Friday, February 15, 2008
Friday, February 15, 2008 10:44:16 AM (Mountain Standard Time, UTC-07:00) ( Anti-Spam | CudaMail | Threats )

A classic example of why the storm worm has been so successful. The subject lines of this variation play on peoples emotions and their desire to be wanted / loved. This will be successful again as valentines day comes around and people expect to get electronic valentines.

People have resist the urge to click on something like this that tugs on their heart strings.

Storm Worm encore. A Trojan repackaged yet again. This incarnation of the "Dorf" Trojan sends out emails posing as messages of love in an attempt to lure unsuspecting users to dangerous websites. The emails sport subject lines such as "Falling In Love with You," "Special Romance," and "You're In My Thoughts." The body of the email contains a link to a website that is actually one of the many compromised computers in the worldwide Storm botnet. The website displays a large red heart, while installing malware onto the visitor's computer.
More information:

http://www.sophos.com/pressoffice/news/articles/2008/01/love-storm.html

- Shaun Sturby
Technical Services Manager
CudaMail

 

Comments [0] | Trackback | # 
Friday, February 15, 2008 10:04:24 AM (Mountain Standard Time, UTC-07:00) ( Anti-Spam | CudaMail | Spam Stats | Threats )

AVG Research has released an interesting report on the changing malware landscape.  According to AVG, viruses now account for less than 15% of total threats, with phishing scams, backdoor worms, Trojans, keyloggers, spyware, adware and web-based exploits making up the rest.


For 2008 AVG predicts an increase in the number of web attacks on legitimate web sites, particularly social network sites, in order to use these sites for the illegal capture of user data and for the propagation of malware. Folks, over the last year I have been advising you to run your browser in a sandbox or with reduced rights. This is one of the reasons why. In the future you may not be able to assume that those "trusted" websites you visit have not been temporarily compromised.

http://www.avg.com.au/index.cfm?section=news&feature=83


- Shaun Sturby
Technical Services Manager
CudaMail

Comments [0] | Trackback | # 
Friday, February 15, 2008 9:51:22 AM (Mountain Standard Time, UTC-07:00) ( Anti-Spam | CudaMail | SPF )
(really I'm not!)

1. Maybe because you misspelled something or are using text messaging shorthand, L337 (leet) speak or hacker jargon.

http://en.wikipedia.org/wiki/Text_messaging
http://en.wikipedia.org/wiki/L337

Anti-spam filters get suspicious when they see bad spelling or unusual characters inserted into words because this is what Spammers do all the time. Don't act like a Spammer and you won't get lumped in with them. ;-)

2. If you are at your corporate site you probably send e-mail out via your organization's mail server but when you work from home, at a hotel or at your favorite coffee spot they are probably either blocking outbound SMTP traffic to stop infected systems from sending Spam or are silently proxying port 25 'in your best interest'. This can cause your outbound e-mail to fail completely or fail something called an Sender Policy Framework (SPF) check or a domain check as an outgoing server whose name doesn't match your domain name raises a red flag, unless it's a well-known one, like Gmail or Yahoo.
 
What can you do about this?
 
A. Use webmail. Since you are connecting back to your real mail server the e-mail will not be blocked and it will be coming from your mail server so the mail server checks will pass. Make sure you use a secure connection (httpS) when you do this or the hotel or coffee shop may be able to read your e-mail. Not something to do if your working on your "super secret" plan!

B. Use a VPN to your office first then use your regular mail client. Again the e-mail is going from your laptop to your mail server first so you will pass these anti-spam checks. Some locations, like hotels, may not let you start a VPN connection so you will have to use webmail or the final solution - alternate SMTP port.

C. Use an alternate port for SMTP
. Way back when the Internet was young and shiny and spammers weren't born things were a lot more permissive and so requiring people to identify themselves to send e-mail wasn't necessary. Today the best thing to do is run two SMTP services or e-mail server software that can listen for e-mail on more than one port. Leave port 25 to accept e-mail from the wild and do all your anti-spam checks on this port. The second port is going to be dedicated to accepting e-mail from your users only and therefore two things are needed:
1. An alternate port like 465 or 587 mapped through your firewall to your mail server.
2. A setting that forces your users to authenticate (provide a user name and password) FIRST before accepting e-mail from them.
This way your laptop connects to your mail server on a port that is not blocked and spammers can't use this port to send you spam because they don't have a username and password on your server - simple!
 
More about SPF records next week.

Shaun Sturby
Technical Services Manager
CudaMail

Comments [0] | Trackback | # 
 Wednesday, February 13, 2008
Wednesday, February 13, 2008 2:06:25 PM (Mountain Standard Time, UTC-07:00) ( Anti-Spam | Threats )
As Valentines day draws ever closer the flood of e-mail's designed to trick you (Classic Social Engineering) into clicking on a link that will infect and take over your computer start coming fast and furious.
 
Here is a write-up on the latest variation of the Spam Worm (should we change it's name to the Love Worm?)  that uses such subject lines as
 
"Valentines Day"
"Sweetest things Aren't things!"
and my favorite
"The Love Train"
 
 
The Storm worm continues to be a menace to all of us who spend any time on the Internet so practice safe surfing habits.

Comments [0] | Trackback | # 
 Monday, February 11, 2008
Monday, February 11, 2008 5:15:15 PM (Mountain Standard Time, UTC-07:00) ( Anti-Spam | Threats )

Browser vulnerabilities and botnets head threat list.

SANS has released the full article on their website:

Twelve cyber security veterans, with significant knowledge about emerging attack patterns, worked together to compile a list of the attacks most likely to cause substantial damage during 2008. Participants included Stephen Northcutt, Ed Skoudis, Marc Sachs, Johannes Ullrich, Tom Liston, Eric Cole, Eugene Schultz, Rohit Dhamankar, Amit Yoran, Howard Schmidt, Will Pelgrin, and Alan Paller. Here's their consensus list in ranked order:

Sans.Org 2008 Menaces

The Register links to the same information:
http://www.theregister.co.uk/2008/01/14/sans_threat_list/

 - Shaun

Comments [0] | Trackback | # 
 Friday, February 08, 2008
Friday, February 08, 2008 12:24:21 PM (Mountain Standard Time, UTC-07:00) ( Anti-Spam | CudaMail | Spam Stats )

There are 1,300,925,111,156,286,160,896 ways to spell Viagra!

Rob did the math on how many variations you could easily come up with and the above number is what he came up with.

http://cockeyed.com/lessons/viagra/viagra.html

Going after the word is not the way to target the spam.

This came off the Declude forums where someone is trying to come up with all the possible combinations of Viagra.

You can see why the anti-spam people went looking for a better solution.

- Shaun

Comments [0] | Trackback | # 
 Wednesday, February 06, 2008
Wednesday, February 06, 2008 1:00:00 AM (Mountain Standard Time, UTC-07:00) ( Anti-Spam | CudaMail )

We're excited to announce the creation of our new blog on this topic  and it's related news.  CudaMail Anti-Spam discussion, news, and a lot of techniques and tips that will be of interest to those in the IT community who are part of the fight against spam.

Comments [1] | Trackback | # 

About the author

Shaun Sturby, MCSE Shaun Sturby, MCSE
Technical Services Manager, and Optrics' point person for email security

  Navigation

  Search

  Category Feeds

  On this page

  Tag Cloud

  Archive

  Blogroll

  Statistics

Total Posts: 24
This Year: 24
This Month: 1
This Week: 0
Comments: 4


Subscribe

 

© Copyright 2008, Optrics Inc.