CAUCE

Announcing CAUCE

Archive.org has the following press release announcing the formation of CAUCE. Happy birthday to us!

Internet, May 9, 1997--The Coalition Against Unsolicited Commercial Email (CAUCE) announced today that it is calling for a legal ban on unsolicited Email advertising. CAUCE has drafted an amendment to the federal law that bans unsolicited fax advertisements, to extend it to cover unsolicited Email advertising on the same terms. The proposal would give Email users control of the kinds of advertising they are willing to accept in their mailboxes, whether they prefer to shut it off completely, or ask for more.

The junk fax law (more formally, portions of 47 USC 227), provides that businesses may offer goods and services in fax messages only if the recipient has asked for the information or has a previous business relationship with the company. Recipients may ask to be taken off mailing lists at any time. Violation can result in a civil penalty of $500 per message, or more in the case of clearly willful violation or failure to provide a valid return fax number. Extending the same terms to Email should work equally well, according to CAUCE.

The arguments against junk Email and junk fax are very similar. Cost shifting to the recipient and denial of service are two of the most important. For example, many Email users and mailing lists have a daily limit on traffic, so UCE can displace other traffic and prevent it getting through.

"Starting from an existing law has several important advantages," said CAUCE co-founder Edward Cherlin. "We have a law that has worked well, that covers a very similar problem, and that has passed a constitutional challenge in court. The only thing really wrong with the junk fax law from our point of view is that so few people know it exists, so junk fax still continues on a small scale. That makes education the number two priority for us, behind getting the law passed."

The CAUCE Web site at http://www.cauce.org is an important part of the organization's education campaign. It offers information about UCE and the proposed amendment, a FAQ (Frequently Asked Questions) page, and a sign-up page where visitors can join CAUCE to receive a newsletter on Spam issues, or register their support for the proposal. Electronic signatures will be sorted and delivered to the appropriate Senators and Representatives.

The site also explains why other proposed solutions to UCE don't work, and how UCE harms other businesses. Because of UCE, many people are unwilling to deal with any online business. In particular it is impossible to create anything like a complete Internet Email directory service, since it would be used to generate mailing lists.

"We're not against commerce on-line. We're just against paying to receive junk mail. It's time-consuming to deal with, and it's incredibly costly - a cost which has to be passed on by the Internet Service Provider (ISP) to their subscribers." said CAUCE member John Mozena.

The Coalition Against UCE (Unsolicited Commercial Email) was founded by Scott Hazen Mueller, Vice President for Engineering for Whole Earth Networks, Edward Cherlin, Vice President for Business Development of NewbieNet, a free educational service for novice Internet users, and Doug Muth, a UNIX system administrator. The lobbying effort in Washington is led by Ray Everett-Church, a contractor with various ISPs on computer security issues.

For more information on the Coalition and its lobbying efforts, visit its Web home page at http://www.cauce.org. The CAUCE Web site explains the Spam problem, gives the text of the current law prohibiting junk faxes and the proposed amendment, and answers common questions about the proposal.

More information on UCE, or "spam", can be found at http://spam.abuse.net/spam. The current text of 47 USC 227 is available at http://www.law.cornell.edu/uscode/47/227.html.

More information on CAUCE can be found at http://www.cauce.org.

For more information on the coalition and its lobbying efforts, contact:
Scott Hazen Mueller
Phone: (415) xxx xxxx
E-Mail: scott@zorch.sf-bay.org
Edward Cherlin
Phone: (916) xxx xxxx
E-mail: cherlin@newbie.net.
WWW: http://www.newbie.net/Newbie_Pages/new39.html
Ray Everett-Church
Phone: 202 xxx xxxx 
E-mail: everett@everett.org

How to wreck a top level domain with spam

The .PW domain is assigned to the tiny island nation of Palau, but they've rented it to a company that's rebranded it as "Professional Web" and signed up thouands of registrants, offering low prices and little oversight. Unsurprisingly, spammers flocked to the domain, with predictably bad results.

CAUCE president John Levine blogged about it, with a followup.

Boston Marathon Scams

Don't Be Scammed

Predictably, within hours of the tragic bombings yesterday that took place in Boston, scam domains in their hundreds, and fake social media pages began to spring up. To profit from a tragedy is contemptible, and CAUCE officers are doing their level best to ensure these domains are blocked, and taken down as quickly as possible.

Like you, we all mourn those who had their lives taken from them in Boston, and stand with those who were injured and affected by these vile deeds.

If you want to contribute in some way, please donate blood or money to the Red Cross. Go directly to their website here : http://www.redcross.org/news/press-release/Red-Cross-Statement-on-Boston-Marathon-Explosions 

The Spamhaus Distributed Denial of Service – How Big A Deal was it?

If you haven't been reading the news of late, venerable anti-spam service Spamhaus has been the target of a sustained, record-setting Distributed Denial-of-Service (DDoS) attack over the past couple of weeks.

Al Iverson over at Spamresource has a great round-up of the news, if you didn't manage to catch this item, go check it out, then come on back, we'll wait ...

Of course, bad guys are always mad at Spamhaus, and so they had a pretty robust set-up to begin with, but whoever was behind this attack was able to muster some huge resources, heretofore never seen in intensity, and it had some impact, on the Spamhaus website, and to a limited degree, on the behind-the-scenes services that Spamhaus uses to distribute their data to their customers, who happen to be some of the biggest sites and services on the Internet. Spamhaus notes they protect as many as 1.7 billion email accounts.

Some reasonable criticism was aimed at the New York Times, the BBC and Cloudflare for being a little hyperbolic in their headlines, and sure, it was a bit Chicken Little-like, the sky wasn't falling and the Internet didn't collapse.

But don't let the critics fools you, this was a bullet we all dodged.

For one, were Spamhaus to be taken offline, their effectiveness in filtering spam and malware would rapidly decay, due to the rate at which their blocklists need to be updated. The XBL anti-botnet feed and the SBL list both have many additions and deletions every day. These services are used to protect mail servers and networks against the most malicious criminal traffic. If they go down, a lot of major sites would have trouble staying up, or become massively infected with malware.

There are also a ton of small email systems that use the Spamhaus lists as a key part of their mail filtering (for free as it turns out). Were those lookups prevented, or tampered with, those systems would buckle under the load of spam that they dispense with ease thanks to Spamhaus.

To put it into perspective, somewhere between 80% & 90% of all email is spam, and thats the stuff Spamhaus helps filter. So it doesn't take a Rocket Scientist to figure out that if filters go out, so do the email systems, in short order. AOL's Postmaster famously said, at an FTC Spam Summit a decade ago, before the inception of massive botnets, that were their filtering to be taken offline, it would take 10 minutes for their email systems to crash.

Due to some poorly researched media reports (hello, Wolf Blitzer!), there is a perception that this is a fight between two legitimate entities, Spamhaus and Stophaus; some press outlets and bloggers have given equal time to the criminals (we use that word advisedly, there is an ongoing investigation by law enforcement in at least five countries to bring these people to justice). Nothing could be further from the truth. The attackers are a group of organized criminals, end of story. There is nothing to be celebrated in Spamhaus taking it on the chin, unless you want email systems and networks on the Internet to stop working.

So yeah. this was a big deal.

Postscript: There were some reports early on in the attack that some of the Spamhaus feeds may have been hijacked. There is no indication that that is ongoing.

 

Dennis Dayman is a Distinguished Fellow of the Ponemon Institute

CAUCE Board member Dennis Dayman announces he was just named a Distinguished Fellow by the Ponemon Institute, a research center dedicated to privacy, data protection and information security policies.

Ponemon Institute Fellows represent some of the top privacy and security strategists in the world, associated with many of the leading brands in this space. The organization helps provide both the private and public sectors with a clearer understanding of the trends, perceptions and potential threats that will affect the collection, management and safeguarding of personal and confidential information. Ponemon Distinguished Fellows are nominated and selected by their peers. http://www.ponemon.org/ponemon-institute-fellows

Congratulations, Dennis!

Updating the Electronic Communication Privacy Act

Back 1n 1986, the Congress passed and President Reagan signed the Electronic Communication Privacy Act (ECPA), which set the rules under which the government could get copies of a relatively new-fangled medium called electronic mail. While it was a forward looking law for the 1980s, it's gotten pretty creaky. In a rare bipartisan move, Sen. Pat Leahy (D-VT) and Mike Lee (R-UT) have introduced a bill to update it. The bill is surprisingly good.

Facebook, their Walled Garden, and McAfee Anti-Virus – What Really Happened

On Sunday, a number of Facebook users reported being locked out of the system. When they attempted to log in they were presented instead with the a series of screens, informing them that their computer was infected, and providing a link to a free scanning service by McAfee antivirus software.

Being locked out upset people to no end, because it was the first they had heard about their computer being infected.

It appears that Facebook users on a grand scale are receiving a notice that their account is temporarily locked and could be infected with a virus. These users are then encouraged to download a free tool by McAfee to scan their system. There has been much speculation on the issue. Our best guess is that there is a bug in Facebook's filters or algorithms that is yielding a false positive malware result for a large portion of these users. We have reached out to Facebook regarding the matter and will update this thread if we hear anything back.
Other users with Mac computers insisted they were safe.

If only that were true. Over just these past few weeks we have read about Facebook itself being hacked due to a vulnerability in Oracle’s common cross-platform (Windows, Mac, UNIX) software component Java. Media-player Adobe Flash has had a tough time of it too being repeatedly patched, then re-hacked within days, and that runs on all sorts of computers. One Adobe rep, looking very tired, said recently that things were so busy with security issues staff had taken to sleeping at the office. Like, as in ‘moved in’.

Our point? It was entirely reasonable to think that Facebook was detecting infected computers trying to log into their systems.

Wait what? Facebook is scanning their users computers?

Yes, they are. This isn’t a new activity. For example, Google and Facebook helped quell a massive infection called DNSChanger by diverting infected users to special pages with disinfection information U.S. Cable ISP behemoth Comcast also scans their users’ computers and in the case of repeated, untreated infections, user accounts are placed in a so-called ‘walled garden’ limiting Internet access until they can be fixed.

Walled Gardens are a reasonable approach, and an effective way to deal with the rampant levels of compromised computers that can damage networks, and the users’ themselves, by stealing personal information on the machine. In fact, CAUCE has representation on the FCC’s Communications Security, Reliability and Interoperability Council (CSRIC) working group advocating a similar approach industry-wide.

CAUCE has also been involved in parallel discussions in Canada, where the idea is still nascent, but is likely to take hold shortly. But what does all this have to do with Facebook Users? Facebook scans computers connecting to their network for infections, and places compromised user computers in a walled garden until the problem can be remediated. They offer free tools to help. They write certain rules for the scanning engine to detect the infections Reasonable enough. According to a Facebook rep., speaking on condition of anonymity said the problem last Sunday was a new employee wrote rules that were a bit too aggressive, and they incurred many false positive results, falsely indicating computers were infected when they were not. After a couple of hours, the error was caught, and initially they withdrew the rules, and then began to find, and reverse the suspended status of those users they had initially blocked. This lead to what users were experiencing– log in once, you are told you are infected, log in again, no such notice. This is what is known in the computer industry by the technical phrase ‘oops’. CAUCE congratulates Facebook (and others) on their efforts to help mitigate computer compromises by this approach. While it is irksome, and sometimes scary to be locked out, and told your computer is infected, the worst-case scenario is that you were unable to post cat and baby photos for a short time on Sunday, and had to run a harmless anti-virus scan.

What happens when people respond to pharma spam?

NPR's Planet Money did a remarkable piece yesterday, based on research by reporter Brian Krebs and UCSD professor Stefan Savage, looking at pharma spam (black market pharmacies selling prescription drugs), who sends it, and what happens when people respond.

The most surprising discovery was that, for the most part, people actually get the drugs they order. Listen to the Planet Money episode for the full story.

Are You Donating to a Real Charity?

Please share this post.

After a tragedy, many of us want to donate to funds and charities to show our support for a community.

However, scam charities immediately pop up, looking to steal your well intentioned donations. There are at least 30 newly-registered domains created in the past 48 hours related to the tragic shootings at the Sandy Hook elementary school in Connecticut: Most, probably all are scams and rip-offs. How then, to donate so that your funds make it to the deserving victims?

Check out Charity Navigator, an online database that assesses charities based upon revenues, operating costs, and the percentage of funds that make it to the intended recipients.

Donate to the Red Cross / Red Crescent / Magen David Adom. The International Red Cross is a stalwart organization that is reliable, and extremely well-run. The Red Cross of America has a fund for the families and survivors of the Sandy Hook shootings.

News site CNN usually will make mention of an appropriate charity. They report that the United Way of Western Connecticut have set up a Sandy Hook School Support Fund at https://newtown.uwwesternct.org/

If you encounter what you believe to be a scam charity, report them to your local police, federal government or police force, and to the Internet Crime Complaint Center

TEN STEPS : What To Do if Your Data is Being Held for Ransom

 

We have your data. Fork over the money!

 

For the past few months, so-called 'Ransomware' has been very popular among online criminal gangs. A computer is infected with malware which encrypts some or all of the data on the computer, and the criminals demand a payment to restore the machine to normal.

This ofen comes with a fake warning from the national law enforcement agency of the location of the computer, such as the FBI in the US, and geo-locates the payment to dollars or Euros as appropriate. Sometimes the warning claims pirated content or illegal pornography has been found on your machine. While we don't know what you have been downloading, we can say this: Law enforcement won't infect your computer and demand ransoms.

It can happen to anyone: the Miami Family Medical Centre, in the Gold Coast of Australia has reportedly lost patients' medical records to this scheme.

So, what to do, and how to avoid being held to ransom for your favorite grandkid's pictures, your PhD dissertation, or that quarterly report you've been working on for weeks?

1. Do not try to remove the malware yourself. Some variants have trip-wires built in that erase your data permanently if you do the wrong thing.

2. Back up your files religiously.

By religiously we mean constantly, at least several times a day. You can do this automatically with many back-up programs like Apple's Time Machine that back up changed files every hour, and then all files once a day.

3. Use Cloud Services for important data - keep stuff you can't live without somewhere else, like a central server if your organization has one, or box.com, dropbox.com, Google drive, etc.

4. Keep your software and operating system up to date every day! Use Windows Update set to automatically install updates, and Secunia, to alert you to updates to your other applications, if you are a PC user. Apple machines also have automatic checks for software and OS updates.

5. Run anti-virus software. Yes, even if you have an Apple computer! While A/V software can miss some viruses, it generally catches up pretty quickly and is your first line of defense.

6. Install the MyWOT plugin onto all of your browsers. My WOT blocks access to malicious sites.

7. If you are infected, and have anti-virus software that failed to detect the malware - wait if you can. As variations of the malware come out, so too do updates to anti-virus programs - see if you can update your a/v software, as it may be able to decrypt the stolen data.

8. If you have backups, or your data is stored on a cloud service, have an expert help wipe your machine completely clean, reinsstall your operating system and software, and then restore your data from a backup version prior to the infection.

9. If you are really stuck - as a last resort, pay the ransom. Paying the ramsom reportedly works in some cases. But try everything else first, because it may just tell the criminals that you're a live one, so they can come back for more.

While we don't encourage people to give money to criminals, if the data is irreplacable, you may have to give this a try if all else fails.Then start making backups. If you need to buy a backup disk, do so, now that you know what a good investment it is.

10. Don't respond to spam. Never click on it - delete it immediately