Use a service or server based anti spam system. Such systems employ measures that block spam and are hardened to large quantities of spam and will provide some protection from backscatter in and of themselves, however the spam ...

Luis von Ahn, an inventor of the anti-spam tool known as "captchas," talks with Jon Gordon about how much longer the squiggly line challenge-response tools will be useful.

TypePad AntiSpam is the product of the antispam technology Six Apart has been using in their TypePad hosted blogs since May 2007. Now the service, which is in beta, is available to anyone, open source, and free -- regardless of how ...

Just saw this over at namepros, although I don't use myspace but I like to think that spammers (not only the ones spamming myspace) will think twice before doing spamming again Excite News - MySpace wins $230 million anti-spam judgment.

Popular networking sites have become one of the latest targets in recent spam attacks. Cloudmark, an anti-spam enterprise, revealed that social networking sites have seen a huge rise in spam in the 6 months to March 2008. ...

Enjoy!

- Shaun

• Do not follow unsolicited web links received in email messages.
  

• Review the Federal Trade Commission's Charity Checklist.
  

• Verify the legitimacy of the email by contacting the organization directly through a trusted contact number. Trusted contact information can be found on the Better Business Bureau National Charity Report Index.
  

• Recognizing and Avoiding Email Scams (PDF)
  

• Avoiding Social Engineering and Phishing Attacks
  

A funny but O so true write-up from SANS (www.sans.org) on what NOT to do online.

1. Practice Unsafe Surfing. When you purchase a new computer, go online without activating the firewall, or purchasing protective software.

Further expose yourself digitally by sharing a wireless connection with the entire neighborhood. Without digital encryption, you can share the contents of your hard drive with anyone on the street. For maximum risk, do some online banking on a public computer -- like the one at the library or a public cafe. Bonus points are added if your Social Security number is your user ID for any transactions.

• Use a hardware firewall at work and at home along with good AV software that is kept up to date.
• While the desire to go 'Wireless' is high and the products make is so easy take the time to set it up properly or call in an expert to set it up for you.
• Never do more than just check news stories on some basic searching when on an unknown and thus un-trusted computer be it at the library or even over at your friends house.

2. Skimp on anti-virus and anti-spyware protection. Courting disaster online is easy. Invite malicious code to attack your computer simply by doing nothing. Antivirus programs can be pricey, and the maintenance of constantly downloading updates is time-consuming. Combine that with the security updates from Microsoft or Apple and it's enough to seriously annoy anyone.

Install a good Anti-Virus solution, most like F-Secure, come in a full protection suite and could be included free with your internet connection (Shaw includes F-Secure for example) Turn on automatic updates in Windows and if your programs can be set to do the same do so. Once a month manually check to ensure your programs are up to date with something like the online F-Secure Health Check or the Secunia Software Inspector. It wouldn't hurt to visit both Windows Update and Office Update while your at it.

3. Passwords are a pain! Make life easy for yourself by using the same password for EVERYTHING, and make it something easy to remember, like your first name or 'password'. Just in case, make sure you write it down on a yellow sticky and put it somewhere easy to see.

And don't forget to have your browser set to 'remember password' to make life easy for you - and the cyber thief.

• Use the idea of a password phrase to remember hard to guess passwords. A favorite phrase or poem can become the backbone of a secure password policy.
• For Example the phrase 'The quick brown fox jumped over the lazy dog' can be used to easily remember a password of 'tqbfjotld'.
• Make your password harder to guess by throwing in Capitalization, numbers and special characters.
  • If you want to keep things simple then come up with at least three or four secure passwords.
  • The first would be used only for online banking. The second would be used for your e-mail. The third would be used anywhere you have to register to use a site. The fourth could be used for questionable sites that require you to register.

4. Peek at junk email and open attachments from unknown sources. Open attachments from strangers, secret crushes, long-lost friends saying "what's up," or strangers hawking cheap drugs -- you'll never know unless you peek at that email. One of the many fun things that can happen when you open an attachment containing malicious code is infecting your computer with a Trojan horse or virus, which can easily lead to identity theft.

Use a service like CudaMail to filter out all these unwanted messages. They are either marketing messages or worse, spammers trying to add your computer to their botnet. Stay away from these messages no matter how 'interesting' the spammers make them.

5. Stuff your wallet with juicy identifying tidbits. Wallets and purses are more than just handy cash-carrying devices. They often have credit cards, identification, insurance information and even Social Security cards. Obviously, more is better if you'd like to become the prey of fraudsters.

Losing or misplacing a wallet or purse can cause more problems than just the hassle of replacing all those cards and buying a new bag. Armed with your date of birth, Social Security number and mailing address, there's no limit to the damage thieves could cause.

• Keep only what you need in your wallet or purse.
• The rest of the information should be in a safety deposit box where you can get it if you need it but the rest of the time it is locked away.
• Check on the personal information the credit bureaus have on you to make sure it is accurate and that someone hasn't signed up for a credit card or something else in your name but using a different address.

6. Make your checks payable to criminals. If you're like most people, you wouldn't post your checking account information on your front door, though you should if you'd like to be a victim of fraud. Similarly, checks reflecting the same information can be dropped casually into unsecured mailboxes. Statistically the chances of your mailbox being targeted by criminal elements are low, but not that low. According to the 2008 Identity Fraud Survey Report from Javelin Strategy and Research, almost 1 in 10 victims of identity theft who can pinpoint the scene of the crime say that it happened at the mailbox.

7. Opt out? Opt in! While you're mailing checks from the unlocked mailbox, go ahead and get credit card companies to send you all the pre-approved offers that the postman can cram into the box. Similarly, don't get credit card statements online; leave them on the side of the road so that they're more convenient for fraudsters who lack the technical knowledge or follow-through to launch complicated hacking schemes.

Don't use the mailbox by your front door as an outbox just because it is convenient. Take your bills to the bank to pay or drop them off at a real post office. Anything you do get that has your identifying information on it like a pre-filled out credit application should go through a good cross cut paper shredder before leaving your place.

8. Nothing is too good to be true. Everyone wants to feel special and maybe more importantly, filthy rich. When reading an emailed proposition from an African business tycoon, an imperiled prince or downtrodden heiress offering millions of dollars in exchange for some small measure of assistance, it's difficult not to wish it were true. Falling for the story will undoubtedly lead to unpleasantness.

Don't let your greed get the better of you. While the 'I have umpteen million dollars that I'm trying to sneak out of the country' e-mail's are getting old hat people are still falling for them. What is more insidious is the 'work at home as an agent' e-mail's that make it sound so easy. All you have to do is deposit a check or two each week into your personal bank account and wire transfer the funds to 'the company'. You either end up out the entire amount when the check is returned NSF or you are working for organized crime and are a money launderer.

The internet is a wonder and scary place at the same time. Be educated and play safe.

Thailand

Emirates

> Source: http://isc.sans.org/diary.html?storyid=4343

• http://oit.nd.edu/email/fullheaders.shtml

• www.us-cert.gov/current/archive/2008/04/25/archive.html#irs_rebate_phishing_scam
• www.us-cert.gov/current/archive/2008/03/31/archive.html#internal_revenue_service_tax_scams
  

• www.us-cert.gov/current/archive/2008/04/25/archive.html#federal_subpoena_email_scam

• www.us-cert.gov/current/archive/2008/04/11/archive.html#email_attack_circulating

• www.f-secure.com/healthcheck/

• www.pandasecurity.com/canada-eng/homeusers/solutions/activescan/default.htm?track=80383

• http://usa.kaspersky.com/products_services/free-virus-scanner.php

• http://secunia.com/software_inspector/

It seemed that the exploitation of SQL Injection vulnerabilities was involved in the automated attacks. The precise mechanism was unclear until earlier this week when security researchers discovered a malicious executable later linked to the attack on a hacker site.

The hacker utility used search engines to find insecure websites that it then tried to exploit using an SQL injection attack. The exploit included an SQL statement that tried to inject a script tag into every HTML page on the website.

The tool - which had an interface written in Chinese - was programmed by default to insert a tag to the same malicious JavaScript file that featured in the January attack, solid evidence that it was at least partially behind the assault.

The tool runs a script called pay.asp, hosted on a server in China. This suggests that hackers running the attack were keeping count of the number of sites they had compromised, in order to work out how much they stand to get paid.

Further analysis of the tool by security researchers at the SANS Institute's Internet Storm Centre (ISC) is ongoing. The tool came to their attention via a tip-off from Dr Neal Krawetz. The initial attack was uncovered by security researcher Mary Landesman, of ScanSafe, who described it as the time as a new type of compromise.

The constant, changing flux of the malicious JavaScript served up by compromised sites made initial analysis difficult. With the benefit of the hacker tool used to pull off the attack this all becomes much clearer, much like it was easier for scientists to unravel a cure for the mystery pandemic that blighted mankind in the Twelve Monkies after they obtained a sample of the pure source.

"The nice thing about this is that we finally managed to confirm that it is SQL Injection that was used in those attacks. The tool has more functionality that we still have to analyze but this is the main purpose," writes ISC handler Bojan Zdrnja.