CAUCE

spamNEWS 09/28/2013

CAUCE posts regularly on topics related to spam. Here are our picks of the most interesting news items of the day.

You can follow them in real time on Twitter on Google +  or on LinkedIn

Facebook wins $3M injunction against spammer Steven Vachani aka Power.com http://news.cnet.com/8301-1023_3-57604866-93/facebook-wins-$3m-injunction-against-spammer/

Revealed: UK secretly arrested 16-year old boy for world’s ‘biggest’ DDoS-attack http://rt.com/news/uk-boy-arrested-ddos-attack-411/

Data Broker Giants Hacked by ID Theft Service http://krebsonsecurity.com/2013/09/data-broker-giants-hacked-by-id-theft-service/

DMARC Forward Reporting: Why Network Owners Should be Informed, too http://blog.abusix.com/2013/09/24/dmarc-forward-reporting-why-network-owners-should-be-informed-too/

LinkedIn Class Action http://www.linkedinclassaction.com

A Study of Whois Privacy and Proxy Service Abuse by @MAAWG STA Dr. Richard Clayton http://www.lightbluetouchpaper.org/2013/09/25/a-study-of-whois-privacy-and-proxy-service-abuse/

Is Fake iMessage App Malware or Not? http://www.enterprise-security-today.com/story.xhtml?story_id=121000A6NWYX&nl=7

Do not use iMessage Chat for Android – it’s not safe [Updated] @digitaltrends http://www.digitaltrends.com/mobile/imessage-chat-android-security-flaw/#ixzz2gDyzRIv1

ICANN and Your Internet Abuse By Garth Bruen @circleid http://www.circleid.com/posts/20130924_icann_and_your_internet_abuse/

Twitter's User Growth Slows, Perhaps As A Result Of Spam Account Purges Ahead Of IPO http://www.businessinsider.com.au/twitters-user-growth-slows-2013-9

Spam Arrest's Sender Agreement Fails Because Email Marketer's Employees Lacked Authority http://www.circleid.com/posts/20130919_spam_arrests_sender_agreement_fails/

Apple's a tasty phishing target for scammers http://www.pcworld.com/article/2049287/apple-is-a-tempting-phishing-target-for-scammers.html

Ransomware Puts Your System To Work Mining Bitcoins http://blog.malwarebytes.org/intelligence/2013/09/ransomware-puts-your-system-to-work-mining-bitcoins/

KETLER INVESTMENTS CC vs. South African INTERNET SERVICE PROVIDERS’ ASSOCIATION http://badwhois.info/Ketler_Invest_v_ISPA_JMNT_REVISED.PDF

How not to sue spammers, a cautionary tale

Spam Arrest is a company that sells an anti-spam service. They attempted to sue some spammers and, as has been widely reported, lost badly. This case emphasizes three points that litigious anti-spammers seem not to grasp:

• Under CAN SPAM, a lot of spam is legal.
• Judges hate plaintiffs who try to be too clever, and hate sloppy preparation even more.
• Never, ever, file a spam suit in Seattle.

CAUCE president John Levine has all the details on his blog.

Announcing CAUCE

Archive.org has the following press release announcing the formation of CAUCE. Happy birthday to us!

Internet, May 9, 1997--The Coalition Against Unsolicited Commercial Email (CAUCE) announced today that it is calling for a legal ban on unsolicited Email advertising. CAUCE has drafted an amendment to the federal law that bans unsolicited fax advertisements, to extend it to cover unsolicited Email advertising on the same terms. The proposal would give Email users control of the kinds of advertising they are willing to accept in their mailboxes, whether they prefer to shut it off completely, or ask for more.

The junk fax law (more formally, portions of 47 USC 227), provides that businesses may offer goods and services in fax messages only if the recipient has asked for the information or has a previous business relationship with the company. Recipients may ask to be taken off mailing lists at any time. Violation can result in a civil penalty of $500 per message, or more in the case of clearly willful violation or failure to provide a valid return fax number. Extending the same terms to Email should work equally well, according to CAUCE.

The arguments against junk Email and junk fax are very similar. Cost shifting to the recipient and denial of service are two of the most important. For example, many Email users and mailing lists have a daily limit on traffic, so UCE can displace other traffic and prevent it getting through.

"Starting from an existing law has several important advantages," said CAUCE co-founder Edward Cherlin. "We have a law that has worked well, that covers a very similar problem, and that has passed a constitutional challenge in court. The only thing really wrong with the junk fax law from our point of view is that so few people know it exists, so junk fax still continues on a small scale. That makes education the number two priority for us, behind getting the law passed."

The CAUCE Web site at http://www.cauce.org is an important part of the organization's education campaign. It offers information about UCE and the proposed amendment, a FAQ (Frequently Asked Questions) page, and a sign-up page where visitors can join CAUCE to receive a newsletter on Spam issues, or register their support for the proposal. Electronic signatures will be sorted and delivered to the appropriate Senators and Representatives.

The site also explains why other proposed solutions to UCE don't work, and how UCE harms other businesses. Because of UCE, many people are unwilling to deal with any online business. In particular it is impossible to create anything like a complete Internet Email directory service, since it would be used to generate mailing lists.

"We're not against commerce on-line. We're just against paying to receive junk mail. It's time-consuming to deal with, and it's incredibly costly - a cost which has to be passed on by the Internet Service Provider (ISP) to their subscribers." said CAUCE member John Mozena.

The Coalition Against UCE (Unsolicited Commercial Email) was founded by Scott Hazen Mueller, Vice President for Engineering for Whole Earth Networks, Edward Cherlin, Vice President for Business Development of NewbieNet, a free educational service for novice Internet users, and Doug Muth, a UNIX system administrator. The lobbying effort in Washington is led by Ray Everett-Church, a contractor with various ISPs on computer security issues.

For more information on the Coalition and its lobbying efforts, visit its Web home page at http://www.cauce.org. The CAUCE Web site explains the Spam problem, gives the text of the current law prohibiting junk faxes and the proposed amendment, and answers common questions about the proposal.

More information on UCE, or "spam", can be found at http://spam.abuse.net/spam. The current text of 47 USC 227 is available at http://www.law.cornell.edu/uscode/47/227.html.

More information on CAUCE can be found at http://www.cauce.org.

For more information on the coalition and its lobbying efforts, contact:
Scott Hazen Mueller
Phone: (415) xxx xxxx
E-Mail: scott@zorch.sf-bay.org
Edward Cherlin
Phone: (916) xxx xxxx
E-mail: cherlin@newbie.net.
WWW: http://www.newbie.net/Newbie_Pages/new39.html
Ray Everett-Church
Phone: 202 xxx xxxx 
E-mail: everett@everett.org

Boston Marathon Scams

Don't Be Scammed

Predictably, within hours of the tragic bombings yesterday that took place in Boston, scam domains in their hundreds, and fake social media pages began to spring up. To profit from a tragedy is contemptible, and CAUCE officers are doing their level best to ensure these domains are blocked, and taken down as quickly as possible.

Like you, we all mourn those who had their lives taken from them in Boston, and stand with those who were injured and affected by these vile deeds.

If you want to contribute in some way, please donate blood or money to the Red Cross. Go directly to their website here : http://www.redcross.org/news/press-release/Red-Cross-Statement-on-Boston-Marathon-Explosions 

Updating the Electronic Communication Privacy Act

Back 1n 1986, the Congress passed and President Reagan signed the Electronic Communication Privacy Act (ECPA), which set the rules under which the government could get copies of a relatively new-fangled medium called electronic mail. While it was a forward looking law for the 1980s, it's gotten pretty creaky. In a rare bipartisan move, Sen. Pat Leahy (D-VT) and Mike Lee (R-UT) have introduced a bill to update it. The bill is surprisingly good.

Facebook, their Walled Garden, and McAfee Anti-Virus – What Really Happened

On Sunday, a number of Facebook users reported being locked out of the system. When they attempted to log in they were presented instead with the a series of screens, informing them that their computer was infected, and providing a link to a free scanning service by McAfee antivirus software.

Being locked out upset people to no end, because it was the first they had heard about their computer being infected.

It appears that Facebook users on a grand scale are receiving a notice that their account is temporarily locked and could be infected with a virus. These users are then encouraged to download a free tool by McAfee to scan their system. There has been much speculation on the issue. Our best guess is that there is a bug in Facebook's filters or algorithms that is yielding a false positive malware result for a large portion of these users. We have reached out to Facebook regarding the matter and will update this thread if we hear anything back.
Other users with Mac computers insisted they were safe.

If only that were true. Over just these past few weeks we have read about Facebook itself being hacked due to a vulnerability in Oracle’s common cross-platform (Windows, Mac, UNIX) software component Java. Media-player Adobe Flash has had a tough time of it too being repeatedly patched, then re-hacked within days, and that runs on all sorts of computers. One Adobe rep, looking very tired, said recently that things were so busy with security issues staff had taken to sleeping at the office. Like, as in ‘moved in’.

Our point? It was entirely reasonable to think that Facebook was detecting infected computers trying to log into their systems.

Wait what? Facebook is scanning their users computers?

Yes, they are. This isn’t a new activity. For example, Google and Facebook helped quell a massive infection called DNSChanger by diverting infected users to special pages with disinfection information U.S. Cable ISP behemoth Comcast also scans their users’ computers and in the case of repeated, untreated infections, user accounts are placed in a so-called ‘walled garden’ limiting Internet access until they can be fixed.

Walled Gardens are a reasonable approach, and an effective way to deal with the rampant levels of compromised computers that can damage networks, and the users’ themselves, by stealing personal information on the machine. In fact, CAUCE has representation on the FCC’s Communications Security, Reliability and Interoperability Council (CSRIC) working group advocating a similar approach industry-wide.

CAUCE has also been involved in parallel discussions in Canada, where the idea is still nascent, but is likely to take hold shortly. But what does all this have to do with Facebook Users? Facebook scans computers connecting to their network for infections, and places compromised user computers in a walled garden until the problem can be remediated. They offer free tools to help. They write certain rules for the scanning engine to detect the infections Reasonable enough. According to a Facebook rep., speaking on condition of anonymity said the problem last Sunday was a new employee wrote rules that were a bit too aggressive, and they incurred many false positive results, falsely indicating computers were infected when they were not. After a couple of hours, the error was caught, and initially they withdrew the rules, and then began to find, and reverse the suspended status of those users they had initially blocked. This lead to what users were experiencing– log in once, you are told you are infected, log in again, no such notice. This is what is known in the computer industry by the technical phrase ‘oops’. CAUCE congratulates Facebook (and others) on their efforts to help mitigate computer compromises by this approach. While it is irksome, and sometimes scary to be locked out, and told your computer is infected, the worst-case scenario is that you were unable to post cat and baby photos for a short time on Sunday, and had to run a harmless anti-virus scan.

Are You Donating to a Real Charity?

Please share this post.

After a tragedy, many of us want to donate to funds and charities to show our support for a community.

However, scam charities immediately pop up, looking to steal your well intentioned donations. There are at least 30 newly-registered domains created in the past 48 hours related to the tragic shootings at the Sandy Hook elementary school in Connecticut: Most, probably all are scams and rip-offs. How then, to donate so that your funds make it to the deserving victims?

Check out Charity Navigator, an online database that assesses charities based upon revenues, operating costs, and the percentage of funds that make it to the intended recipients.

Donate to the Red Cross / Red Crescent / Magen David Adom. The International Red Cross is a stalwart organization that is reliable, and extremely well-run. The Red Cross of America has a fund for the families and survivors of the Sandy Hook shootings.

News site CNN usually will make mention of an appropriate charity. They report that the United Way of Western Connecticut have set up a Sandy Hook School Support Fund at https://newtown.uwwesternct.org/

If you encounter what you believe to be a scam charity, report them to your local police, federal government or police force, and to the Internet Crime Complaint Center

CAUCE, MAAWG, London Action Plan release "Best Practices to Address Online and Mobile Threats" Report

New Online and Mobile Best Practices Clarify Business and Governmental Security Tactics




Baltimore, Oct. 24, 2012 – A cooperative international report available today outlines
Internet and mobile best practices aimed at curtailing malware, phishing, spyware, bots
and other Internet threats, and provides a thorough review of current and emerging
threats.  “Best Practices to Address Online and Mobile Threats” is a comprehensive
assessment of Internet security as it stands today and explains in non-technical language
the proactive steps that can help mitigate risks, according to the report’s two major
contributors, the Messaging, Malware and Mobile Anti-Abuse Working Group (M3AAWG) and the
London Action Plan (LAP).

The report is also one of the first global efforts to encourage governments to deploy best
practices, which are more often associated with businesses.  It focuses on four major
areas of concern: malware and botnets, social engineering and phishing, IP and DNS
exploits, and mobile threats. To encourage government participation, it has been
presented to the 34-member country OECD (Organisation for Economic Co-Development) for
review.

“Best Practices to Address Online and Mobile Threats” draws on the tactics that have
proven effective over the past decade to reduce online risks, then augments these with
forward-thinking recommendations for emerging vulnerabilities, such as mobile text spam
and Web abuse. The comprehensive report is available here:



Download Best_Practices_to_Address_Online_and_Mobile_Threats_(Oct_2012)

The report is also available via the London Action Plan site and by way of the Messaging
Anti-Abuse Working Group site.

“As a globally cooperative effort, the report brought together an unprecedented team of
experts who outlined safe computing tactics in uncomplicated, accessible language for
end-users, large and small businesses, and governments. This is also one of the first
efforts to update industry recommendations recognizing that public agencies are important
online enterprises, and just as companies need to implement best practices, so do
governments,” Alex Bobotek, M3AAWG co-chairman said.

CAUCE President John Levine noted "We were honored to work with Industry Canada, M3AAWG,
and the other organizations. Online security is such a massive problem that working
partnerships among governments, business, and non-profits such as CAUCE is the only
logical way forward to deal with these issues."

The international community collaboratively stepped up to generate the report in a
public-private partnership led by André Leduc, Manager of the National Anti-Spam Coordinating
Body at Industry Canada. Industry experts from M3AAWG, LAP and other
organizations, such as CAUCE, contributed to it.
CAUCE President John Levine, and Executive Director Neil Schwartzman were part of the
Paris delegation that presented the report to the OECD committee on consumer protection,
it was also reviewed by the Working Party on Information Security and Privacy (WPISP).

Online threats are evolving as Internet and mobile technologies play a more vital role in
many business models, attracting cybercriminals who target users on popular platforms such
as laptops, tablets, smartphones and other handheld devices. As the Internet economy
grows, implementing the best practices detailed in the report will help reduce illegal
activities such as spam, phishing, malware and spyware distribution, botnet deployment,
the redirection of Internet traffic to malicious websites and denial of service attacks.

Inbound Email Filtering Sued Over Privacy Issues, This Time in Canada

In a case that parallels many of the aspects of the three cases filed in July 2012 in California, against Google & Yahoo!,  retiree Wayne Plimmer of Sechelt, British Columbia filed a class action suit against Google on October 4, 2012.

Here is a copy of the complaint :  Download PlimmerV.Google

The suits alleges that Google has breached sections 1 and 3 of the British Columbia Privacy Act R.S.B.C. 1996 c. 373 and s.52 of the Federal Competition Act R.S.C. 1985 c. C-34

Some news coverage notes that the class has not yet been approved (anyone in British Columbia who has sent email to a Gmail account), and that should this lawsuit be successful, this may prohibit the use of anti-virus and anti-spam software on inbound mail. The suit also alleges that Google invaded users’ privacy, violated solicitor-client, physician-patient, pastor-penitent and journalist-source privilege, and infringed upon copyright.

CAUE President has blogged about the U.S. Federal and California cases here and here 

The BC Privacy Act reads:

A new Definition of 'Opt-in'

In April, I stayed at the Hotel Carelton in San Francisco. Today, I received an email sent on their behalf with some interesting headers:

From: Joie de Vivre <VIP@crm.SafeCRM.com> (1)

Subject: 20% Off Our Best Available Rates For A Limited Time!!!

Date: July 26, 2012 12:12:01 PM PDT

To: Neil Schwartzman <redacted@gmail.com>

Reply-To: Joie de Vivre <createjoy@jdvhotels.com>

N.B.: Neither the From: nor the reply-to are ostensibly related to Hotel Carleton. 

Now, I never signed up to be on their mailing loist, but I figured I'd give them a break and unsubscribe, so I clicked this link (again, seemingly unrelated to the hotel)

http://www.data2gold.com/cc3/RmvRPC.wow?5Q09376I525C1U43414E403I3B1W514S4Q6F5H1F596G600G4K515Y674235MUNGED

Now here's the thing that really got my goat, the landing page on the unsubscribe:

Thank You!

We have removed munged@gmail.com from our list.  We do not provide your information to any other company ever and we will not contact you again at this email address. Thank you for helping us maintain a true opt-in list.

A true opt-in list, just for the record, would be one that I signed up to, not one that I was forcibly subscribed to, pending my unsubscribe.You're welcome.

(1) SafeCRM.com

   Digital Alchemy 
   5750 Stratum Drive 
   Fort Worth, Texas 76137 
   United States  

(2) data2gold.com

Registrant: 
   Digital Alchemy, LLC 
   5750 Stratum Drive 
   Fort Worth, Texas 76137 
   United States  

A little poking around sees these domains on the digital alchemy nameservers

da2go.com
da2go.net
data2gold.com
data2gold.net
data2gold.us
dataintogold.com
datatogold.com
digitalalchemyusa.com
disneytriptips.com
gone2fun.com
gone2sun.com
guestfocus.com
mercutiomdef.com
orlandotriptips.com
orlandotripwiz.com
orlandotripwizard.com
safecrm.com
safecrm.org
turndata2gold.com
turndatatogold.com
turningdata2gold.com
turningdataintogold.com
turningdatatogold.com