicationService.asmx/GetEntryCommentsRss?guid=b557a9f3-d4df-4ce5-958f-5cf2ea83d5ec 2 Let's talk about what you can to do help make your e-mail both more reliable and keep Spam out of your client's mailboxes.
 
First, most people have this idea that e-mail is both near instant and 100% reliable - unfortunately, both of these ideas are 100% wrong!

The SMTP protocol was designed when Internet links were both unreliable and slow, therefore the protocol was built to be resilient and to retry failed messages. However, the link speeds have now increased and have become more reliable, therefore people have gotten used to their e-mail arriving really quickly and so they have come to the unreasonable expectation that e-mail is near instant and 100% reliable.

Let's look at a couple of scenarios that will show that this is not the case as well as address some ways to increase your control over your e-mail server's level of reliability.
 
Case 1 - Single Mail Exchanger
 
A lot of e-mail domains right now have only 1 Mail eXchanger (or MX record) typically pointing to a single mail server at the head office.

So what happens if your internet connection goes down or there is some "hiccup" with the mail server or your firewall (you do have a hardware firewall don't you?). Anyone who tries to e-mail you will not be able to and the sender may get an undeliverable messages (or not) from their mail server after some period of time.

The Sending mail server should be configured to retry this message to you a number of times at some interval both of which are set solely by the administrator of the sending mail server. In other words, you have no control over how often they will try again or for how long and it will be different for each and every mail server that is trying to send to you. Talk about a troubleshooting nightmare!
 
Case 2 - Backup Mail Exchanger

When you publish an MX record via DNS one of the properties of the record is a preference. Here is an example (fictitious) domain and the tools you would use to see what your MX record points to:
 
nslookup -type=mx somedomain.com
Non-authoritative answer:
somedomain.com        MX preference = 10, mail exchanger =
mail.somedomain.com
somedomain.com        MX preference = 99, mail exchanger =
smtp.SomedomainISP.com
 
What the above record is saying is that when sending e-mail to 'yourbuddy@somedomain.com' to first try sending it to the mail server named 'mail.somedomain.com' and if that fails to try and send the e-mail through the mail server named 'smtp.SomedomainISP.com'. Your ISP may even include this service for free if you ask them, however these 'store and forward' backup mail servers typically just accept and forward messages WITHOUT anti-spam processing and since they are from a trusted source (your ISP) most mail servers are configured to accept without further processing.

Guess what? The Spammers are aware of this little fact and will, in violation of the standard, try to send e-mail to your domain through your backup or secondary MX record. This is how a lot of Spam sneaks in today - it takes the back door and doesn't get challenged by the security guard at the front door - your primary anti-spam solution.

So what is the solution to this problem?

Case 3 - Spam filtered MX Backup service.

Make sure your backup or secondary MX record points to a system or systems that are as hard on Spam as the protection on or in front of your mail server. This is the reasoning behind our CudaMail MX Backup Service.

We (Optrics Engineering) have been Barracuda Diamond Partners for a number of years and have seen the above problems (Case 1 and Case 2) a number of times with the clients we deal with and are offering not just an MX backup service but a Spam Filtered MX Backup Service. We have a redundant cluster of Barracuda Spam Firewalls that we use to provide primary anti-spam protection for smaller organizations but can use these same servers to accept, scan for Spam and deliver to your mail server in the event that your anti-spam solution goes off-line or your Internet connection or firewall has an issue.

This cluster is configured to retry delivery to your mail server every 15 minutes for up to 48 hours. Those pesky Spammers who try to sneak in through the back door are going to be very surprised when they run into the CudaMail service on your secondary MX records and you now know how often and how long you have before people get an 'undeliverable' response back.

While e-mail is not 100% guaranteed the above service puts you in control and slams the door in the face of the Spammers.

Now go have a nice (Spam-free) day!

- Shaun


This weblog is sponsored by CudaMail. You Have Invested In A Spam Filter But Continue Getting Spam - What Is Wrong With This Picture? http://www.cudamail.com/blog/PermaLink,guid,b557a9f3-d4df-4ce5-958f-5cf2ea83d5ec.aspx http://www.CudaMail.com/blog/2008/04/02/YouHaveInvestedInASpamFilterButContinueGettingSpamWhatIsWrongWithThisPicture.aspx Wed, 02 Apr 2008 21:26:26 GMT Let's talk about what you can to do help make your e-mail both more reliable and keep Spam out of your client's mailboxes.<br> &nbsp;<br> First, most people have this idea that e-mail is both near instant and 100% reliable - unfortunately, both of these ideas are 100% wrong! <br> <br> The SMTP protocol was designed when Internet links were both unreliable and slow, therefore the protocol was built to be resilient and to retry failed messages. However, the link speeds have now increased and have become more reliable, therefore people have gotten used to their e-mail arriving really quickly and so they have come to the unreasonable expectation that e-mail is near instant and 100% reliable.<br> <br> Let's look at a couple of scenarios that will show that this is not the case as well as address some ways to increase your control over your e-mail server's level of reliability.<br> &nbsp;<br> <i><b>Case 1 - Single Mail Exchanger</b></i> <br> &nbsp;<br> A lot of e-mail domains right now have only 1 Mail eXchanger (or MX record) typically pointing to a single mail server at the head office. <br> <br> So what happens if your internet connection goes down or there is some "hiccup" with the mail server or your firewall (you do have a hardware firewall don't you?). Anyone who tries to e-mail you will not be able to and the sender may get an undeliverable messages (or not) from their mail server after some period of time. <br> <br> The Sending mail server should be configured to retry this message to you a number of times at some interval both of which are set solely by the administrator of the sending mail server. In other words, you have no control over how often they will try again or for how long and it will be different for each and every mail server that is trying to send to you. Talk about a troubleshooting nightmare! <br> &nbsp;<br> <b><u>Case 2</u></b><i><b> - Backup Mail Exchanger</b></i> <br> <br> When you publish an MX record via DNS one of the properties of the record is a preference. Here is an example (fictitious) domain and the tools you would use to see what your MX record points to:<br> &nbsp;<br> nslookup -type=mx somedomain.com<br> Non-authoritative answer:<br> somedomain.com&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; MX preference = 10, mail exchanger =<br> mail.somedomain.com<br> somedomain.com&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; MX preference = 99, mail exchanger =<br> smtp.SomedomainISP.com<br> &nbsp;<br> What the above record is saying is that when sending e-mail to 'yourbuddy@somedomain.com' to first try sending it to the mail server named 'mail.somedomain.com' and if that fails to try and send the e-mail through the mail server named 'smtp.SomedomainISP.com'. Your ISP may even include this service for free if you ask them, however these 'store and forward' backup mail servers typically just accept and forward messages WITHOUT anti-spam processing and since they are from a trusted source (your ISP) most mail servers are configured to accept without further processing.<br> <br> <i>Guess what? </i>The Spammers are aware of this little fact and will, in violation of the standard, try to send e-mail to your domain through your backup or secondary MX record. This is how a lot of Spam sneaks in today - it takes the back door and doesn't get challenged by the security guard at the front door - your primary anti-spam solution.<br> <br> <b>So what is the solution to this problem? </b> <br> <br> <b><u>Case 3</u></b><i><b> - Spam filtered MX Backup service.</b></i> <br> <br> Make sure your backup or secondary MX record points to a system or systems that are as hard on Spam as the protection on or in front of your mail server. This is the reasoning behind our <a href="http://www.cudamail.com/backup_service.htm" target="_blank">CudaMail MX Backup Service</a>. <br> <br> We (<a href="http://www.Optrics.com" target="_blank">Optrics Engineering</a>) have been <a href="http://www.barracudanetworks.ca" target="_blank">Barracuda Diamond Partners</a> for a number of years and have seen the above problems (Case 1 and Case 2) a number of times with the clients we deal with and are offering not just an MX backup service but a <a href="http://www.cudamail.com/backup_service.htm" target="_blank">Spam Filtered MX Backup Service</a>. We have a redundant cluster of <a href="http://www.barracudanetworks.ca/spam-firewall.aspx" target="_blank">Barracuda Spam Firewalls</a> that we use to provide primary anti-spam protection for smaller organizations but can use these same servers to accept, scan for Spam and deliver to your mail server in the event that your anti-spam solution goes off-line or your Internet connection or firewall has an issue. <br> <br> This cluster is configured to retry delivery to your mail server every 15 minutes for up to 48 hours. Those pesky Spammers who try to sneak in through the back door are going to be very surprised when they run into the <a href="http://www.cudamail.com" target="_blank">CudaMail</a> service on your secondary MX records and you now know how often and how long you have before people get an 'undeliverable' response back.<br> <br> While e-mail is not 100% guaranteed the above service puts you in control and slams the door in the face of the Spammers.<br> <br> Now go have a nice (Spam-free) day!<br> <br> - Shaun<br> <p> </p> <img width="0" height="0" src="http://www.cudamail.com/blog/aggbug.ashx?id=b557a9f3-d4df-4ce5-958f-5cf2ea83d5ec" /> <br /> <hr /> This weblog is sponsored by <a href="http://www.CudaMail.com" title="CudaMail Managed Spam Filtering">CudaMail</a>. http://www.cudamail.com/blog/CommentView,guid,b557a9f3-d4df-4ce5-958f-5cf2ea83d5ec.aspx Anti-Spam Barracuda Spam Firewalls CudaMail MX Backup Spam Filtering Service http://www.cudamail.com/blog/Trackback.aspx?guid=96372a5c-0c03-4708-943c-31e25c6795a8 http://www.cudamail.com/blog/pingback.aspx http://www.cudamail.com/blog/PermaLink,guid,96372a5c-0c03-4708-943c-31e25c6795a8.aspx Site Admin http://www.cudamail.com/blog/CommentView,guid,96372a5c-0c03-4708-943c-31e25c6795a8.aspx http://www.cudamail.com/blog/SyndicationService.asmx/GetEntryCommentsRss?guid=96372a5c-0c03-4708-943c-31e25c6795a8 April Fool's Day is upon us - don't be an e-mail fool - as the Spammers will be trying to take advantage of our love of a good laugh.
 
As always be very careful when you get an e-mail that you don't expect. Just last week my own wife sent me a video via e-mail and the first thing I did was call her and ask if she had sent it to me. It turns out she had but it could easily be an e-mail containing Spam/malware like the latest storm being reported on by the Internet Storm Center.

Storming into April on Fools Day

http://isc.sans.org/diary.html?storyid=4222

Here are some subject lines to watch out for (there may be more variations):

  • All Fools' Day
  • Doh! All's Fool
  • Doh! April's Fool.
  • Gotcha!
  • Gotcha! All Fool!
  • Gotcha! April Fool!
  • Happy All Fool's Day.
  • Happy All Fools Day!
  • Happy All Fools!
  • Happy April Fool's Day.
  • Happy April Fools Day!
  • Happy Fools Day!
  • I am a Fool for your Love
  • Join the Laugh-A-Lot!
  • Just You
  • One who is sportively imposed upon by others on the first day of April Surprise!
  • Surprise! The joke's on you.
  • Today You Can Officially Act Foolish
  • Today's Joke!
The e-mails either contain or have links to a nasty malware payload.

The download is a binary, also with varying names:

foolsday.exe
funny.exe
kickme.exe

In your e-mail it will look something like this:

April Fool's Day http://276.233.234.297 <= This is an invalid link intended to be harmless

CudaMail blocks .EXE attachments by default so anyone using our CudaMail managed anti-spam service is not going to be getting any of the malware payloads but some of the links may slip through.

We are blocking new variants as quickly as they are discovered but the best defense is to be educated to not click on unsolicited links.

Consider yourself educated. :)

- Shaun


This weblog is sponsored by CudaMail. Happy April Fool's Day - Don't Be An E-mail Fool! http://www.cudamail.com/blog/PermaLink,guid,96372a5c-0c03-4708-943c-31e25c6795a8.aspx http://www.CudaMail.com/blog/2008/04/01/HappyAprilFoolsDayDontBeAnEmailFool.aspx Tue, 01 Apr 2008 14:53:40 GMT <i>April Fool's Day</i> is upon us - don't be an e-mail fool - as the Spammers will be trying to take advantage of our love of a good laugh.<br> &nbsp;<br> As always be very careful when you get an e-mail that you don't expect. Just last week my own wife sent me a video via e-mail and the first thing I did was call her and ask if she had sent it to me. It turns out she had but it could easily be an e-mail containing Spam/malware like the latest storm being reported on by the <a href="http://isc.sans.org/diary.html?storyid=4222">Internet Storm Center</a>.<br> <br> <i><b>Storming into April on Fools Day</b></i> <br> <br> <a href="http://isc.sans.org/diary.html?storyid=4222">http://isc.sans.org/diary.html?storyid=4222</a> <br> <br> Here are some subject lines to watch out for (there may be more variations):<br> <br> <ul> <li> All Fools' Day </li> <li> Doh! All's Fool</li> <li> Doh! April's Fool.</li> <li> Gotcha!</li> <li> Gotcha! All Fool!</li> <li> Gotcha! April Fool!</li> <li> Happy All Fool's Day.</li> <li> Happy All Fools Day!</li> <li> Happy All Fools!</li> <li> Happy April Fool's Day.</li> <li> Happy April Fools Day!</li> <li> Happy Fools Day!</li> <li> I am a Fool for your Love</li> <li> Join the Laugh-A-Lot!</li> <li> Just You</li> <li> One who is sportively imposed upon by others on the first day of April Surprise!</li> <li> Surprise! The joke's on you.</li> <li> Today You Can Officially Act Foolish</li> <li> Today's Joke!</li> </ul> The e-mails either contain or have links to a nasty malware payload.<br> <br> The download is a binary, also with varying names:<br> <br> foolsday.exe<br> funny.exe<br> kickme.exe<br> <br> In your e-mail it will look something like this: <br> <br> April Fool's Day http://276.233.234.297 &lt;= This is an invalid link intended to be harmless<br> <br> <a href="http://www.CudaMail.com">CudaMail</a> blocks .EXE attachments by default so anyone using our CudaMail <a href="http://www.CudaMail.com">managed anti-spam service</a> is not going to be getting any of the malware payloads but some of the links may slip through. <br> <br> We are blocking new variants as quickly as they are discovered but the best defense is to be educated to not click on unsolicited links.<br> <br> Consider yourself educated. :)<br> <br> - Shaun<br> <p> </p> <img width="0" height="0" src="http://www.cudamail.com/blog/aggbug.ashx?id=96372a5c-0c03-4708-943c-31e25c6795a8" /> <br /> <hr /> This weblog is sponsored by <a href="http://www.CudaMail.com" title="CudaMail Managed Spam Filtering">CudaMail</a>. http://www.cudamail.com/blog/CommentView,guid,96372a5c-0c03-4708-943c-31e25c6795a8.aspx Anti-Spam April Fool's Day CudaMail Spam Threats http://www.cudamail.com/blog/Trackback.aspx?guid=967baccb-3d52-463e-bad3-c65a7c79a52f http://www.cudamail.com/blog/pingback.aspx http://www.cudamail.com/blog/PermaLink,guid,967baccb-3d52-463e-bad3-c65a7c79a52f.aspx Scott Young http://www.cudamail.com/blog/CommentView,guid,967baccb-3d52-463e-bad3-c65a7c79a52f.aspx http://www.cudamail.com/blog/SyndicationService.asmx/GetEntryCommentsRss?guid=967baccb-3d52-463e-bad3-c65a7c79a52f As some of you may know,  ORDB.org (aka the Open Relay Data Base) was one of the original real time or IP based black lists. The idea was that as your mail server or anti-spam service (like CudaMail) was getting a connection from a sending mail server you could ask ORDB.org if the senders IP address was known to ORDB and if it was you had a pretty good idea that you didn't want to accept this e-mail as it was most likely spam being routed through an open relay mail server.
 
Well after running as a free service for years the ORDB.org service was shut down on December 18, 2006 and instead of replying it would just time out.  Not a big deal and since your mail server didn't get a reply either way you went on to other tests. They announced that they were going off-line and at some time in the future they would be replying with a positive result to any new queries. This has happened many times over the years with various free anti-spam databases for a variety of reasons. Most administrators didn't notice the ORDB.org announcement or put the removal of this test on their 'to do' list and promptly forgot about it until now.
 
So on March 25, 2008, after giving fair warning, the DNS servers for ORDB.org started to answer every query with a positive result. All mail servers still using a SPAM filtering solution that references ORDB (relays.ordb.org) started to immediately block all incoming e-mails regardless of their real status as spam sources. You can't blame the admin of ORDB.org as they were doing this service for free and had been paying for the bandwidth used up by all these timed out queries for the last 2 years.
 
While the CudaMail system does still use some of the no charge databases out there to block spam it does not use ORDB.org. Barracuda Central has also been actively working on their own internal reputation system. The Barracuda Reputation system is very mature at this point with the end result is that this database is flagging new spam sources before the no charge databases like ORDB.org used to do. The real benefit of Barracuda Central maintaining this database is that there are dedicated people paid to maintain it as part of their business plan and the problems experienced by people who rely on the free databases will not happen to CudaMail.

Now go have a nice spam free day!

- Shaun Sturby


This weblog is sponsored by CudaMail. Why You Want to Pay for Your Reputation Database http://www.cudamail.com/blog/PermaLink,guid,967baccb-3d52-463e-bad3-c65a7c79a52f.aspx http://www.CudaMail.com/blog/2008/03/28/WhyYouWantToPayForYourReputationDatabase.aspx Fri, 28 Mar 2008 15:03:37 GMT As some of you may know,&nbsp; ORDB.org (aka the Open Relay Data Base) was one of the original real time or IP based black lists. The idea was that as your mail server or anti-spam service (like <a href="http://www.CudaMail.com">CudaMail</a>) was getting a connection from a sending mail server you could ask ORDB.org if the senders IP address was known to ORDB and if it was you had a pretty good idea that you didn't want to accept this e-mail as it was most likely spam being routed through an open relay mail server.<br> &nbsp;<br> Well after running as a free service for years the ORDB.org service was shut down on December 18, 2006 and instead of replying it would just time out.&nbsp; Not a big deal and since your mail server didn't get a reply either way you went on to other tests. They announced that they were going off-line and at some time in the future they would be replying with a positive result to any new queries. This has happened many times over the years with various free anti-spam databases for a variety of reasons. Most administrators didn't notice the ORDB.org announcement or put the removal of this test on their 'to do' list and promptly forgot about it until now.<br> &nbsp;<br> So on March 25, 2008, after giving fair warning, the DNS servers for ORDB.org started to answer every query with a positive result. All mail servers still using a SPAM filtering solution that references ORDB (relays.ordb.org) started to immediately block all incoming e-mails regardless of their real status as spam sources. You can't blame the admin of ORDB.org as they were doing this service for free and had been paying for the bandwidth used up by all these timed out queries for the last 2 years. <br> &nbsp;<br> While the <a href="http://www.CudaMail.com">CudaMail</a> system does still use some of the no charge databases out there to block spam it does not use ORDB.org. <a href="http://www.barracudacentral.com/">Barracuda Central </a>has also been actively working on their own internal reputation system. The Barracuda Reputation system is very mature at this point with the end result is that this database is flagging new spam sources before the no charge databases like ORDB.org used to do. The real benefit of Barracuda Central maintaining this database is that there are dedicated people paid to maintain it as part of their business plan and the problems experienced by people who rely on the free databases will not happen to <a href="http://www.CudaMail.com">CudaMail</a>.<br> <br> Now go have a nice spam free day!<br> <br> - Shaun Sturby<br> <br> <p> </p> <img width="0" height="0" src="http://www.cudamail.com/blog/aggbug.ashx?id=967baccb-3d52-463e-bad3-c65a7c79a52f" /> <br /> <hr /> This weblog is sponsored by <a href="http://www.CudaMail.com" title="CudaMail Managed Spam Filtering">CudaMail</a>. http://www.cudamail.com/blog/CommentView,guid,967baccb-3d52-463e-bad3-c65a7c79a52f.aspx Anti-Spam Barracuda Central Barracuda Networks CudaMail ORDB Spam Filtering Service http://www.cudamail.com/blog/Trackback.aspx?guid=b177b727-90ea-44b6-99d4-981491e7124e http://www.cudamail.com/blog/pingback.aspx http://www.cudamail.com/blog/PermaLink,guid,b177b727-90ea-44b6-99d4-981491e7124e.aspx Scott Young http://www.cudamail.com/blog/CommentView,guid,b177b727-90ea-44b6-99d4-981491e7124e.aspx http://www.cudamail.com/blog/SyndicationService.asmx/GetEntryCommentsRss?guid=b177b727-90ea-44b6-99d4-981491e7124e
False Spam are messages that are blank or contain garbled text with no links or real message.
 
Yes, they are unwanted messages but there is no real 'body' to the Spam - just some garbled words. The message that the Spammer wanted to send was not included and thus these messages are ineffective as Spam.
 
Why would the Spammers want to send 'False Spam'?

Just speculating here but it could be anything from someone doing a 'test spam run' that got away on them and sent nonsensical random text without the advertisement. If that is the case then 'Silly Spammer - you wasted your money on this one!'
 
It could also possibly be an effort to see what did get through by utilizing the 'Out of Office' or 'Delivery Receipts' to capture valid e-mail addresses. If the Spammer gets any response back except 'undeliverable' then they know that there is a valid e-mail address on the other side. It is a good idea to not send these 'Out of Office' messages outside your organization if at all possible. It is also a good idea to disable the 'Delivery or Read receipts' in both your e-mail client and your mail server as some people rely on them. 
 
A third possibility is that Spammers may be trying to poison the Bayesian or statistical database by sending out these random words and phrases. A poisoned database will make it that much harder to pick the Spam out of the noise and could result in more false positives.
 
Rest assured that CudaMail is working hard to clean up these 'False Spam' messages as quickly as we can.

- Shaun


This weblog is sponsored by CudaMail. What is 'False Spam?' http://www.cudamail.com/blog/PermaLink,guid,b177b727-90ea-44b6-99d4-981491e7124e.aspx http://www.CudaMail.com/blog/2008/03/19/WhatIsFalseSpam.aspx Wed, 19 Mar 2008 14:18:24 GMT <div dir="ltr" align="left"><span class="737454817-17032008"><span class="969041719-17032008"><i>False Spam</i> are messages that are blank or contain garbled text with no links or real message.</span></span> </div> <div dir="ltr" align="left"><span class="737454817-17032008"></span>&nbsp; </div> <div dir="ltr" align="left"><span class="737454817-17032008">Yes, they are unwanted messages but there is no real 'body' to the Spam - just some garbled words. The message that the Spammer wanted to send was not included and thus these messages are ineffective as Spam.</span> </div> <div><span class="737454817-17032008"></span>&nbsp; </div> <div><span class="737454817-17032008"><b>Why would the Spammers want to send 'False Spam'? </b> <br> <br> Just speculating here but it could be anything from&nbsp;someone doing a 'test spam run' that got away on them and sent nonsensical random text without the advertisement. If that is the case then 'Silly Spammer -&nbsp;you wasted your money on this one!'</span> </div> <div><span class="737454817-17032008"></span>&nbsp; </div> <div><span class="737454817-17032008">It could also possibly be an effort to see what did get through by utilizing the 'Out of Office' or 'Delivery Receipts' to capture valid e-mail addresses. If the Spammer gets any response back except 'undeliverable' then they know that there is a valid e-mail address on the other side. It is a good idea to not send these 'Out of Office' messages outside your organization if at all possible. It is also a good idea to disable the 'Delivery or Read receipts' in both your e-mail client and your mail server<span class="969041719-17032008"> as some people rely on them.&nbsp;</span></span> </div> <div><span class="737454817-17032008"></span>&nbsp; </div> <div><span class="737454817-17032008">A third possibility is that Spammers may be trying to&nbsp;poison the Bayesian or statistical database by sending out these random words and phrases. A poisoned database will make it that much harder to pick the Spam out&nbsp;of&nbsp;the noise and could result in more false positives.</span> </div> <div><span class="737454817-17032008"></span>&nbsp; </div> <div><span class="737454817-17032008">Rest assured that <a href="http://www.cudamail.com">CudaMail</a> is working hard to clean up these 'False Spam' messages as quickly as we can.<br> <br> - Shaun<br> </span> </div> <p> </p> <img width="0" height="0" src="http://www.cudamail.com/blog/aggbug.ashx?id=b177b727-90ea-44b6-99d4-981491e7124e" /> <br /> <hr /> This weblog is sponsored by <a href="http://www.CudaMail.com" title="CudaMail Managed Spam Filtering">CudaMail</a>. http://www.cudamail.com/blog/CommentView,guid,b177b727-90ea-44b6-99d4-981491e7124e.aspx Anti-Spam CudaMail False Spam Spam Filtering Service