CAUCE

spamNEWS 09/28/2013

CAUCE posts regularly on topics related to spam. Here are our picks of the most interesting news items of the day.

You can follow them in real time on Twitter on Google +  or on LinkedIn

Facebook wins $3M injunction against spammer Steven Vachani aka Power.com http://news.cnet.com/8301-1023_3-57604866-93/facebook-wins-$3m-injunction-against-spammer/

Revealed: UK secretly arrested 16-year old boy for world’s ‘biggest’ DDoS-attack http://rt.com/news/uk-boy-arrested-ddos-attack-411/

Data Broker Giants Hacked by ID Theft Service http://krebsonsecurity.com/2013/09/data-broker-giants-hacked-by-id-theft-service/

DMARC Forward Reporting: Why Network Owners Should be Informed, too http://blog.abusix.com/2013/09/24/dmarc-forward-reporting-why-network-owners-should-be-informed-too/

LinkedIn Class Action http://www.linkedinclassaction.com

A Study of Whois Privacy and Proxy Service Abuse by @MAAWG STA Dr. Richard Clayton http://www.lightbluetouchpaper.org/2013/09/25/a-study-of-whois-privacy-and-proxy-service-abuse/

Is Fake iMessage App Malware or Not? http://www.enterprise-security-today.com/story.xhtml?story_id=121000A6NWYX&nl=7

Do not use iMessage Chat for Android – it’s not safe [Updated] @digitaltrends http://www.digitaltrends.com/mobile/imessage-chat-android-security-flaw/#ixzz2gDyzRIv1

ICANN and Your Internet Abuse By Garth Bruen @circleid http://www.circleid.com/posts/20130924_icann_and_your_internet_abuse/

Twitter's User Growth Slows, Perhaps As A Result Of Spam Account Purges Ahead Of IPO http://www.businessinsider.com.au/twitters-user-growth-slows-2013-9

Spam Arrest's Sender Agreement Fails Because Email Marketer's Employees Lacked Authority http://www.circleid.com/posts/20130919_spam_arrests_sender_agreement_fails/

Apple's a tasty phishing target for scammers http://www.pcworld.com/article/2049287/apple-is-a-tempting-phishing-target-for-scammers.html

Ransomware Puts Your System To Work Mining Bitcoins http://blog.malwarebytes.org/intelligence/2013/09/ransomware-puts-your-system-to-work-mining-bitcoins/

KETLER INVESTMENTS CC vs. South African INTERNET SERVICE PROVIDERS’ ASSOCIATION http://badwhois.info/Ketler_Invest_v_ISPA_JMNT_REVISED.PDF

Boston Marathon Scams

Don't Be Scammed

Predictably, within hours of the tragic bombings yesterday that took place in Boston, scam domains in their hundreds, and fake social media pages began to spring up. To profit from a tragedy is contemptible, and CAUCE officers are doing their level best to ensure these domains are blocked, and taken down as quickly as possible.

Like you, we all mourn those who had their lives taken from them in Boston, and stand with those who were injured and affected by these vile deeds.

If you want to contribute in some way, please donate blood or money to the Red Cross. Go directly to their website here : http://www.redcross.org/news/press-release/Red-Cross-Statement-on-Boston-Marathon-Explosions 

The Spamhaus Distributed Denial of Service – How Big A Deal was it?

If you haven't been reading the news of late, venerable anti-spam service Spamhaus has been the target of a sustained, record-setting Distributed Denial-of-Service (DDoS) attack over the past couple of weeks.

Al Iverson over at Spamresource has a great round-up of the news, if you didn't manage to catch this item, go check it out, then come on back, we'll wait ...

Of course, bad guys are always mad at Spamhaus, and so they had a pretty robust set-up to begin with, but whoever was behind this attack was able to muster some huge resources, heretofore never seen in intensity, and it had some impact, on the Spamhaus website, and to a limited degree, on the behind-the-scenes services that Spamhaus uses to distribute their data to their customers, who happen to be some of the biggest sites and services on the Internet. Spamhaus notes they protect as many as 1.7 billion email accounts.

Some reasonable criticism was aimed at the New York Times, the BBC and Cloudflare for being a little hyperbolic in their headlines, and sure, it was a bit Chicken Little-like, the sky wasn't falling and the Internet didn't collapse.

But don't let the critics fools you, this was a bullet we all dodged.

For one, were Spamhaus to be taken offline, their effectiveness in filtering spam and malware would rapidly decay, due to the rate at which their blocklists need to be updated. The XBL anti-botnet feed and the SBL list both have many additions and deletions every day. These services are used to protect mail servers and networks against the most malicious criminal traffic. If they go down, a lot of major sites would have trouble staying up, or become massively infected with malware.

There are also a ton of small email systems that use the Spamhaus lists as a key part of their mail filtering (for free as it turns out). Were those lookups prevented, or tampered with, those systems would buckle under the load of spam that they dispense with ease thanks to Spamhaus.

To put it into perspective, somewhere between 80% & 90% of all email is spam, and thats the stuff Spamhaus helps filter. So it doesn't take a Rocket Scientist to figure out that if filters go out, so do the email systems, in short order. AOL's Postmaster famously said, at an FTC Spam Summit a decade ago, before the inception of massive botnets, that were their filtering to be taken offline, it would take 10 minutes for their email systems to crash.

Due to some poorly researched media reports (hello, Wolf Blitzer!), there is a perception that this is a fight between two legitimate entities, Spamhaus and Stophaus; some press outlets and bloggers have given equal time to the criminals (we use that word advisedly, there is an ongoing investigation by law enforcement in at least five countries to bring these people to justice). Nothing could be further from the truth. The attackers are a group of organized criminals, end of story. There is nothing to be celebrated in Spamhaus taking it on the chin, unless you want email systems and networks on the Internet to stop working.

So yeah. this was a big deal.

Postscript: There were some reports early on in the attack that some of the Spamhaus feeds may have been hijacked. There is no indication that that is ongoing.

 

What happens when people respond to pharma spam?

NPR's Planet Money did a remarkable piece yesterday, based on research by reporter Brian Krebs and UCSD professor Stefan Savage, looking at pharma spam (black market pharmacies selling prescription drugs), who sends it, and what happens when people respond.

The most surprising discovery was that, for the most part, people actually get the drugs they order. Listen to the Planet Money episode for the full story.

Are You Donating to a Real Charity?

Please share this post.

After a tragedy, many of us want to donate to funds and charities to show our support for a community.

However, scam charities immediately pop up, looking to steal your well intentioned donations. There are at least 30 newly-registered domains created in the past 48 hours related to the tragic shootings at the Sandy Hook elementary school in Connecticut: Most, probably all are scams and rip-offs. How then, to donate so that your funds make it to the deserving victims?

Check out Charity Navigator, an online database that assesses charities based upon revenues, operating costs, and the percentage of funds that make it to the intended recipients.

Donate to the Red Cross / Red Crescent / Magen David Adom. The International Red Cross is a stalwart organization that is reliable, and extremely well-run. The Red Cross of America has a fund for the families and survivors of the Sandy Hook shootings.

News site CNN usually will make mention of an appropriate charity. They report that the United Way of Western Connecticut have set up a Sandy Hook School Support Fund at https://newtown.uwwesternct.org/

If you encounter what you believe to be a scam charity, report them to your local police, federal government or police force, and to the Internet Crime Complaint Center

TEN STEPS : What To Do if Your Data is Being Held for Ransom

 

We have your data. Fork over the money!

 

For the past few months, so-called 'Ransomware' has been very popular among online criminal gangs. A computer is infected with malware which encrypts some or all of the data on the computer, and the criminals demand a payment to restore the machine to normal.

This ofen comes with a fake warning from the national law enforcement agency of the location of the computer, such as the FBI in the US, and geo-locates the payment to dollars or Euros as appropriate. Sometimes the warning claims pirated content or illegal pornography has been found on your machine. While we don't know what you have been downloading, we can say this: Law enforcement won't infect your computer and demand ransoms.

It can happen to anyone: the Miami Family Medical Centre, in the Gold Coast of Australia has reportedly lost patients' medical records to this scheme.

So, what to do, and how to avoid being held to ransom for your favorite grandkid's pictures, your PhD dissertation, or that quarterly report you've been working on for weeks?

1. Do not try to remove the malware yourself. Some variants have trip-wires built in that erase your data permanently if you do the wrong thing.

2. Back up your files religiously.

By religiously we mean constantly, at least several times a day. You can do this automatically with many back-up programs like Apple's Time Machine that back up changed files every hour, and then all files once a day.

3. Use Cloud Services for important data - keep stuff you can't live without somewhere else, like a central server if your organization has one, or box.com, dropbox.com, Google drive, etc.

4. Keep your software and operating system up to date every day! Use Windows Update set to automatically install updates, and Secunia, to alert you to updates to your other applications, if you are a PC user. Apple machines also have automatic checks for software and OS updates.

5. Run anti-virus software. Yes, even if you have an Apple computer! While A/V software can miss some viruses, it generally catches up pretty quickly and is your first line of defense.

6. Install the MyWOT plugin onto all of your browsers. My WOT blocks access to malicious sites.

7. If you are infected, and have anti-virus software that failed to detect the malware - wait if you can. As variations of the malware come out, so too do updates to anti-virus programs - see if you can update your a/v software, as it may be able to decrypt the stolen data.

8. If you have backups, or your data is stored on a cloud service, have an expert help wipe your machine completely clean, reinsstall your operating system and software, and then restore your data from a backup version prior to the infection.

9. If you are really stuck - as a last resort, pay the ransom. Paying the ramsom reportedly works in some cases. But try everything else first, because it may just tell the criminals that you're a live one, so they can come back for more.

While we don't encourage people to give money to criminals, if the data is irreplacable, you may have to give this a try if all else fails.Then start making backups. If you need to buy a backup disk, do so, now that you know what a good investment it is.

10. Don't respond to spam. Never click on it - delete it immediately

How to Prevent (and mitigate) Data Breaches

Cisco's Michael Sanchez published a great piece called 5 Steps for avoiding data breaches.

We tweeted, plussed, and re-posted this elsewhere, and at the encouragement of SURBL's Jeff Chan, here's a blog post about this practical advice. (Do read the article in its entirety)

Step 1: Document where your data is stored and how it is accessed.
Step 2: Identify the level of protection your data needs.
Step 3: Secure your company’s data.
Step 4: Create a disaster recovery plan.
Step 5: Know what to do if you experience a data breach.

Since we are talking about data breaches, it should be noted that Canada is now considering a bill, C-12, 'An Act to amend the Personal Information Protection and Electronic Documents Act' that provides for mandatory notification of breaches.

C-12 is the re-tabling of bill C-29, a bill that died on the order table last year; it is a companion to C-28, Canada's Anti-spam Law; it also has provisions to allow Canadian law enforcement to share data and evidence with agencies outside of Canada, and even among themselves, something that is currently illegal under PIPEDA.

CAUCE supported C-29, and of course supports the passage of C-12. Given the Conservative majority, it is expected that C-12 will pass this legislative session.

Facebook has stolen all the contents of mobile address books, including private telephone numbers

As you know, Facebook have a long, storied history, including several ongoing brushes with the Privacy Commissioner of Canada, and despite repeat warnings against abuse of end-user rights, they recently deployed facial recognition software with no notice given their 500,000,000 users.

Today, however was the straw that broke the camel's back. Unbeknowst to me, perhaps by way of their new 'Facebook messanger' [update: actually, by way of Facebook's iPhone app.] they have uploaded the address books of hundreds of millions of users' mobile phones.

I found the home, private, business and mobile telephone numbers of 700 friends, colleagues, co-workers, and associates (Facebook users or not) published on their site [update: on my account only - at least, for the moment, but nonetheless up on Facebook] - I never agreed to this, I never knew about this, and it was only by way of the Sophos blog post below that I discovered this.

To check to see if you have had the same unfortunate thing happened to you:

1. Log into Facebook
2. Click on Account (upper RH corner)
3. Click 'edit friends'
4. Click 'contacts' (LH side)

(There is the option to disable this feature. Turn OFF synching on your mobile phone, then go here)

update: CAUCE Director Matt Sergeant had this to say on his blog - he nails exactly what is wrong with this:

Addressing the latest Facebook privacy issue

(This is a non-work post, but Disclaimer: I work for Symantec and regularly talk publicly about security issues)

There’s been lots of talk today online about the latest Facebook privacy debacle whereby they have all your cell phone contacts listed on your “Contacts” page.

Facebook have been trying to quiet the storm, as people are posting to their status updates for people to disable this.

First, to combat some FUD: Facebook is not sharing this information from you with your friends. Your buddies aren’t going to be able to call up your Grandma.

But what Facebook have entirely ignored, and why this is again an issue, is the question of permission.

I have two phones. One is a work phone (BlackBerry), and one is my personal iPhone. The only phone the contacts I had listed on Facebook came from is my BlackBerry, which is good, because I have a lot of random old numbers in my iPhone (don’t ask!).

So what happened here? I believe that the latest BlackBerry Facebook app (which recently underwent a major upgrade) automatically set the preference to sync contacts with Facebook. Now it may very well have been in the multi-page user agreement that I accepted, but yes I admit, I don’t read those things. And those agreements don’t even appear on the iPhone version, because, and here’s the fundamental difference I guess: the iPhone version doesn’t transparently change your preferences.

Facebook needs to stop that. I don’t care if it’s useful, or if you’re not sharing it with anyone else. I don’t want you uploading my contacts to your servers without ASKING me first.

It’s that simple. And this is why there are laws against what they have done in various countries, and why this will probably result in yet another lawsuit against them.

Rant over.

CAUCE are stunned by this move, it is beyond the ken. We will be calling upon Facebook to remove this facility immediately (it should always bo opt-in by default, as should ALL end-user options) and failing that, filing complaints with the proper authorities.

See more: http://nakedsecurity.sophos.com/2011/08/11/has-facebook-got-your-mobile-number-now-your-friends-do-too

--
Neil Schwartzman
Executive Director
CAUCE : The Coalition Against Unsolicited Commercial Email

CRTC Publishes Regulations, another step towards CASL coming into Force

Happy Canada Day from the CRTC

As anticipated, the CRTC took a long-awaited step towards Canada's Anti-spam Law coming into force; regulations designed to help define the scope and impact of the law were published late afternoon, June 30. They are available in their full form here: http://www.crtc.gc.ca/eng/archive/2011/2011-400.htm

They are quite terse, coming in at less than 440 words. CAUCE will comment here in due course, but for your instant gratification, here they are:

The proposed regulations prescribe the form and certain information to be included in a CEM. They establish that a CEM must set out information that identifies the sender of the message and, if different, the person on whose behalf the message is sent, as well as, if applicable, the names of those persons’ businesses. The CEM is also to include information that would enable the recipient to readily contact such persons. Further, the proposed regulations prescribe that this information, as well as the unsubscribe mechanism, be set out clearly and prominently.

The proposed regulations also specify a particular form by which information relating to the sender of the message and the unsubscribe mechanism may be accessed, in circumstances where it is not practicable to include such information in a CEM, for instance, because of character limitations.

Section 6 of the Act prohibits the sending of a CEM unless there is express or implied consent from the recipient of that message. Section 7 of the Act prohibits, absent express consent, the alteration of transmission data in an electronic message which results in the message being delivered to a different destination. Section 8 of the Act prohibits the installation of a computer program unless express consent has been obtained. The Commission’s proposed regulations prescribe the form of a request for express consent for the purposes of subsections 10(1) and 10(3) of the Act. More specifically, the proposed regulations stipulate that any request for express consent must clearly identify the person seeking consent and, if different, the person on whose behalf consent is sought, and, if applicable, the names of those persons’ businesses. In addition, it is proposed that contact information be included for such persons, and further, that there be a requirement to include a statement which states that consent may be withdrawn using the contact information provided.

The focus of the final segment of the proposed regulations is the installation of computer programs in the course of a commercial activity, which, as noted above, is addressed in section 8 of the Act. The proposed provisions prescribe that additional information be provided when requesting express consent if a computer program that performs a function set out in subsection 10(5) of the Act is to be installed. In such circumstances, the proposed regulations prescribe the manner in which the computer program’s material elements must be brought to the attention of the person from whom consent is being sought, and further establish that the person seeking consent must obtain a written acknowledgement from the person from whom consent is sought that they understand and agree that the program performs the specified functions.

Best Buy and Air Miles notify Alberta, Canada Privacy Commissioner of Epsilon Data Breach

The Office of Information and Privacy Commissioner for the province of Alberta issued a decision [PDF] on May 16, regarding the Epsilon breach that affected the customer lists of 150 different companies, including Best Buy and Air Miles. Both companies operate in Canada.

The Personal Information Protection Act, which went into force May 01, 2010, compels companies to notify their customers in the event of a breach. Both companies did so.

Best Buy and Air Miles proactively reported to the Commissioner that they had been notified by their service provider, Epsilon (a large US based third party marketing organization) that it had experienced a data breach in which 50 million or more email addresses were compromised and that its customers as well as customers of other organizations serviced by Epsilon had been affected. Best Buy and Air Miles had also proactively notified their affected members of the breach within a few days of learning about it.

Commissioner Work reviewed the incident reports by Best Buy and Air Miles and concluded that although the information at issue (name, email addresses and organization membership (in the Best Buy case) was relatively minor compared to other data breaches which involve the unauthorized access of financial or other sensitive information, the sheer magnitude of the breach and the evidence that the information will likely be used for malicious purposes indicated there was a real risk of significant harm to affected individuals. He noted in his decisions that Best Buy and Air Miles had already notified the affected customers in compliance with section 19.1 of the PIPA Regulation, and therefore did not require the organizations to notify again.

CAUCE congratulates both Best Buy and Air Miles, as well as Information and Privacy Commissioner of Alberta, Frank Work on their actions in this regard.

As always, our advice to consumers remains the same: If you received a notices from any company regarding the Epsilon breach, we suggest you change your email address immediately.