CAUCE

BBC World News Facebook Account Hacked

Sadly, it can happen to anyone. Poor passwords, or clicking on an errant link can end up with something like this on your Facebook account. There is, of course, no such tool, although the landing page at http://valcreepers.tk/ will try to convince you otherwise.

 

Don't be fooled - don't add this rogue app, or any other, to your Facebook account, ever.

Yes, People Still Care About Email Spam

Just over a month ago, we posted an article entitled "Do People Still Care About Email Spam Anymore?". Part of the reason why people might not care anymore, according to this article, is that email has become passé. With so many other new ways to communicate, why even bother with email?

Not only did a few readers take the time to post some compelling counter-arguments to our article, even muckraking marketing columnist Ken Magill has weighed in on the debate. Citing a few recent studies — including a finding by the Pew Internet & American Life Project that email is still the No. 1 online activity across all age groups of internet users — Magill goes so far as to advocate a pretty hefty dose of harassment for the next person who states in public that email is dead.

According to The Radicati Group, there are currently 1.4 billion email users. A study by Nielsen found that 25 minutes out of every hour spent on a mobile device is on email. And so on.

There are reasons why email is still so popular. It is easy to use, it is (relatively) private, and it is accepted across generations and for personal and business purposes alike. You don't need a special 'app' to use it, and neither do you have to enlist with an online "community" (yes, there are still people out there who don't want to be a part of Facebook!). While most of us in the online business world are keen to broadcast our thoughts to the world via Facebook, Twitter, and whatever, there are still many people who just want to have a good old fashioned one-on-one email conversation.

And so it's pretty clear: email still matters. And, because email matters, spammers still take advantage of it. And for that reason, people still care about old-fashioned email spam. They have to.

As one commenter noted, spam is still widely used by scam artists to get their dirty hands into our private lives, and, ultimately, our bank accounts. People are still getting ripped off by spammers - whether it be through malware, phishing, fake pharmaceuticals, or whatever — and, undoubtedly, these people still care.

Another comment pointed out that, even for those of us who think that spam isn't a problem because filters manage to keep most spam from our inboxes, the cure is occasionally worse than the disease. Regardless of how good spam filtering has become, false positives will always be a problem. For anyone who has ever lost out on an important business opportunity (or maybe even a hot date) because their email didn't make it to the intended recipient, they care about spam. If it weren't for spam, we wouldn't need spam filters, and we wouldn't have to worry about legitimate emails getting hijacked on their way to the inbox.

Parents are concerned about sexually explicit messages popping up (no pun intended) in their kids' inboxes. Legitimate marketers are concerned about having to compete with spammers for space in their customers' inboxes, and the ever-present risk that their messages might be labelled as spam too. And the Nigerian government is concerned about former diplomats and members of the royal family using spam to collude with total strangers to steal millions of dollars from the government's coffers (ok, just kidding).

When people stop using email, then spammers will stop sending spam through email. Then people will stop caring about email spam. Let me know when that happens.

Some readers may wonder why an organization that advocates against spam would even ask this question. We really just wanted to see what people would say. CAUCE still thinks email is important, and spam a very real problem. And apparently at least a few really smart people agree. Let's declare this debate closed - at least for the time being.

(This article was written by a different CAUCE supporter who wishes to remain anonymous.)

I don't really want to stay in touch on LinkedIn

Imagine my surprise (I imagine yours to be similar), when whilst sitting around watching t.v. on a cold Sunday afternoon I was fiddling with my new iPad, and decided during a commercial to cross-check my gmail contacts to my LinkedIn contacts.

I was shown a short list of contacts, with no scroll-bar, (deselected a few, actually) and hit 'ok'. I saw no results, iPad did its thing where pages disappear then relaunch. Then, I tried my other gmail account.

Sigh.

The rest, as they say, is history. I'm not certain if it is because I've been on LinkedIn for a long time, have a business account, have a lot of existing contacts or some combination of these factors, but somehow LinkedIn determined I was a suitable candidate to upload two address books (yes, I overtly OK'ed this step), and invite them all to 'get in touch', or to join LinkedIn.

Included in this wonderful offer were anti-spam mailing lists, people I'd decidedly not prefer to stay in touch with, for example, spammers about whom I've complained. LI also wrote to abuse desks to whom I've complained about said spammers, and at least one (literally) dead friend, a dead email list I used to run (or, at least, I thought it was decommissioned), the billing alias for my telephone company, a whole Smörgåsbord stuffed into a cornucopia of ill-placed messaging.

I do have no small number of people who accepted my offer (my dead friend didn't). As, well, I received no small number of complaints, a total that will undoubtedly mount as people will probably complaint to abuse@cauce.org, linkedin.com and elsewhere, justifiably so.

I'm uncertain if this was due to poor UI, generally or UI that only displays on the iPad, and lousy policy regarding address book uploads at LinkedIn and the way that Google aggregates contacts; I will reiterate here what has always been my recommendation regarding such things: Limit inviatation sends to a maximum of 100 at any time, and should an uploaded list have role accounts, the send be held until the validity can be humanly verified. Neither of those things happened.

My two gmail accounts date back to 2006 and 2004 respectively, and I didn't overtly add many of these addresses to my contact list.

There you have it, a case in point and an object lesson in how powerful the tools we use actually are, and the laxity in privacy that is pervasive these days.

Of course, I apologize profusely for the intrusion.

Atypically, I've kept the comment section open for this post, feel free to stay in touch here! ;-)

--
Neil Schwartzman
Exectuive Director
CAUCE

'Official Limewire Replacement' Scamware

A friend alerted me to a piece of spam he just received with the subject line "Can't Use Limewire? We Have Your Replacement"

It includes links, presumably to downloads of some sketchy software, at 20hugeupdates.info (the site is down at the moment). The domain was created on 07-Dec-2010 16:41:26 UT.

 

As an alert to Limewire users who were left in the lurch when the software was withdrawn due to court order, there is NO official Limewire replacement, and anyone operating under these auspices, particularly by spamming, is trying to sell you a bill of goods, and quite likely infect your computer with malware.

 

From the limewire website:

 

LIMEWIRE IS UNDER A COURT ORDER DATED OCTOBER 26, 2010 TO STOP DISTRIBUTING THE LIMEWIRE SOFTWARE. A COPY OF THE INJUNCTION CAN BE FOUND HERE. LIMEWIRE LLC, ITS DIRECTORS AND OFFICERS, ARE TAKING ALL STEPS TO COMPLY WITH THE INJUNCTION. WE HAVE VERY RECENTLY BECOME AWARE OF UNAUTHORIZED APPLICATIONS ON THE INTERNET PURPORTING TO USE THE LIMEWIRE NAME. WE DEMAND THAT ALL PERSONS USING THE LIMEWIRE SOFTWARE, NAME, OR TRADEMARK IN ORDER TO UPLOAD OR DOWNLOAD COPYRIGHTED WORKS IN ANY MANNER CEASE AND DESIST FROM DOING SO. WE FURTHER REMIND YOU THAT THE UNAUTHORIZED UPLOADING AND DOWNLOADING OF COPYRIGHTED WORKS IS ILLEGAL.

 

Here is a copy of the spam:

 

Where Every Phisher Knows Your Name

Spear phishing is the unholy love child of email spam and social engineering.

It refers to when a message is specifically crafted, using either public or previously stolen information, to fool the recipient into believing that it's legitimate. This personalization is usually fairly general, like mentioning the recipient's employer (easily gleaned from their domain name.) Sometimes they address you by name. Much scarier is when they use more deeply personal information stolen from one of your contacts: if you get a message from a friend's email or facebook account referring to a recent private conversation you had with them, wouldn't you believe it was really them? Wouldn't anyone?

Though not new, spear phishing has been increasing. There's no way to measure it accurately, of course, but reports are increasing -- and getting scarier. A US State Department cable made public by WikiLeaks discusses an attack on government climate change researchers in 2009. Return Path was targeted last year, along with many other major companies in the email industry. And over the holidays, dozens of government employees -- including many who work on cybersecurity -- fell for what looked like an eCard from the White House.

Historically, phishing attacks appeared fairly innocuous, when viewed from a global perspective. After all, how much damage can be done by stealing one user's login credentials? And early on, the damage was minimal -- again, from a global perspective. Most often, the stolen account was used to send spam until their ISP's rate limits noticed, and shut down the account. Echoing Stalin, each stolen account was absolutely devastating for that individual user, but was otherwise lost in the noise.

But phishing -- and especially spear phishing -- has evolved since then. Late in 2007, phishers stole the login credentials of a salesforce.com employee, used those credentials to steal email addresses from salesforce.com, and then sent more phishing messages to those addresses.

Today, that same phish recipe is like Lipton onion soup dip: no matter how many times the phishers serve it, everyone still yums it up. And they've evolved, focusing now on specific high-value targets.

Email service providers are particularly tasty because they have lots of lists of email addresses, almost always split by interest in particular products and general demographics. By getting into ESPs, the phishers can take advantage of the hard work email marketers -- the ESPs' clients -- have put into making sure their messages are relevant and welcome to recipients. Some of the big-name brands whose lists were compromised recently via their ESP accounts include McDonalds, Walgreens, and Honda Finance, all of whom did the right thing by immediately informing their customers and offering assistance.

So far it's unclear what the bad guys will do with those stolen lists. They may just be used for spam, but it seems more likely that they'll be used for additional spear phishing. For example, knowing that a particular list of addresses belong to recent Honda buyers, they could trick people into handing over all sorts of personal financial information with a promise of lowering the APR on their loan.

Government employees are also high-value targets for the spear phishers. According to this article by leading security journalist Brian Krebs, a recent spear-phishing attack featuring a fake holiday eCard purporting to be from the White House netted hundreds of NSF grant applications, records of court-ordered cell phone intercepts, and draft policy documents relating to money laundering, terrorist financing, new technologies, and foreign aid. Though receiving (thus far) far less attention than the Wikileaks collection, this is still one of the widest known governmental data breaches in recent memory.

In that attack on government employees, the message tricked recipients into downloading malware which they thought was an eCard from the White House. The malware then stole passwords and documents from their computer, and uploaded the stolen booty to a server apparently in Belarus. This, too, is different from the traditional phishing attack where victims are encouraged to type their username, password, and other information into a duplicitous web page.

It's clear that the criminals' techniques have evolved beyond technology-only attacks, and thus so must our protections and our paranoia.

Obviously, as always, education is necessary -- though not sufficient. The Anti-Phishing Working Group has a list of the best educational materials available, but even there, user education about phishing tends to still be focused on the old, scattershot phishing methods rather than the extremely targeted attacks of today -- and on identity theft, rather than theft of corporate or governmental data.

Specific to the targeted attacks on the email industry is Return Path's own Phishing 2010 Resource Center, and we'll be writing more about this for the Received: blog.

Overall, the most important thing is to stay aware of what's going on out there so you can recognize when it happens to you. A few of the best sites for up-to-the-minute security-related information include Brian Krebs' Krebs on Security, Wired's Threat Level, Sophos' Naked Security, and the curated aggregator Box of Meat.

(This article was originally published by Return Path's Received: blog.)

Do People Still Care About Email Spam Anymore?

This may seem like a strange question for an anti-spam organization to ask.

CAUCE obviously still cares about email spam, and always will, but does anyone else?

If you talked to your friends or relatives over the holidays and asked them about the amount of spam they get in their inboxes, most of them may tell you that they rarely see it (even basic spam filtering on free email accounts has gotten pretty good).

When you talk to some younger people about email spam, be prepared for them to laugh.

They'll tell you that when they need to communicate, they'll usually use some sort of instant messaging, or maybe send text messasges from their Blackberry or their iPhone. Email just isn't relevant to them any more. ("Sheesh! What will you ask about next? Faxes? Telegrams? Papyrus? Stone tablets? Get with the modern era! Who cares about stupid email?")

For all those sort of users, email is about as relevant as horse-drawn buggies. Email is archaic. They don't care about email, much less email spam.

Other users may tell you that they do care about unsolicited email, but if you probe a little, you'll find that they really only care about certain types of "spam." Everyone hates spam that might infect their computer with a virus or other malware, and many may find it creepy to get personalized phishing messages, but we empirically know that most spam doesn't contain malware or phishing-related content.

In fact, we even find ourselves wondering about email spammers themselves.

Do any smart spammers still care about email spamming? When's the last time you saw anything even relatively creative when it came to spam? I remember being impressed the first time I saw randomized image spam, and fast flux web hosting, but since then I haven't seen a whole lot in the way of spam-related developments that are very technically impressive. (I think this may be evidence that the smart spammers have already moved on to greener and more lucrative cyber crime fields.)

Image by Getty Images via @daylife

Sending email spam has acquired an increasingly last-decade (or last-century!) sort of feeling, sort of like being a person from the Eastern Bloc still proudly driving a rattle trap Trabant. The world's moved on, even if a few Communist-era fossils haven't.

True, there are some back-of-the-pack guys who are still sending cliché spam for illegal pharmaceuticals and quick-to-break knock-off watches or untrustworthy casinos.

I'm sure it's partially a matter of intertia. If sending email spam using someone else's seldom-updated and easily detected spamware is all you really know how to do, well, I suppose that's what you're going to keep doing, even if it doesn't pay nearly as well as it used to. You're trapped in a dead end job, just like a soon-to-be unemployed factory worker who never got retrained for the the modern era.

In fact, it must be sort of depressing to be a professional email spammer. As a professional email  spammer, you really only have two career tracks: mediocrity or infamy.

If you work really hard and end up being one of the rare persons who excels at email spamming, your success virtually guarantees that you'll be the focus of undesirable attention from law enforcement. They can't go after everyone, so they understandably like to use what resources they do have to target the rare "spam king" -- someone like you.

And then there's all the waiting. Law enforcement may not work fast, but boy oh boy, some of those guys are pretty dang dogged once they get on your trail. It may take them years and years to get all the paperwork lined up, but these are very patient guys. They will eventually get all the evidence they need, and then they will reach out and arrest you, sometimes just when you're getting ready to retire somewhere nice and warm.

As a spammer, you do have options. You could intentionally try to "stay small scale" and thus stay off law enforcement's radar, but if you do, is small scale email spamming even really worth it?

See what I mean when I ask, "Do people really even care about email spam anymore?"

 

(This article was contributed by a long-time CAUCE supporter who wishes to remain anonymous.)

The Stockings Were Hung by the Chimney with Care

The ARPA Computer Network is susceptible to security violations for at least
the three following reasons:

(1)  Individual sites, used to physical limitations on machine access, have
     not yet taken sufficient precautions toward securing their systems
     against unauthorized remote use.  For example, many people still use
     passwords which are easy to guess:  their fist names, their initials,
     their host name spelled backwards, a string of characters which are
     easy to type in sequence (e.g. ZXCVBNM).

(2)  The TIP allows access to the ARPANET to a much wider audience than
     is thought or intended.  TIP phone numbers are posted, like those
     scribbled hastily on the walls of phone booths and men's rooms.  The
     TIP required no user identification before giving service.  Thus,
     many people, including those who used to spend their time ripping off
     Ma Bell, get access to our stockings in a most anonymous way.

(3)  There is lingering affection for the challenge of breaking
     someone's system.  This affection lingers despite the fact that
     everyone knows that it's easy to break systems, even easier to
     crash them.

All of this would be quite humorous and cause for raucous eye
winking and elbow nudging, if it weren't for the fact that in
recent weeks at least two major serving hosts were crashed
under suspicious circumstances by people who knew what they
were risking; on yet a third system, the system wheel password
was compromised -- by two high school students in Los Angeles
no less.

We suspect that the number of dangerous security violations is
larger than any of us know is growing.  You are advised
not to sit "in hope that Saint Nicholas would soon be there".

Sound familiar? Bob Metcalfe wrote that in December of 1973, and it was published as RFC 602. Today, gaining access to the internet is far easier than finding a dial-in number written on a bathroom wall — but the rest is more true than even Bob imagined.

C-28 Receives Royal Assent

By Shaun Brown:

It's been a long time coming, but Canada finally has an anti-spam law. Bill C-28, the law with no name, was just passed.

First introduced in April 2009 as C-27, the Electronic Commerce Protection Act, it died when parliament was prorogued in December 2009, only to be resurrected in May of this year as the Fighting Internet and Wireless Spam Act. Industry Committee members, who were unimpressed with the government's bizarre decision to amend the short title, approved the entire bill last month, except for the name. Rather than forcing the issue, everyone involved decided that it would be better to have the law passed before Christmas than go through the process of adding a new short title, which would have required approval of both the Senate and House of Commons, and delayed its passing until next year.

The bill was approved by the Senate yesterday, and received Royal Assent early this afternoon. As of right now, the unofficial name is "Canada's Online Protection Legislation", or COPL.

For those who are not familiar with C-28, it deals not only with spam by establishing an opt-in regime for the sending of commercial electronic messages, but it also addresses a number of related internet threats, including malware, spyware, phishing, and pharming. It provides the Canadian Radio-television and Telecommunications Commission (CRTC) with broad enforcement powers, including the ability to impose hefty administrative monetary penalties (AMPs) for non-compliance. It also includes a private right of action, allowing for private enforcement where public enforcement falls short.

Having been involved since the beginning, and eagerly awaiting its passage, CAUCE is excited and relieved to see Bill C-28 become law. We would like to congratulate everyone at Industry Canada as well as the agencies who worked diligently and tirelessly on this, fighting the endless bureaucratic and political process, as well as the naysayers who would have preferred to see the bill reduced to a gutless, meaningless shell of what we now have (anyone remember Do-Not-Call?).

While COPL will not solve all of the world's online problems, it provides Canada with the tools to do its part in the global fight against spam and related threats. No longer will Canada be the infamous "spam haven" of the G8. Based on best practices from around the world, it is now the gold standard for online protection that will undoubtedly serve as a model as other countries look to improve their own laws.

COPL will come into force in September, 2011, giving organizations plenty of time to ensure that they are in compliance.

C-28 The Law of The Land!

VICTORY!

It’s been a long time coming, but Canada has an anti-spam law, and one, which sets a new world standard, and a tough, but fair, opt-in protocol for everyone in North America who sends commercial email and other  electronic messages.

Yesterday, The Canadian Senate voted to accept Bill C-28, and today, December 15, at 13:00 eastern, it will be given Royal Asset of the Governor General of Canada, His Excellency the Right Honourable David Johnston.

It has been a long, arduous road to get to this point. In 1998, born as an offspring of U.S. anti-spam organization CAUCE, CAUCE Canada came into being.
 
Our mission? To get an anti-spam law passed in Canada.

Over these dozen years, there were fits and spurts along the way, with private member’s bills like that of Dan McTeague, and Senator Oliver, and several others. In 2004-2005 CAUCE played a prominent role in The Federal Task Force on Spam with full hopes of a law being forthcoming.

Years passed, and despite the final report of FASTF being readily accepted, and in fact setting standards world-wide as the seed for other laws, regulations and industry best practices, still no law.

Then, in 2009, a breakthrough – a bill, C-27, was introduced. Over the course of the year, there was testimony by CAUCErs Matt Vernhout & Dennis Dayman to parliamentary committee. There was support. There were naysayers. There was misinformation right up to the last minute, and there was grassroots use of social media.

There was heavy lobbying against the bill, and there was Conservative Minister of Industry Tony Clement who stuck to his guns and resisted attempts to gut the bill. That session of parliament came and went, and in 2010, the bill, slightly amended to deal with some technical issues, was re-introduced. Senders, industry, receivers, politicians from all parties, mandarins, and CAUCE were all in agreement: Canada needed a law, and C-28 wasn’t just good enough – it was great. C-28 now sets a best-of-breed world standard.

To all my colleagues worldwide who have helped this effort in every way possible, I extend my deepest gratitude and most profound thanks, particularly to Scott Hazen Mueller whose visionary thought lead to the creation of CAUCE in 1997.

We have had many board members come and go along the way, but CAUCE founding members Mike ‘der Mouse’ Parker, John Levine, JD Falk, and Chris Lewis stuck with the organization through highs and lows; through it all, with solid support and determination, and they deserve special mention for 12 years of work. Our newest additions, Dr. Joe St. Sauver and Shaun Brown provided sage guidance in the final stretch. Gentlemen, I thank you all, as do all Canadians (whether they know it or not) for your help to get us here.

CAUCE must also share congratulations with many from Industry Canada: André Leduc, Richard Simpson, Michael Binder, Jennifer Kealy, Shari Scott, Andy Kaplan-Myrth, Serge  Presseau, Janet Difrancesco, and many others – please forgive me if your names are forgotten in my excitement to write this - your support and work are decidedly not.

My friend Tom Copland of the Canadian Association of Internet Providers, CAIP, was a stalwart supporter of this bill, and he too merits our thanks. Of course, The Right Honourable Tony Clement who was nothing less than fantastic, for understanding the Internet well enough to have a vision, and a Twitter account, @TonyClement_MP which I abused mercilessly.

CAUCE has an incredibly talented and diverse board, with legal experts, top-notch markers, malware & botnet research elites, all faced with no shortage of work ahead to see that the law is properly implemented, and applied.

Someone recently said C-28 renders CAN SPAM obsolete. Just so, but there is still much work for us to do, to promote a harmonized legal régime throughout North America and the Caribbean, and internationally.  CAUCE will continue to be there, nagging, cajoling, pleading, advocating and demanding that the governments of the world put into place legal protections for all users of the Internet.

Governments, Politicians and Bureaucrats take note: We are your brothers, your mothers, fathers, friends and sisters. We are not consumers, we are Internet users. Respect us for that, do your duty, and protect our right to enjoy our connective technologies unsullied by the harassment of abusive, unwanted communications in all its manifestations. Your job is to draw distinct lines, well overdue, to stop rampant insanity perpetrated upon us all by the rapaciously greedy violators of our fundamental right to privacy.

The net is a place where commerce is done, but it is far more so a place where friends meet, people fall in love, students learn, dissidents agitate for political change, artists create, and folks live an enriching part of their lives. C-28 and laws like it help to protect this invaluable resource, our worldwide shared commons. Today, C-28 made all this a little more possible, and I couldn’t be happier or more proud.

One down, so many more to go! Onwards!

Neil Schwartzman
Executive Director
CAUCE, the Coalition Against Unsolicited Commercial Email

Canadian Anti-spam Bill C-28 Goes to senate Committee Tuesday Dec. 14

TRANSPORT AND COMMUNICATIONS

NOTICE OF MEETING
Tuesday, December 14, 2010
9:30 a.m.
Room 2, Victoria Building 140 Wellington Street

Clerk: Keli Hogan  (613-993-9021)

(Televised live on PTN) Webcast of Senate Meetings : http://senparlvu.parl.gc.ca/Guide.aspx

AGENDA
Bill C-28, An Act to promote the efficiency and adaptability of the Canadian economy by regulating certain activities that discourage reliance on electronic means of carrying out commercial activities, and to amend the Canadian Radio-television and Telecommunications Commission Act, the Competition Act, the Personal Information Protection and Electronic Documents Act and the Telecommunications Act.

WITNESS


          Witnesses to follow

With reporting and interpretation.

Use this link to obtain the latest information about this meeting: http://www.parl.gc.ca/Common/Committee_SenNotice.asp?Language=E&meeting_id=11575&comm_id=19