CAUCE

spamNEWS 09/28/2013

CAUCE posts regularly on topics related to spam. Here are our picks of the most interesting news items of the day.

You can follow them in real time on Twitter on Google +  or on LinkedIn

Facebook wins $3M injunction against spammer Steven Vachani aka Power.com http://news.cnet.com/8301-1023_3-57604866-93/facebook-wins-$3m-injunction-against-spammer/

Revealed: UK secretly arrested 16-year old boy for world’s ‘biggest’ DDoS-attack http://rt.com/news/uk-boy-arrested-ddos-attack-411/

Data Broker Giants Hacked by ID Theft Service http://krebsonsecurity.com/2013/09/data-broker-giants-hacked-by-id-theft-service/

DMARC Forward Reporting: Why Network Owners Should be Informed, too http://blog.abusix.com/2013/09/24/dmarc-forward-reporting-why-network-owners-should-be-informed-too/

LinkedIn Class Action http://www.linkedinclassaction.com

A Study of Whois Privacy and Proxy Service Abuse by @MAAWG STA Dr. Richard Clayton http://www.lightbluetouchpaper.org/2013/09/25/a-study-of-whois-privacy-and-proxy-service-abuse/

Is Fake iMessage App Malware or Not? http://www.enterprise-security-today.com/story.xhtml?story_id=121000A6NWYX&nl=7

Do not use iMessage Chat for Android – it’s not safe [Updated] @digitaltrends http://www.digitaltrends.com/mobile/imessage-chat-android-security-flaw/#ixzz2gDyzRIv1

ICANN and Your Internet Abuse By Garth Bruen @circleid http://www.circleid.com/posts/20130924_icann_and_your_internet_abuse/

Twitter's User Growth Slows, Perhaps As A Result Of Spam Account Purges Ahead Of IPO http://www.businessinsider.com.au/twitters-user-growth-slows-2013-9

Spam Arrest's Sender Agreement Fails Because Email Marketer's Employees Lacked Authority http://www.circleid.com/posts/20130919_spam_arrests_sender_agreement_fails/

Apple's a tasty phishing target for scammers http://www.pcworld.com/article/2049287/apple-is-a-tempting-phishing-target-for-scammers.html

Ransomware Puts Your System To Work Mining Bitcoins http://blog.malwarebytes.org/intelligence/2013/09/ransomware-puts-your-system-to-work-mining-bitcoins/

KETLER INVESTMENTS CC vs. South African INTERNET SERVICE PROVIDERS’ ASSOCIATION http://badwhois.info/Ketler_Invest_v_ISPA_JMNT_REVISED.PDF

How not to sue spammers, a cautionary tale

Spam Arrest is a company that sells an anti-spam service. They attempted to sue some spammers and, as has been widely reported, lost badly. This case emphasizes three points that litigious anti-spammers seem not to grasp:

• Under CAN SPAM, a lot of spam is legal.
• Judges hate plaintiffs who try to be too clever, and hate sloppy preparation even more.
• Never, ever, file a spam suit in Seattle.

CAUCE president John Levine has all the details on his blog.

Court rules that proxy registrations and flaky opt-out info violate CAN SPAM

A Utah court recently ruled in a CAN SPAM case Zoobuh vs. Better Broadcasting et al. The decision has two interesting aspects. The spammer used proxy registrations to hide the WHOIS contact information on the return addresses, which the court declared was a CAN SPAM violation, the first time a Federal court has said so.

Also, the required notices about how to opt out were not in the spam itself, but were (in theory at least) in images on remote web servers that the spam referred to. Noting that many mail programs don't show remote images for security reasons, the court found that they weren't an adequate opt-out.

The defendants never replied to the suit and defaulted, so even though the court awared over $1 million, there's little chance the plaintiffs will ever see any of  it. But this is a useful precedent for other people who want to use what little anti-spam protection CAN SPAM provides.

CAUCE president John Levine wrote in more detail in his blog.

The Spamhaus Distributed Denial of Service – How Big A Deal was it?

If you haven't been reading the news of late, venerable anti-spam service Spamhaus has been the target of a sustained, record-setting Distributed Denial-of-Service (DDoS) attack over the past couple of weeks.

Al Iverson over at Spamresource has a great round-up of the news, if you didn't manage to catch this item, go check it out, then come on back, we'll wait ...

Of course, bad guys are always mad at Spamhaus, and so they had a pretty robust set-up to begin with, but whoever was behind this attack was able to muster some huge resources, heretofore never seen in intensity, and it had some impact, on the Spamhaus website, and to a limited degree, on the behind-the-scenes services that Spamhaus uses to distribute their data to their customers, who happen to be some of the biggest sites and services on the Internet. Spamhaus notes they protect as many as 1.7 billion email accounts.

Some reasonable criticism was aimed at the New York Times, the BBC and Cloudflare for being a little hyperbolic in their headlines, and sure, it was a bit Chicken Little-like, the sky wasn't falling and the Internet didn't collapse.

But don't let the critics fools you, this was a bullet we all dodged.

For one, were Spamhaus to be taken offline, their effectiveness in filtering spam and malware would rapidly decay, due to the rate at which their blocklists need to be updated. The XBL anti-botnet feed and the SBL list both have many additions and deletions every day. These services are used to protect mail servers and networks against the most malicious criminal traffic. If they go down, a lot of major sites would have trouble staying up, or become massively infected with malware.

There are also a ton of small email systems that use the Spamhaus lists as a key part of their mail filtering (for free as it turns out). Were those lookups prevented, or tampered with, those systems would buckle under the load of spam that they dispense with ease thanks to Spamhaus.

To put it into perspective, somewhere between 80% & 90% of all email is spam, and thats the stuff Spamhaus helps filter. So it doesn't take a Rocket Scientist to figure out that if filters go out, so do the email systems, in short order. AOL's Postmaster famously said, at an FTC Spam Summit a decade ago, before the inception of massive botnets, that were their filtering to be taken offline, it would take 10 minutes for their email systems to crash.

Due to some poorly researched media reports (hello, Wolf Blitzer!), there is a perception that this is a fight between two legitimate entities, Spamhaus and Stophaus; some press outlets and bloggers have given equal time to the criminals (we use that word advisedly, there is an ongoing investigation by law enforcement in at least five countries to bring these people to justice). Nothing could be further from the truth. The attackers are a group of organized criminals, end of story. There is nothing to be celebrated in Spamhaus taking it on the chin, unless you want email systems and networks on the Internet to stop working.

So yeah. this was a big deal.

Postscript: There were some reports early on in the attack that some of the Spamhaus feeds may have been hijacked. There is no indication that that is ongoing.

 

Updating the Electronic Communication Privacy Act

Back 1n 1986, the Congress passed and President Reagan signed the Electronic Communication Privacy Act (ECPA), which set the rules under which the government could get copies of a relatively new-fangled medium called electronic mail. While it was a forward looking law for the 1980s, it's gotten pretty creaky. In a rare bipartisan move, Sen. Pat Leahy (D-VT) and Mike Lee (R-UT) have introduced a bill to update it. The bill is surprisingly good.

CRTC Issues CASL (Canada's Anti-Spam Law) Regulation Guidelines

The Canadian Radio-television and Telecommunications Commission today issued two important guideline documents related to their previously-published Regulations

Guidelines on the interpretation of the Electronic Commerce Protection Regulations (CRTC)
Compliance and Enforcement Information Bulletin CRTC 2012-548
PDF version
Additional reference: Telecom Regulatory Policy 2012-183
Ottawa, 10 October 2012

and

Guidelines on the use of toggling as a means of obtaining express consent 
Compliance and Enforcement Information Bulletin CRTC 2012-549
PDF version
Additional reference: Telecom Regulatory Policy 2012-183
Ottawa, 10 October 2012

As well we are told that the second-round iteration of the Industry Canada Regulations will be published later this month.

e360 vs. Spamhaus is over, e360 wins three bucks

Four years ago a bulk mailer called e360 sued the Spamhaus Project for a broad range of alleged evils interfereing with e360's allegedly highly successful email marketing business, which most of the rest of us considered to be spamming to sell junk. Due to a variety of unfortunate legal moves on both sides, it's dragged on for years. I blogged about it last year when the trial court decided that of the three causes for damage that e360 had alleged, two showed nothing, so he got a nominal $1 each, but for the third, for lost business, he awarded $27,000. Spamhaus, now ably represented pro bono by Jenner and Block, appealed on the basis that the judge had misinterpreted e360's numbers, which were in any event not credible.

Today the appeals court ruled in Spamhaus' favor, reducing the third award to $1, for a total of $3, which Spamhaus (or more likely their friends in the US) will pay. In appeals cases, the loser has to pay the winner's costs, so Jenner and Block will presumably be going after e360 for that.

For more analysis see Laura Atkins' Word to the Wise, Mickey Chandler's Spamtacular, and Venkat Balasubramani at Circle ID.