CAUCE

moving the web site

If you can see this on www.cauce.org, then we've successfully moved the CAUCE North America web site to the Typepad blog hosting service.

Unfortunately, Typepad doesn't support the URL scheme we were using before, which means most links into individual articles will now be broken.  Many apologies for the inconvenience.

A Word of Warning about your Donation to Charity

Many of us have seen the heart-wrenching scenes from the world’s latest natural disaster, in Haiti, and want to help.

Unfortunately, there are some who would take advantage of the situation, and people’s charitable nature, and put fraudulent requests for money online. As Linda McGlasson over at the Bank Info Security blog said ‘there Is a special place in hell’ for people like this.

Let’s hope so, because the sad, awful truth of it is that Symantec is reporting this morning that they have already seen spam fraudulently claiming to be from the Red Cross, soliciting donations for Haitian Earthquake relief funds. There have been sporadic reports of fraudulent tweets on Twitter, and some Google search results have been skewed in an attempt to divert people to malware and phishing sites.

Do not use links to potentially fake charities from anywhere but the most trusted of reliable sources.

To be safe, check the list of charities at www.whitehouse.gov

If you are in Canada, the Canadian government is matching private donations – you can find more information here.

If you are in another country, check out your federal government’s or local newspapers’ websites to find out where best to send funds.

Lastly, and most importantly, don’t let these bad actors scare you off from doing the right thing. Please donate generously, if for no other reason than to prove the world is a better place than they make it out to be.

By the way, please feel free to repost or tweet this article.

This Decade in Spam: 2009

In 2009, Sanford Wallace was sued under CAN-SPAM by Facebook. The BBC controlled a botnet. Canada introduced serious anti-spam legislation, which didn't make it through the legislative process. Alan Ralsky pled guilty and went to prison with his co-conspirators. ISP Pricewert was taken down by the FTC for hosting botnet controllers, MEGA-D takes a hit as a result. Fireye took down the remnants later in the year. Habitat UK spammed Twitter using Iranian election hash tags. James Gordon lost his case against Virtumundo. Herbal King spammers Lance and Shane Atkinson are fined under New Zealand, Australian and American anti-spam law. Vodafone was fined for spamming for Coca-cola. ASIS lost its CAN-SPAM case against AzoogleAds. The Anti-phishing Working Group said that phishing was up 600% over 2008

January 2009

Google was ranked the 'Third Worst Spam Provider' by Spamhaus.

Australian Communications and Media Authority (ACMA) fined Australian firm Optus $110,000 for mobile phone spamming. They had also successfully sued DC Marketing the previous year.

The decline of spam after the Atrivo and McColo take-downs was a temporary respite. Spam slammed back up 150% in the two months following their 'demise'

Messagelabs noted that financial scam spam lept in numbers early in the year.

Taiwan's National Communications Commission drafts 'Regulations of Unsolicited Commercial E-mails'. The draft includes private right of action and stipulated damages.

Soon-to-be-convicted spammer Lance Anderson has a cure for spam: "If you don't want to receive spam, don't connect to the internet, or don't have an email address." Later in the year, law enforcement from New Zealand, America, and Australia had a solution to spam Atkinson sent.

February 2009
Google's Gmail has a massive false positive problem for a few hours, filtering everything to bulk. Spam problem solved!

KnujOn names Xinnet.com, a Chinese registrar, linked to more than 3 million spam messages between June 2008 and January 2009 as the worst on the net.

The house of the state of Virginia approved changes to the anti-spam law to address the constitutionality issues.

Sanford Wallace, Adam Arzoomanian, and Scott Shaw face charges brought under CAN-SPAM by Facebook. Wallace and Walt Rines had been found guilty of spamming MySpace users the year previous, and fined $230,000,000.

March 2009
The U.S. Federal Bureau of Investigation applied for a search warrant to do forensic analysis of the computers seized from Josh Holly in late 2008. Holly had hacked the MySpace administrative control panel, and used celebrity email and MySpace accounts to spam, earning himself $100,000.

The Security and Exchange Commission settled with Jonathan Randall Curshen (the case was initiated 2003).

The U.S. Supreme Court declined to consider the Virginia Attorney General's petition for a writ of certiorari to review the decision of the Supreme Court of  Virginia deeming the anti-spam law unconstitutional.

Click, a BBC television show, rented a botnet. Some felt that the BBC broke the British Computer Misuse Act by doing so.

American Brendan Paul Battles now of Browns Bay, New Zealand and Image Marketing Ltd (co-owned by Battles, Tan Chor Thien and Walter Scheer) were linked to mobile phone spam.

Darrel T. Uselton and his uncle Jack E. Uselton settled pump & dump charges with the U.S. Securities and Exchange Commission, disgorging $2,800,000.

April 2009
U.S. Senators Olympia Snowe and Bill Nelson introduced the m-Spam Act to strengthen the FCC and FTC's powers to fight mobile phone spamming.

The Conservative Government of Canada introduced bill C-27 into the House of Commons.

Amir Ahmad Shah, 28, of St. Louis, Missouri, his brother, Osmaan Ahmad Shah, 25, of Columbia, Missouri; Liu Guang Ming, a citizen of China; and Paul Zucker, 55, of Wayne, New Jersey are charged by the U.S. Department of Justice under CAN-SPAM for scheme where they stole and then spammed 8,000,000 student email addresses at colleges and universities.

June 2009
Sanford Wallace faced jail-time for ignoring an injunction to stop spamming Facebook

ISP Pricewert was unplugged by the FTC after suspected intrusions into NASA, and being behind numerous spam campaigns. Botnets Pushdo and Mega-D take a hit, spam from them dropped off significantly.

Chinese mobile phone firms limited the number of text messages that can be sent from phones. A mobile number cannot send more than 200 messages per hour or 1,000 per day on weekdays, and on holidays, the limits are 500 messages per hour and 2,000 per day under new rules.

According to Gary Warner, director of research in computer forensics at the University of Alabama at Birmingham, Chinese domains accounted for 70% of all TLDs seen in spam in the first part of 2009. This is apparently due to the availability of bullet-proof hosting in China. eName and Xin Net Technology (previously noted by KnujOn) are named in his report.

Alan Ralsky joined the rest of his co-defendants and pled guilty to stock manipulation charges

British Furniture store Habitat UK intentionally misused Twitter hashtags related to the Iranian elections. They apologized.

July 2009
Microsoft filed suit against Hong Kong-based Funmobile and its US subsidiary Mobilefundster. They allegedly held phished sites sporting spam payloads.

A survey by MAAWG reveals that 30% of consumers polled admit to responding to spam email.

David S. Patton, 49, of Centreville, Virginia, pled guilty for creating a botnet as his part of the Alan Ralsky stock spam scheme.

Evidence showing the links between Canadian Pharmacy and the Storm botnet grew.

MXLogic was acquired by McAfee for $140,000,000.

August 2009
Yahoo! researchers arrived at the same conclusion as Bill Gates did years previous with Penny Black, but they called it 'CentMail' wherein people would be charged for email sent.

Twitter is taken offline by a DDoS. The attack was against one Twitter user, Cyxymu
http://www.theregister.co.uk/2009/08/10/twitter_hack_fallout/print.html

The Ninth US Circuit Court of Appeals upheld a lower court rulings that James S. Gordon Jr. lacked standing to sue Virtumundo Inc. under CAN-SPAM nor the Washington state anti-spam laws.

A spate of rogue Facebook apps looked to steal user login account information.

September 2009
Alton in Hampshire, United Kingdom, takes first place as the most-spammed city in Britain, from former 'winner' Alton, according to Symantec Messagelabs. Colin Wells of Dawlish, Devon, is Britain's 'most spammed man', receiving millions of spam yearly.

Hong Kong complained that it is under siege from botnets.

October 2009
Google said the level of spam they dealt with daily makes the Storm botnet look 'small'.

The Bredolab was released in an attempt to re-grow the Cutwail botnet.

Mobilegate Ltd and Winning Bid Pty Ltd., and Simon Anthony Owen, Tarek Andreas Salcedo and Glenn Christopher Maughan are found guilty of mobile phone text spamming in Australia. They are fined $15,000,000.

November 2009
Alan M. Ralsky, from West Bloomfield, Michigan., Ralsky's son-in-law Scott Bradley, also from West Bloomfield, Michigan,  John S. Bown, from Fresno, California, and How Wai John Hui, a resident of Hong Kong and Canada were sentenced to prison for their involvement in a stock fraud spam scheme.

Shane Atkinson was fined $71,870, Roland Smits was fined $35,915, and Lance Atkinson fined $71,870 in Australia for their part in the Herbal King spam ring.

FireEye took down the Mega-D botnet. 264,784 unique IP addresses were related to the botnet, each capable of sending 15,000 spam per hour

The Australian Communications and Media Authority (ACMA) accepted enforceable undertakings from three companies - Vodafone, New Dialogue and Big Mobile for mobile phone text spam on behalf of Coca-Cola. Vodafone was fined $110,000.

The Korea Communications Commission cut the total number of mobile phone texts each user could send per day to 500.

Spam containing shortened URLs spiked, trashing yet another useful service on the net.

Lance Atkinson is ordered to pay $15,200,000 under the FTC's CAN-SPAM suit against him.

Harvard Law School and Harvard Faculty of Arts and Sciences email is marked as spam by Google's Gmail.

The CAN-SPAM case against Epic Advertising and AzoogleAds filed by ISP ASIS failed, because ASIS could not prove economic damages.

The Anti-Phishing Working Group noted a 600% rise in phishing in 2009

December 2009
Cisco's annual security report noted that social networks were where criminals focused their attention in 2009

Messagelabs predicted the rise of self-healing botnets in 2010.

U.S. attorneys Julie Beck and Christopher Graveline, of the United States Attorney’s Office — Eastern District of Michigan, were honored for their prosecution of Alan Ralsky

ECPA, Canada's anti-spam bill C-27, died on the vine when the Canadian parliament was prorogated.