CAUCE

BBC World News Facebook Account Hacked

Sadly, it can happen to anyone. Poor passwords, or clicking on an errant link can end up with something like this on your Facebook account. There is, of course, no such tool, although the landing page at http://valcreepers.tk/ will try to convince you otherwise.

 

Don't be fooled - don't add this rogue app, or any other, to your Facebook account, ever.

I don't really want to stay in touch on LinkedIn

Imagine my surprise (I imagine yours to be similar), when whilst sitting around watching t.v. on a cold Sunday afternoon I was fiddling with my new iPad, and decided during a commercial to cross-check my gmail contacts to my LinkedIn contacts.

I was shown a short list of contacts, with no scroll-bar, (deselected a few, actually) and hit 'ok'. I saw no results, iPad did its thing where pages disappear then relaunch. Then, I tried my other gmail account.

Sigh.

The rest, as they say, is history. I'm not certain if it is because I've been on LinkedIn for a long time, have a business account, have a lot of existing contacts or some combination of these factors, but somehow LinkedIn determined I was a suitable candidate to upload two address books (yes, I overtly OK'ed this step), and invite them all to 'get in touch', or to join LinkedIn.

Included in this wonderful offer were anti-spam mailing lists, people I'd decidedly not prefer to stay in touch with, for example, spammers about whom I've complained. LI also wrote to abuse desks to whom I've complained about said spammers, and at least one (literally) dead friend, a dead email list I used to run (or, at least, I thought it was decommissioned), the billing alias for my telephone company, a whole Smörgåsbord stuffed into a cornucopia of ill-placed messaging.

I do have no small number of people who accepted my offer (my dead friend didn't). As, well, I received no small number of complaints, a total that will undoubtedly mount as people will probably complaint to abuse@cauce.org, linkedin.com and elsewhere, justifiably so.

I'm uncertain if this was due to poor UI, generally or UI that only displays on the iPad, and lousy policy regarding address book uploads at LinkedIn and the way that Google aggregates contacts; I will reiterate here what has always been my recommendation regarding such things: Limit inviatation sends to a maximum of 100 at any time, and should an uploaded list have role accounts, the send be held until the validity can be humanly verified. Neither of those things happened.

My two gmail accounts date back to 2006 and 2004 respectively, and I didn't overtly add many of these addresses to my contact list.

There you have it, a case in point and an object lesson in how powerful the tools we use actually are, and the laxity in privacy that is pervasive these days.

Of course, I apologize profusely for the intrusion.

Atypically, I've kept the comment section open for this post, feel free to stay in touch here! ;-)

--
Neil Schwartzman
Exectuive Director
CAUCE

Kidnapping, Theft and Rape Are Not "Cyber" Crimes

Kidnap. Rape. There are no lesser words that can be used to describe what happened to the daughter of an anti-spam investigator in Russia.

His daughter was recently released, according to Joseph Menn’s recent article on Boing Boing, after having been kidnapped from her home five years ago, fed drugs, and made to service men, as a warning to ward off further investigations.

The criminals behind these vicious acts were also responsible for large spamming organization associated with Russian Mob activity.

Note that we say "also."

When someone is mugged, harassed, kidnapped or raped on a sidewalk, we don't call it "sidewalk crime" and call for new laws to regulate sidewalks. It is crime, and those who commit crimes are subject to the full force of the law.

For too long, people have referred to spam in dismissive terms: just hit delete, some say, or let the filters take care of it. Others — most of us, in fact — refer to phishing, which is the first step in theft of real money from real people and institutions, as "cyber crime." It's time for that to stop.

Some of these crimes involve technology. So what? Criminals have used technology before.

Some of these crimes cross borders. So what? Crimes have crossed borders before.

Spam isn't illegal everywhere yet. So what? Spam 2.0 (spam, malware & spyware) is the leading edge of far worse activities, often things that have been illegal as long as we've had laws.

It is high time that governments and law enforcement stop thinking of computer crime as that perpetrated by teenagers in their parent’s basement. It is the Russian Mob and other organized criminals that are doing this.

While we are at it, we should mention ‘cyber-warfare’, something too often conflated with cyber-crime. Cyber-crime is not "cyber-warfare.” There may be state or terrorist agencies copying the tactics and methods of these criminals, but that does not mean that the criminals must be left alone until new cyber-warfare agencies have been created and funded.

As Purdue computer science professor ‘Spaf’ Spafford was recently quoted as saying in a note-worthy piece ‘Cyberwar Vs. Cybercrime’ on the GovInfo Security blog

"Why aren't we seeing the investment and prioritization being made in law enforcement, first? Why is all the publicity, funding and prioritization being given to the military - with efforts such as the build-up of the military cyber command - when so much of the clear and present threat is from the criminal element and not from other nation-states?"

Just so, Prof. Spafford!

As we have said repeatedly on this site, these are criminal gangs who have found an incredible loophole in the justice systems of the world: they can rob banks and people, with little chance of getting caught, let alone going to jail. This is not because they're doing things that aren't illegal; they've just found a new way to hide.

David Black, manager of the RCMP's cyber infrastructure protection section recently said to CAUCE Executive Director Neil Schwartzman “we don’t do spam”. OK, but why not? Spam is no longer, and hasn’t been for some time, about simply sending unwanted emails. Spam is now a delivery mechanism for malware, which in turn threatens infrastructure, and facilitates theft. We have seen precious few cases filed using existing Federal computer intrusions laws in Canada, and none, to our knowledge have been filed under the renovated anti-phishing law, S-4, passed in September 2009.

Governments and law enforcement agencies need to begin to treat online theft with the same seriousness as they do other physical crimes. It is time to bring this up to the diplomatic level, or seriously consider refusing packets from places that treat the Internet, and innocent victims, as their personal ATM.

CAUCE is made up of people who care about email qua email. We understand it, we love it. It is still the ‘killer app’. Furthermore, we understand why some folks in law enforcement or the judiciary might ask, "When there are people stealing millions or hurting people in the commission of violent crimes, why are you wasting our time with 'just' a spam case?” Here's why:

1. Most spam is sent by organized criminal gangs, just like other organized crime.
2. Those gangs intentionally operate trans-nationally, in an effort to frustrate investigation and prosecution.
3. Money laundering of the proceeds from spam is routine, and that money directly fuels official corruption and other social ills.
4. Some spammers are actually selling something. Their favorite product? Counterfeit pharmaceuticals. In many cases these may be scheduled controlled substances, sold in bulk, and available to minors; in other cases, critical medicines needed to properly treat cancer and other serious illnesses may be counterfeit placebos, with potentially tragic results.
5. Spammers operate by compromising tens or hundreds of thousands of end-user PCs, violating those users' privacy and sometimes steal sensitive personally identifiable information such as individuals’ and even corporate access to financial services at the same time they're using their systems to spam. Computer ‘phishing’ is no less a crime than bank robbery, home invasion, and mugging.

Cyber criminals consider cyber crime to be a virtually riskless offense; they're unlikely to be identified; if identified, they're unlikely to be investigated; if investigated, they're unlikely to be charged and prosecuted; if prosecuted, they're unlikely to be convicted; if convicted, they're unlikely to do jail time.

The courts need to make it clear that that's wrong in all respects. If you commit cyber crimes, you will be identified, investigated, charged, prosecuted, convicted and sentenced to serious time and we will seize your assets.

This will not happen so long as crime, which involves the Internet, is dismissed as "cybercrime" and either scoffed at, or used to justify ever-increasing cyberwarfare budgets

This isn't just email. This isn't a war. This isn't "cyber.” This is crime. It is time to call a cop, and expect a response.

 

by CAUCE Executives J.D. Falk & Neil Schwartzman

Resources for Cleaning Your Network

Image by dr.jd via Flickr

The first step (but certainly not the last) towards saving the internet from spam, malware, and other abuse is to keep your own network clean.

A friend of CAUCE, who wishes to remain anonymous, offers these tips and resources to help you identify problem traffic emanating from your network, and clean it up.  Though primarily written for ISPs, many of the items below should apply equally well to any network owner.

Zero-point: Problems which aren't identified don't get fixed. So...

First and foremost, proper identification of the ISP's IPs in both RIR (APNIC) and rDNS. Along with that, working and properly processed Abuse e-mail contact for APNIC and "abuse@domain" for the generic rDNS primary domain. Correct domain whois goes hand-in-hand.

Then, in no particular order...

Block port 25 on dynamic ranges, as recommended by MAAWG.

Complaint Feedback Loops and other abuse reporting mechanisms: Spamhaus and Word To The Wise both have links to get started on those, and ISPs serious about cleaning up should subscribe all their IP ranges to as many of those FBLs as they can handle. (The best for spam detection would be subscribing to all of them but volume can get quite high so they may wish to pick and choose what fits their needs the best.)

That includes SpamCop, but it's worth its own mention. Unlike most other FBLs, SpamCop reports spamvertised URLs as well as spam source. Note that it has both direct spam reporting and "Summary" reports which provide IP-by-IP reporting for a subscribed range on an hourly or daily basis.

www.abuse.net can help them direct spam reports to the right place.  SpamCop seems to look at Abuse.net, too.

CBL offers rsync of its data within terms of use posted on its website. An ISP with that data can use grepcidr across its IP ranges to identify currently active spam-bot IPs.

Spamhaus PBL provides participating ISPs with CBL's list bots in the respective ISP's IP ranges, so that's another easy way for ISPs to get that same data.

Botnet C&C and malware related IPs identified by the FIRE group can be
found by ASN with http://maliciousnetworks.org/ .

Senderbase.org, Trustedsource.org and Senderscore.org websites all have searchable reputational information which can help an ISP corroborate reports they get with a wider sample of traffic...very useful.

I'm sure there are more such resources, I'd be interested in them and I hope others will chime in, but for an ISP which is already overrun with spam issues, those websites should at least give them grist to start grinding away at the problems. I suspect the more difficult challenge will be to get them to actually back the effort.

Any ideas?  Post them in the comments, and maybe our anonymous friend will join in too.

Related articles by Zemanta

• Computerworld: Outbound spam: the canary in the coalmine (boxofmeat.net)
• Which "experts" do you listen to? (spamtacular.com)

ARIN makes a sane decision about IP WHOIS

The recent ARIN XXV meeting in Toronto had two positive developments related to WHOIS privacy and accuracy of data.

A decision was rendered about contentious proposal 2010-3: Customer Confidentiality https://www.arin.net/policy/proposals/2010_3.html which allowed for commercial IP holders to have hidden WHOIS records, ostensibly to prevent client poaching between ISPs. As one commenter said at the meeting 'if you are losing customers, fix your business'.

Both CAUCE and MAAWG were opposed to this proposal, which was withdrawn by the submitter, Aaron Wendel, after some discussions with representatives of the LEA community. The proposal made provision for decloaking WHOIS records upon request, court order, etc. by law enforcement, a hopelessly naive understanding of the current situation with regard to anti-abuse work. It was impressed upon the assemblage that grass-roots anti-spam investigations were behind the majority of takedowns of malicious sites, for example. Tom Grasso, an FBI investigator who was in attendance commented, "95% of our successful cases are as a result of grassroots investigators. Limiting ARIN WHOIS to LEA is not a good idea"

Despite having been withdrawn, a vote was taken, and nonetheless, defeated roundly.

Of the 133 attendees to the meeting, 5 voted in favour, 70 against.

A second bit of good news was related by Leslie Nobile, ARIN Director of Registration Services who noted that ARIN would commence a process of confirming all WHOIS email points of contact, beginning in June, 2010, and that this would become an annual process.

CAUCE Director Matt Sergeant was in attendance at ARIN to represent our position as a signatory and supporter of the MAAWG position statement.

Download MAAWG Comments ARIN Draft Policy 2010-3

Email User Safety At Risk - MAAWG Consumer Survey 2010

The 2010 version of the now-annual Messaging Anti-abuse Working Group (MAAWG) ‘Email Security Awareness and Usage Report’ was released yesterday. While un-belied by the title, the vernacular name might get a bit more attention: ‘The MAAWG Consumer Email Survey”.

The key findings of this comprehensive study can be found here, and the full report downloaded here.

Consumers were surveyed in North America and across Europe with a variety of questions from computer expertise and savvy, to their preferences of email.

Many of the findings are both shocking and disturbing; despite efforts to the educate, consumers are well unaware of the consequences of their actions, and a painful percentage continue to click on spam, knowingly, instead of deleting it immediately. Such actions has, of course, lead to the gargantuan increase in botnet presence on the ‘net and zombie’d computers continue to steal millions of bits of personal and confidential business information as a result.

Clearly, a concerted effort to heighten consumer awareness of the very real dangers on the net is needed; involving all stakeholders, marketers, receiving sites, government, and NGO consumer advocacy groups. The resources are out there, for example StopSpamHere.ca and Onguardonline.gov (more resources below), but do not appear to be used, or sage advice heeded.

Equally striking are the findings about the email consumers actually want and care about. it has long been CAUCE's contention that email is about personal communication. The survey's respondents from across the world agree.

On page 14 of the full report consumers state their preferences for various types of email; clearly one-to-one communications is still the cock of the walk when it comes to the type of email we all like to receive, messages from friends and family were ranked as ‘extremely or very important’ to 82% of respondents.

Strikingly, marketing email was only rated similarly by 15% of those surveyed; however, 32% did view such mail as ‘somewhat important’.

Graphic courtesy of MAAWG.org,reproduced with permission

This seemingly speaks to some fundamental issues that the marketing community must deal with if they are to better themselves in the eyes of consumers, irrelevant content and over-mailing are serious issues that enlightened marketers are working hard to deal with, but much more can be done, industry-wide to address them.

Other End-user oriented Resources (please help promote them!)
StaySafeOnline.org
StopBadware.org

A Dangerous Buzz, and Opt-In Isn't Just for Email

Image by dr.jd via Flickr

Google is great at generating buzz, and they've done it again with their new social vitality tool, appropriately named Google Buzz.

Buzz takes all of your GMail contacts (and presumably other connections from elsewhere within the Googleplex), and makes them all your "friends" by default; it then shares your activity from Google Reader, YouTube, and other tools with all of them, and vice versa.  They can see who your friends are, and you can see who theirs are.  It's a quick & impressive way to make a whole new social network out of the original social networking tool: email.

Only one problem: all of those connections, and all of that public information, happens by default.  You do get to choose whether or not to activate Buzz, but apparently it's activated either way — and if you say no, you won't have access to the nearly-hidden privacy controls.

These may seem like small issues: Facebook already tells the world who you're friends with, and Twitter updates are public by default.  But with both of those, you choose to sign up and you know what you're getting (until it changes.)  Buzz is different: you signed up for GMail, and suddenly this other thing happened too.  Suddenly, things you thought were private are public.  It's tantamount to spyware.

This is all of particular concern to someone like the author of the Fugitivus blog, who writes anonymously about her life — including some truly disturbing experiences, being raised in an abusive family and then married to an abusive husband.  Everyone should have the right to make their own privacy choices; for her, privacy is absolutely required.  Her well-being, perhaps even her life depends on it.

When Google Buzz showed up, it revealed her activity to all of her most common correspondents — which includes her ex-husband.  Things she had thought she was only sharing with her boyfriend and her mother, that she thought she had control over, were now automatically shown to someone she has very good reason to trust no further than her inbox.  See the problem here?

We've talked for years about the "opt-in" paradigm for email: companies and organizations should not send you advertisements unless you've asked for them — even if they believe you'll be interested.  Similarly, companies and organizations should not be sharing your information with others — even if they believe you know the person — without asking first.

Shame on Google for not considering the choice aspect of privacy before launching Buzz.  You know better.

Related articles by Zemanta

• Fugitivus: Fuck you, Google (boxofmeat.net)
• Google: Buzz off! (accmanpro.com)
• Google Buzz: The Missing Features (readwriteweb.com)
• Google Buzz And Their Social Strategy (cloudave.com)
• Is Google Reader Still an RSS Reader? (staynalive.com)
• Google will Improve Buzz based on Users' Feedback (taragana.com)

Maybe email IS dead -- part of it, anyway.

by J.D. Falk

I tend to chuckle at every new proclamation that email is dead. Google Wave won't kill it. Twitter and Facebook aren't killing it; they're using it. RSS didn't kill it. Instant messaging didn't kill it. "Push media" (remember that?) didn't kill it. AOL and Compuserve and Prodigy didn't kill it; they joined it. And before that, usenet and email lived happily side-by-side.

Over the years the Coalition Against Unsolicited Commercial Email (CAUCE), the world's oldest and largest email advocacy organization, has also predicted the death of email. Some day, we've said, we will reach a tipping point where spam finally makes email unusable for regular people. And for any people who doesn't have good spam filters, that's already happened. Avoiding email's death by spam has given rise to the spam filtering & security industry, and the equally powerful mailbox hosting industry. It has elevated open source projects like SpamAssassin from curiosities to necessities. I've lost count of the number of hardcore geeks who've finally given up on running their own severs, and moved their personal mail to Gmail.

Through these efforts, and these small personal concessions, email survives. But it's not the same, and I'm left wondering if a part of email has died.

Follow C-27 Updates on CAUCE Twitter, and sign our Twitter Petitions

Lots of activity in the twitersphere: http://twitter.com/#search?q=c-27

CAUCE live and kicking on Twitter / Linkedin / and Facebook - follow us!

[ Sign the CAUCE online petition to support Canada's antispam bill C-27
http://www.ipetitions.com/petition/SupportC27/ ]

McColo and the Difficulty of Fighting Spam

CAUCE's own Ray Everett-Church writes: It may be a truism that "little things mean a lot," but in the world of spam, flipping a single switch can have huge consequences that span the globe. We saw that concept reinforced this past week when McColo Corp., an Internet hosting firm based in San Jose, Calif., had its Internet connection shut off by its upstream connectivity providers on suspicion that McColo was serving as a command and control center for various spamming "bot net" operations as well as a base of operations for various other unsavory activities. Of course everyone, even McColo, is innocent until proven guilty. But in the days following the disconnection, global spam volumes have reportedly dropped by nearly two-thirds. I suppose it could be a coincidence... Read the rest here.