CAUCE

Epsilon Interactive breach the Fukushima of the Email Industry

Marketing as Usual? Not a chance. – Epsilon corporate catch phrase

A series of attacks on the Email Service Provider (ESP) community began in late 2009. The criminals spear-phish their way into these companies that provide out-sourced mailing infrastructure to their clients, who are companies of all types and sizes.

Upon gaining access to an ESP, the criminals then steal subscriber data (PII such as names, addresses, telephone numbers and email addresses, and in one case, Vehicle Identification Numbers). They then use ESPs’ mailing facility to send spam; to monetize their illicit acquisition, the criminals have spammed ads for fake Adobe Acrobat and Skype software.

On March 30, the Epsilon Interactive division of Alliance Data Marketing (ADS on NASDAQ) suffered a massive breach that upped the ante, substantially.  Email lists of at least eight financial institutions were stolen. 

Thus far, puzzlingly, Epsilon has refused to release the names  of compromised clients. CAUCE has drawn the a list of  from news reports (below)

The obvious issue at hand is the ability of the thieves to now undertake targeted spear-phishing problem as critically serious as it could possibly be.

What to do?

CAUCE is calling on the ESP industry and ISP and Email Receivers to implement these measures across the board, to protect the PII of end-users everywhere. What follows are best common practices that have existed for many years. It is time to take a stand against the data-thieves, and begin to properly protect end-users, without fail.

ESP & Senders

• Security must be the top corporate priority. Both Silverpop and Epsilon Interactive were either breached repeatedly, or failed to fully mitigate their initial security lapse in December.  I was told by one ESP security staffer that he hadn’t been given sufficient resources to affect all the appropriate changes. That is at best lamentable.

• Two-factor authentication must be implemented for ESP system access for both staff and clients.

• Senders and ESPs must sign all email with DKIM, and authenticate all mailing IPs with SPF.

• ESPs must check all outbound content against domain blacklists such as SURBL and the Spamhaus DBL before deployment.

• ESPs must deploy extended-validation certificates on web properties.

• ESPs and senders must rigourously adhere to the MAAWG Senders’ BCP

• ESPs and brand owners should use the services of email authentication services such as Authentication Metrics, eCert, Return Path, and Truedomain, as well as anti-phishing services like BrandProtect, Internet Identity and tools such as Lashback’s BrandAlert

• ESPs must adopt and embrace a culture of transparency and commit to cooperative full disclosure

“Epsilon has refused to provide additional details on what other brands may have been affected.” – Security Week

“SilverPop did not respond to requests for comment” – Krebs on Security

While it is the instinctive corporate reaction to be secretive, such a strategy exacerbates the frustration of the other set of victims of data-theft, namely the end-users. A complete list of breached clients is fundamental to protecting end-users, and allowing them to protect themselves.

Receiving Systems

We need desperate measure for desperate times, CAUCE calls upon the receiving community to better their protection of end-users.

• Email receivers must follow Yahoo! Mail’s lead and deploy multi-layer phishing protection.

• Email receivers must deploy DKIM and SPF checking, and treat messaging failing such checks accordingly by labeling the subject line, placing it in a spam folder, or blocking it entirely.

• Email receivers must deploy checks using URI blacklists like SURBL and Spamhaus on message headers and content domains.

• Email receivers must take extreme measures, even if there are false positives. Better safe that sorry, and given the potential damage these breaches can cause to a recipient, far better that there are false positives (legitimate email refused or sidetracked to the bulk folder) than false negatives (illicit email delivered to the inbox).

The list of breached companies

 

Microsoft, others help take down Rustock Botnet

Microsoft's DCU and some federal agencies took down the Rustock botnet two days ago. A hearty CAUCE congratulations to all those involved, in the forefront, and behind the scenes.

Here's a compilation of various news and data sources:

Krebs on Security: http://krebsonsecurity.com/2011/03/rustock-botnet-flatlined-spam-volumes-plummet/
Wall Street Journal: http://online.wsj.com/article/SB10001424052748703328404576207173861008758.html

Microsoft: http://blogs.technet.com/b/mmpc/archive/2011/03/18/operation-b107-rustock-botnet-takedown.aspx & http://blogs.technet.com/b/microsoft_on_the_issues/archive/2011/03/18/taking-down-botnets-microsoft-and-the-rustock-botnet.aspx

CBL (2nd & 3rd charts) http://cbl.abuseat.org/totalflow.html  & http://cbl.abuseat.org/rustock.html
Spamcop: http://www.spamcop.net/spamgraph.shtml?spamweek
Nixspam: http://img.ly/3eix

The court orders (PDF) http://bit.ly/fg0d0u

Kidnapping, Theft and Rape Are Not "Cyber" Crimes

Kidnap. Rape. There are no lesser words that can be used to describe what happened to the daughter of an anti-spam investigator in Russia.

His daughter was recently released, according to Joseph Menn’s recent article on Boing Boing, after having been kidnapped from her home five years ago, fed drugs, and made to service men, as a warning to ward off further investigations.

The criminals behind these vicious acts were also responsible for large spamming organization associated with Russian Mob activity.

Note that we say "also."

When someone is mugged, harassed, kidnapped or raped on a sidewalk, we don't call it "sidewalk crime" and call for new laws to regulate sidewalks. It is crime, and those who commit crimes are subject to the full force of the law.

For too long, people have referred to spam in dismissive terms: just hit delete, some say, or let the filters take care of it. Others — most of us, in fact — refer to phishing, which is the first step in theft of real money from real people and institutions, as "cyber crime." It's time for that to stop.

Some of these crimes involve technology. So what? Criminals have used technology before.

Some of these crimes cross borders. So what? Crimes have crossed borders before.

Spam isn't illegal everywhere yet. So what? Spam 2.0 (spam, malware & spyware) is the leading edge of far worse activities, often things that have been illegal as long as we've had laws.

It is high time that governments and law enforcement stop thinking of computer crime as that perpetrated by teenagers in their parent’s basement. It is the Russian Mob and other organized criminals that are doing this.

While we are at it, we should mention ‘cyber-warfare’, something too often conflated with cyber-crime. Cyber-crime is not "cyber-warfare.” There may be state or terrorist agencies copying the tactics and methods of these criminals, but that does not mean that the criminals must be left alone until new cyber-warfare agencies have been created and funded.

As Purdue computer science professor ‘Spaf’ Spafford was recently quoted as saying in a note-worthy piece ‘Cyberwar Vs. Cybercrime’ on the GovInfo Security blog

"Why aren't we seeing the investment and prioritization being made in law enforcement, first? Why is all the publicity, funding and prioritization being given to the military - with efforts such as the build-up of the military cyber command - when so much of the clear and present threat is from the criminal element and not from other nation-states?"

Just so, Prof. Spafford!

As we have said repeatedly on this site, these are criminal gangs who have found an incredible loophole in the justice systems of the world: they can rob banks and people, with little chance of getting caught, let alone going to jail. This is not because they're doing things that aren't illegal; they've just found a new way to hide.

David Black, manager of the RCMP's cyber infrastructure protection section recently said to CAUCE Executive Director Neil Schwartzman “we don’t do spam”. OK, but why not? Spam is no longer, and hasn’t been for some time, about simply sending unwanted emails. Spam is now a delivery mechanism for malware, which in turn threatens infrastructure, and facilitates theft. We have seen precious few cases filed using existing Federal computer intrusions laws in Canada, and none, to our knowledge have been filed under the renovated anti-phishing law, S-4, passed in September 2009.

Governments and law enforcement agencies need to begin to treat online theft with the same seriousness as they do other physical crimes. It is time to bring this up to the diplomatic level, or seriously consider refusing packets from places that treat the Internet, and innocent victims, as their personal ATM.

CAUCE is made up of people who care about email qua email. We understand it, we love it. It is still the ‘killer app’. Furthermore, we understand why some folks in law enforcement or the judiciary might ask, "When there are people stealing millions or hurting people in the commission of violent crimes, why are you wasting our time with 'just' a spam case?” Here's why:

1. Most spam is sent by organized criminal gangs, just like other organized crime.
2. Those gangs intentionally operate trans-nationally, in an effort to frustrate investigation and prosecution.
3. Money laundering of the proceeds from spam is routine, and that money directly fuels official corruption and other social ills.
4. Some spammers are actually selling something. Their favorite product? Counterfeit pharmaceuticals. In many cases these may be scheduled controlled substances, sold in bulk, and available to minors; in other cases, critical medicines needed to properly treat cancer and other serious illnesses may be counterfeit placebos, with potentially tragic results.
5. Spammers operate by compromising tens or hundreds of thousands of end-user PCs, violating those users' privacy and sometimes steal sensitive personally identifiable information such as individuals’ and even corporate access to financial services at the same time they're using their systems to spam. Computer ‘phishing’ is no less a crime than bank robbery, home invasion, and mugging.

Cyber criminals consider cyber crime to be a virtually riskless offense; they're unlikely to be identified; if identified, they're unlikely to be investigated; if investigated, they're unlikely to be charged and prosecuted; if prosecuted, they're unlikely to be convicted; if convicted, they're unlikely to do jail time.

The courts need to make it clear that that's wrong in all respects. If you commit cyber crimes, you will be identified, investigated, charged, prosecuted, convicted and sentenced to serious time and we will seize your assets.

This will not happen so long as crime, which involves the Internet, is dismissed as "cybercrime" and either scoffed at, or used to justify ever-increasing cyberwarfare budgets

This isn't just email. This isn't a war. This isn't "cyber.” This is crime. It is time to call a cop, and expect a response.

 

by CAUCE Executives J.D. Falk & Neil Schwartzman

Facebook Spammer Ordered to pay $1 Billion Judgement

Earlier this week a Quebec Judge decided to rule in favour of upholding the record setting judgement of $873 Million USD Montreal resident Adam Guerbuez. 

The original case of Facebook v. Atlantis Blue Capital, alleged millions of messges flooded Facebook's network via compromised accounts resulting in Statuatory damages of ~$436 million and aggravated damages of ~$436 million (or $100/$100 per recipient respectivly).

As Canada does not currently have a compariable law to CAN-SPAM, Facebook petitioned the Quebec courts to enforce the judgement in California.

Read the Story at the Globe and Mail here: Quebec court orders alleged spammer to pay $1-billion to Facebook

This is a great example of the importance of FISA being quickly passed through Goverment.

October is National Cybersecurity Awareness Month

For more information, see staysafeonline.org.

Omnibus Cybersecurity Bill May Not Go Where Original Authors Intended

Image via Wikipedia

In an interview with GovInfoSecurity, Sen. Thomas Carper said that the U.S. Senate is considering attaching cybersecurity legislation to a defense authorizations bill.  Though clearly a ploy to be able to say "we did something about those evil hackers" before the elections, CAUCE applauds the attempt.  There can be no doubt that the United States (and many other countries) sorely needs better laws to deal with these threats.

Further, Senate Majority Leader Harry Reid has asked that the cybersecurity bills currently in front of various committees be combined into one single, omnibus bill, which would presumably then be attached to the defense authorizations bill.  Here's where we start to get worried.

Each of the bills we've seen (and we surely haven't seen them all yet) have some good points, and some...let's just call them unintended consequences.  In every case it's obvious that the authors' intentions were good, but they needed some expert advice from people who understand the technical and legal realities of the internet today.

One such expert, a long-time CAUCE supporter who asked to remain anonymous, shares his review of one of those bills: S. 3742, the "Data Security and Breach Notification Act of 2010."  You can read the original and check its current status here.

Please note that this is not legal advice.  Our expert is not a lawyer, I'm not a lawyer, and CAUCE did not consult with any lawyers before publishing this article.

Our expert says it's going to be difficult to construct a single good omnibus cybersecurity bill. The bigger and more complicated it gets, the less likely it is that anyone will actually read the bill before voting on it — particularly when they're in a hurry to go home and win an election.

He highlights a few specific items which could be troublesome for just about anyone running a mail server, a web site, or other online services which collect or transit any information:

• Page 2, Section 2 (a)(2)(A): More or less everyone's going to need to have personally identifiable information (PII) security policies
• Page 3, Section 2 (a)(2)(B): ... and an information security officer
• Page 3, Section 2 (a)(2)(C): ... and a process for monitoring for PII breaches
• Page 3, Section 2 (a)(2)(D): ... and a process for mitigating PII vulnerabilities
• Page 3, Section 2 (a)(2)(E): ... and a process for securely deleting electronic records containing PII
• Page 4, Section 2 (a)(2)(F): ... and a process for securely destroying paper and other non-electronic records containing PII
• Page 4, Section 2 (b): If you're an "information broker" (which would include nearly anyone who collects information and shares it with anyone else), you have additional obligations, including needing to submit policies to the FTC, needing to provide consumer access to information, tracking access to information maintained by the broker, etc.
• Page 13, Section 3 (a)(1): Requires notification solely to US citizens and residents in the event of a breach. Of course, that presumes you know the nationality/immigration status of those whose PII data you hold (hmm, I don't think *anyone* I know does, except for HR departments with regard to their own employees). If I were a covered entity, I'd be strongly inclined to begin soliciting that information from everyone I get PII data from, although of course that may trigger a whole different set of issues, particularly in areas where immigration related issues are a hot button topic.
• Page 14, Section 3 (b)(2): Notification by a service provider triggers reporting requirements. This is going to make LOTS of friends for service providers, given the affirmative notification and credit protection obligations that customers accrue after being notified.
• Page 19, Section 3 (d)(2)(A): Alternative notification is available for incidents involving LESS than 1,000 individuals. This is goofy.
  Normally alternative notification is allowed as an option when the number of covered individuals is very LARGE not very small. For example, some state laws permit alternative notification in cases where costs of providing notice would exceed a quarter million dollars, the affected class of consumers to be notified exceeds 350,000, or the notifying party doesn't have sufficient contact information to provide notice.
  There's language on page 22 of the draft bill that may allow regulatory additions to expand when substitute notification is permissible, but the basics for when substitute notification should be permissible should be part of the core statute, not an after-the-fact, maybe-yes, maybe-no regulatory add on by the agency.
• Page 25, Section 3 (d)(2)(B): imposes compliance burdens on entities for a year before technical compliance guidance is available. Enforcement of the act should be held until the guidance envisioned by 3(d)(2)(B) is available, and realistically it will take probably an additional period after that for sites to deploy the recommended technology (new projects don't happen over night).
• Page 26, Section 3 (h): Potentially requires notification in polyglot languages. This can be a huge administrative PITA -- consider the "simple" case of the EU, where there are "only" 23 official languages (Bulgarian, Czech, Danish, Dutch, English, Estonian, Finnish, French, German, Greek, Hungarian, Irish, Italian, Latvian, Lithuanian, Maltese, Polish, Portugese, Romanian, Slovak, Slovene, Spanish and Swedish, plus (semi-official) Catalan, Galician, and Basque).
  This section could be potentially exceptionally burdensome if the FCC suddenly mandates that sites provide notification in multiple foreign languages (I could see an argument for requiring Spanish as well as English, but there are some communities in the United States where other languages are also very common).
• Page 28, Section 4 (b)(1): It seems unnecessarially combative to define all data security incidents as "unfair or deceptive acts or practices." Data security incidents are not typically something which a covered entity intentionally does, neither are such breaches typically "unfair" or "deceptive" in the same way that some TV or Internet huckster's "miracle" product or pyramid sales scheme might be.

The most persuasive argument in the other direction is probably that currently most states already have their own PII breach notification laws, and it can be a pain to try to stay in compliance with 46 different PII information security and breach notification statutes. So again, the intention is clearly good, but in practice...it needs some careful review.

So there are the results from one bill, examined by one expert.  He's one of the best minds in the cybersecurity community, yet he may still have missed something.  With legislation as important as this, smushing it all together and rushing to attach it to something unrelated is simply a bad idea.  This is a topic which requires careful thought, from multiple people who really do know what they're doing — and who can explain it to the Congressional staffers who will write the resulting bill, and then to the Senators and Representatives who will collectively make the decision.

Once that education has occurred, it should quickly become evident that while some of these bills do overlap, others do not.  Some will disagree.  Some simply contain bad ideas.  All of this has to be worked out.  Then, finally, it might make sense to combine them — not now, and not just because they all have the prefix "cyber" in the title somewhere.

 

Related articles by Zemanta

• Cybersecurity Tensions Between Public, Private Sector (informationweek.com)
• Former acting cybersecurity czar provides legislative summary of bills in 111th Congress (securityarchitecture.com)
• New Data Breach Legislation (thesecuritypub.com)
• Cybersecurity Regulations Pass House (informationweek.com)
• Federal Computer Week: Congress just doesn't see cybersecurity's sex appeal (boxofmeat.net)
• Omnibus bills subvert our legislative process (theglobeandmail.com)
• Ad trade group spent $250,000 lobbying in 2Q (seattletimes.nwsource.com)
• ID Thefts Go Unreported Despite Notification Laws (informationweek.com)

Email User Safety At Risk - MAAWG Consumer Survey 2010

The 2010 version of the now-annual Messaging Anti-abuse Working Group (MAAWG) ‘Email Security Awareness and Usage Report’ was released yesterday. While un-belied by the title, the vernacular name might get a bit more attention: ‘The MAAWG Consumer Email Survey”.

The key findings of this comprehensive study can be found here, and the full report downloaded here.

Consumers were surveyed in North America and across Europe with a variety of questions from computer expertise and savvy, to their preferences of email.

Many of the findings are both shocking and disturbing; despite efforts to the educate, consumers are well unaware of the consequences of their actions, and a painful percentage continue to click on spam, knowingly, instead of deleting it immediately. Such actions has, of course, lead to the gargantuan increase in botnet presence on the ‘net and zombie’d computers continue to steal millions of bits of personal and confidential business information as a result.

Clearly, a concerted effort to heighten consumer awareness of the very real dangers on the net is needed; involving all stakeholders, marketers, receiving sites, government, and NGO consumer advocacy groups. The resources are out there, for example StopSpamHere.ca and Onguardonline.gov (more resources below), but do not appear to be used, or sage advice heeded.

Equally striking are the findings about the email consumers actually want and care about. it has long been CAUCE's contention that email is about personal communication. The survey's respondents from across the world agree.

On page 14 of the full report consumers state their preferences for various types of email; clearly one-to-one communications is still the cock of the walk when it comes to the type of email we all like to receive, messages from friends and family were ranked as ‘extremely or very important’ to 82% of respondents.

Strikingly, marketing email was only rated similarly by 15% of those surveyed; however, 32% did view such mail as ‘somewhat important’.

Graphic courtesy of MAAWG.org,reproduced with permission

This seemingly speaks to some fundamental issues that the marketing community must deal with if they are to better themselves in the eyes of consumers, irrelevant content and over-mailing are serious issues that enlightened marketers are working hard to deal with, but much more can be done, industry-wide to address them.

Other End-user oriented Resources (please help promote them!)
StaySafeOnline.org
StopBadware.org

T'is the Season for Apartment Rental Scam Spams - Consumer Alert

Summer tends to be moving time here in Montreal, as it is elsewhere. This year, I have decided to move, and thought it would be an opportune time to share a warning about some scams that are related to this seemingly harmless activity.

First off is the 'Too good to be true' Craigslist posting (or Kijiji, or any other public listings site!). Last time I moved, I went searching on CL for a new place, as so many do. I found a nice listing, and emailed the purported landlord. I got an email back from someone claiming to be on missionary work in Africa, and if I would just send him or her some money, the place was mine; I could pick up the key when the cheque cleared.

I researched a bit further, and found that what the scammers had done was re-post a previous listing on CL from a few weeks past, dropping the price enough to make the offer seem great, but yet remain credible. A call to the landlord and an email to Craigslist Abuse had the listing and a few others taken down.

Scam two: Advance Fee Fraud - I am now subletting my place, and today, a very nice lady ostensibly in Benin is offering to send me money to reserve my flat, sight unseen. No doubt, it will be a cheque, which I would deposit. Then, complications will arise, she will ask for her money back, less a fee for the hassle. The cheque would take some time to clear, but by then, the money would be safely in the hands of the scammers.

Bottom line: Never rent an apartment or house from someone who isn't present to show you around, and pay with a cheque noting the address, and the date of the first month of rental. Here in Quebec, we have government issued lease forms available everywhere, always use them, and make sure the person renting has the authority to do so. Otherwise, come moving day, you may find yourself without a place to live.

Never pay out money from cheques you receive before your bank has had time to clear the payment, and are 100% willing to state the transaction is legitimate. Otherwise, you will find yourself on the hook for the money.

As always, the old saw 'if it seems too good to be true, it probably is' applies. Remain skeptical, especially in your online dealings.

Neil Schwartzman
Executive Director, CAUCE

The (Possible) Future of International Spam Laws

by J.D. Falk

After more than a decade of fits and starts, fear and doubt, lies and lobbying, legislative attention towards spam now seems to arrive in regular waves.

Our friend Dennis Dayman reports on deliverability.com that a new law has taken effect in Israel, requiring (in short) opt-in — and so according to the International Herald Tribune, Israeli marketers were rushing to re-confirm questionable subscriptions before the deadline this past Monday. In Canada, Internet law expert Michael Geist lambasted his government for continuing to fail to pass any anti-spam legislation, four years after he and the National Task Force on Spam — which also included our own Neil Schwartzman — strongly urged them to take immediate action. And this week at the Internet Governance Forum in Hyderabad, I've heard representatives from more than a dozen governments from all over the world discussing not whether "cyber crime" legislation is necessary, but rather how it should be formulated to fit their local legal standards and culture.

Facebook Vs. Adam Guerbuez And Atlantis Blue Capital

Facebook won an immense judgement against Montreal, Canada spammer and phisher Adam Guerbuez.

Guerbuez has a storied history, having been found arrested for uttering threats in 1997, charged with murder in 2000, faced marjuana charges in 2004 and perhaps most interestingly his online presence which began in 2003, he interviewed in the Montreal Mirror about his bum-fighting (homeless people paid to beat one another) websites crazypricks.com and bumvision.com. Currently he runs ballervision.com

Facebook's lawyers submitted this affidavit to the court outlining the character of Mr. Guerbuez, including his involvement with Neo-Nazi groups, and his criminal past.

CAUCE has been quoted today in the aftermath

NewsFactor Network

CTV

CAUCE President John levine also has some commentary on his personal blog
The Globe and Mail quotes Federal Task Force on Spam member Michael Geist regarding the lack of Canadian spam law and enforcement.

The Montreal Gazette makes note of Guerbuez' notorious past

Mr. Guerbuez's personal blog refutes any notoriety.