CAUCE

Kidnapping, Theft and Rape Are Not "Cyber" Crimes

Kidnap. Rape. There are no lesser words that can be used to describe what happened to the daughter of an anti-spam investigator in Russia.

His daughter was recently released, according to Joseph Menn’s recent article on Boing Boing, after having been kidnapped from her home five years ago, fed drugs, and made to service men, as a warning to ward off further investigations.

The criminals behind these vicious acts were also responsible for large spamming organization associated with Russian Mob activity.

Note that we say "also."

When someone is mugged, harassed, kidnapped or raped on a sidewalk, we don't call it "sidewalk crime" and call for new laws to regulate sidewalks. It is crime, and those who commit crimes are subject to the full force of the law.

For too long, people have referred to spam in dismissive terms: just hit delete, some say, or let the filters take care of it. Others — most of us, in fact — refer to phishing, which is the first step in theft of real money from real people and institutions, as "cyber crime." It's time for that to stop.

Some of these crimes involve technology. So what? Criminals have used technology before.

Some of these crimes cross borders. So what? Crimes have crossed borders before.

Spam isn't illegal everywhere yet. So what? Spam 2.0 (spam, malware & spyware) is the leading edge of far worse activities, often things that have been illegal as long as we've had laws.

It is high time that governments and law enforcement stop thinking of computer crime as that perpetrated by teenagers in their parent’s basement. It is the Russian Mob and other organized criminals that are doing this.

While we are at it, we should mention ‘cyber-warfare’, something too often conflated with cyber-crime. Cyber-crime is not "cyber-warfare.” There may be state or terrorist agencies copying the tactics and methods of these criminals, but that does not mean that the criminals must be left alone until new cyber-warfare agencies have been created and funded.

As Purdue computer science professor ‘Spaf’ Spafford was recently quoted as saying in a note-worthy piece ‘Cyberwar Vs. Cybercrime’ on the GovInfo Security blog

"Why aren't we seeing the investment and prioritization being made in law enforcement, first? Why is all the publicity, funding and prioritization being given to the military - with efforts such as the build-up of the military cyber command - when so much of the clear and present threat is from the criminal element and not from other nation-states?"

Just so, Prof. Spafford!

As we have said repeatedly on this site, these are criminal gangs who have found an incredible loophole in the justice systems of the world: they can rob banks and people, with little chance of getting caught, let alone going to jail. This is not because they're doing things that aren't illegal; they've just found a new way to hide.

David Black, manager of the RCMP's cyber infrastructure protection section recently said to CAUCE Executive Director Neil Schwartzman “we don’t do spam”. OK, but why not? Spam is no longer, and hasn’t been for some time, about simply sending unwanted emails. Spam is now a delivery mechanism for malware, which in turn threatens infrastructure, and facilitates theft. We have seen precious few cases filed using existing Federal computer intrusions laws in Canada, and none, to our knowledge have been filed under the renovated anti-phishing law, S-4, passed in September 2009.

Governments and law enforcement agencies need to begin to treat online theft with the same seriousness as they do other physical crimes. It is time to bring this up to the diplomatic level, or seriously consider refusing packets from places that treat the Internet, and innocent victims, as their personal ATM.

CAUCE is made up of people who care about email qua email. We understand it, we love it. It is still the ‘killer app’. Furthermore, we understand why some folks in law enforcement or the judiciary might ask, "When there are people stealing millions or hurting people in the commission of violent crimes, why are you wasting our time with 'just' a spam case?” Here's why:

1. Most spam is sent by organized criminal gangs, just like other organized crime.
2. Those gangs intentionally operate trans-nationally, in an effort to frustrate investigation and prosecution.
3. Money laundering of the proceeds from spam is routine, and that money directly fuels official corruption and other social ills.
4. Some spammers are actually selling something. Their favorite product? Counterfeit pharmaceuticals. In many cases these may be scheduled controlled substances, sold in bulk, and available to minors; in other cases, critical medicines needed to properly treat cancer and other serious illnesses may be counterfeit placebos, with potentially tragic results.
5. Spammers operate by compromising tens or hundreds of thousands of end-user PCs, violating those users' privacy and sometimes steal sensitive personally identifiable information such as individuals’ and even corporate access to financial services at the same time they're using their systems to spam. Computer ‘phishing’ is no less a crime than bank robbery, home invasion, and mugging.

Cyber criminals consider cyber crime to be a virtually riskless offense; they're unlikely to be identified; if identified, they're unlikely to be investigated; if investigated, they're unlikely to be charged and prosecuted; if prosecuted, they're unlikely to be convicted; if convicted, they're unlikely to do jail time.

The courts need to make it clear that that's wrong in all respects. If you commit cyber crimes, you will be identified, investigated, charged, prosecuted, convicted and sentenced to serious time and we will seize your assets.

This will not happen so long as crime, which involves the Internet, is dismissed as "cybercrime" and either scoffed at, or used to justify ever-increasing cyberwarfare budgets

This isn't just email. This isn't a war. This isn't "cyber.” This is crime. It is time to call a cop, and expect a response.

 

by CAUCE Executives J.D. Falk & Neil Schwartzman

How Your Privacy Is Exploited Online and How To Protect Yourself

I spotted a disturbing headline which reminded me to repost a recent series about online privacy in the Wall Street Journal.

Suit alleges Disney, other top sites spied on users - CNET News

A lawsuit filed in federal court last week alleges that a group of well-known Web sites, including those owned by Disney, Warner Bros. Records, and Demand Media, broke the law by secretly tracking the Web movements of their users, including children.

...

Among the laws that were allegedly violated by Clearspring and the other defendants are the Computer Fraud and Abuse Act, California's Computer Crime law, and that state's Invasion of Privacy Act.

(CNET uses trackers themselves. Using the Firefox plugin Ghostery, we see that they monitor using Twitmeme, Comscore Beacon, Revenue Science, Yahoo Buzz, Facebook Connect, Google Analytics, and Chartbeat to monitor your surfing)

The article above references a multi-part series I highly recommend you read if you care about your online privacy (just for the record, the Wall Street Journal uses the following trackers: Facebook Connect, MSN Ads, Chartbeat, Peer39, Fox Audience Metrics,  Google Analytics, Omniture, WoprdPress Stats.

CAUCE uses Google Analytics and Bit.ly, and Typepad, where we are hosted, inserts Quancast tracking into our posts.).

The New Gold Mine: Your Personal Information & Tracking Data Online - WSJ.com

How to Outsmart Tracking Cookies on the Web - WSJ.com

What They Know About You - Personal Information Tracked Online - WSJ.com

Analyzing What You Have Typed - WSJ

ARIN makes a sane decision about IP WHOIS

The recent ARIN XXV meeting in Toronto had two positive developments related to WHOIS privacy and accuracy of data.

A decision was rendered about contentious proposal 2010-3: Customer Confidentiality https://www.arin.net/policy/proposals/2010_3.html which allowed for commercial IP holders to have hidden WHOIS records, ostensibly to prevent client poaching between ISPs. As one commenter said at the meeting 'if you are losing customers, fix your business'.

Both CAUCE and MAAWG were opposed to this proposal, which was withdrawn by the submitter, Aaron Wendel, after some discussions with representatives of the LEA community. The proposal made provision for decloaking WHOIS records upon request, court order, etc. by law enforcement, a hopelessly naive understanding of the current situation with regard to anti-abuse work. It was impressed upon the assemblage that grass-roots anti-spam investigations were behind the majority of takedowns of malicious sites, for example. Tom Grasso, an FBI investigator who was in attendance commented, "95% of our successful cases are as a result of grassroots investigators. Limiting ARIN WHOIS to LEA is not a good idea"

Despite having been withdrawn, a vote was taken, and nonetheless, defeated roundly.

Of the 133 attendees to the meeting, 5 voted in favour, 70 against.

A second bit of good news was related by Leslie Nobile, ARIN Director of Registration Services who noted that ARIN would commence a process of confirming all WHOIS email points of contact, beginning in June, 2010, and that this would become an annual process.

CAUCE Director Matt Sergeant was in attendance at ARIN to represent our position as a signatory and supporter of the MAAWG position statement.

Download MAAWG Comments ARIN Draft Policy 2010-3

T'is the Season for Apartment Rental Scam Spams - Consumer Alert

Summer tends to be moving time here in Montreal, as it is elsewhere. This year, I have decided to move, and thought it would be an opportune time to share a warning about some scams that are related to this seemingly harmless activity.

First off is the 'Too good to be true' Craigslist posting (or Kijiji, or any other public listings site!). Last time I moved, I went searching on CL for a new place, as so many do. I found a nice listing, and emailed the purported landlord. I got an email back from someone claiming to be on missionary work in Africa, and if I would just send him or her some money, the place was mine; I could pick up the key when the cheque cleared.

I researched a bit further, and found that what the scammers had done was re-post a previous listing on CL from a few weeks past, dropping the price enough to make the offer seem great, but yet remain credible. A call to the landlord and an email to Craigslist Abuse had the listing and a few others taken down.

Scam two: Advance Fee Fraud - I am now subletting my place, and today, a very nice lady ostensibly in Benin is offering to send me money to reserve my flat, sight unseen. No doubt, it will be a cheque, which I would deposit. Then, complications will arise, she will ask for her money back, less a fee for the hassle. The cheque would take some time to clear, but by then, the money would be safely in the hands of the scammers.

Bottom line: Never rent an apartment or house from someone who isn't present to show you around, and pay with a cheque noting the address, and the date of the first month of rental. Here in Quebec, we have government issued lease forms available everywhere, always use them, and make sure the person renting has the authority to do so. Otherwise, come moving day, you may find yourself without a place to live.

Never pay out money from cheques you receive before your bank has had time to clear the payment, and are 100% willing to state the transaction is legitimate. Otherwise, you will find yourself on the hook for the money.

As always, the old saw 'if it seems too good to be true, it probably is' applies. Remain skeptical, especially in your online dealings.

Neil Schwartzman
Executive Director, CAUCE

A Dangerous Buzz, and Opt-In Isn't Just for Email

Image by dr.jd via Flickr

Google is great at generating buzz, and they've done it again with their new social vitality tool, appropriately named Google Buzz.

Buzz takes all of your GMail contacts (and presumably other connections from elsewhere within the Googleplex), and makes them all your "friends" by default; it then shares your activity from Google Reader, YouTube, and other tools with all of them, and vice versa.  They can see who your friends are, and you can see who theirs are.  It's a quick & impressive way to make a whole new social network out of the original social networking tool: email.

Only one problem: all of those connections, and all of that public information, happens by default.  You do get to choose whether or not to activate Buzz, but apparently it's activated either way — and if you say no, you won't have access to the nearly-hidden privacy controls.

These may seem like small issues: Facebook already tells the world who you're friends with, and Twitter updates are public by default.  But with both of those, you choose to sign up and you know what you're getting (until it changes.)  Buzz is different: you signed up for GMail, and suddenly this other thing happened too.  Suddenly, things you thought were private are public.  It's tantamount to spyware.

This is all of particular concern to someone like the author of the Fugitivus blog, who writes anonymously about her life — including some truly disturbing experiences, being raised in an abusive family and then married to an abusive husband.  Everyone should have the right to make their own privacy choices; for her, privacy is absolutely required.  Her well-being, perhaps even her life depends on it.

When Google Buzz showed up, it revealed her activity to all of her most common correspondents — which includes her ex-husband.  Things she had thought she was only sharing with her boyfriend and her mother, that she thought she had control over, were now automatically shown to someone she has very good reason to trust no further than her inbox.  See the problem here?

We've talked for years about the "opt-in" paradigm for email: companies and organizations should not send you advertisements unless you've asked for them — even if they believe you'll be interested.  Similarly, companies and organizations should not be sharing your information with others — even if they believe you know the person — without asking first.

Shame on Google for not considering the choice aspect of privacy before launching Buzz.  You know better.

Related articles by Zemanta

• Fugitivus: Fuck you, Google (boxofmeat.net)
• Google: Buzz off! (accmanpro.com)
• Google Buzz: The Missing Features (readwriteweb.com)
• Google Buzz And Their Social Strategy (cloudave.com)
• Is Google Reader Still an RSS Reader? (staynalive.com)
• Google will Improve Buzz based on Users' Feedback (taragana.com)

Keeping Kids Safe on Facebook

Image by hoyasmeg via Flickr

Though some of the technologies and techniques differ, there's a lot of overlap between email safety and social network safety.  Laura Deisley, who speaks about technology with parent groups, has written an extremely complete list of things parents should do to keep their kids' Facebook accounts safe; the same concepts apply equally wel to other social networks & email accounts.

A Word of Warning about your Donation to Charity

Many of us have seen the heart-wrenching scenes from the world’s latest natural disaster, in Haiti, and want to help.

Unfortunately, there are some who would take advantage of the situation, and people’s charitable nature, and put fraudulent requests for money online. As Linda McGlasson over at the Bank Info Security blog said ‘there Is a special place in hell’ for people like this.

Let’s hope so, because the sad, awful truth of it is that Symantec is reporting this morning that they have already seen spam fraudulently claiming to be from the Red Cross, soliciting donations for Haitian Earthquake relief funds. There have been sporadic reports of fraudulent tweets on Twitter, and some Google search results have been skewed in an attempt to divert people to malware and phishing sites.

Do not use links to potentially fake charities from anywhere but the most trusted of reliable sources.

To be safe, check the list of charities at www.whitehouse.gov

If you are in Canada, the Canadian government is matching private donations – you can find more information here.

If you are in another country, check out your federal government’s or local newspapers’ websites to find out where best to send funds.

Lastly, and most importantly, don’t let these bad actors scare you off from doing the right thing. Please donate generously, if for no other reason than to prove the world is a better place than they make it out to be.

By the way, please feel free to repost or tweet this article.

Consumer Alert: Deep Inside a 'Work at Home' Scam: Mules Victimized by "Air Parcel Express"

Here at CAUCE, we don't often post articles unrelated to spam law, but this piece by RSA is remarkably well-written and relevant to all Internet users, particularly during these days of high unemployment. Scam job offers to 'work at home' have appeared on legitimate sites such as LinkedIn, Craiglist, and Monster.com, and even in the classified sections of newspapers. Before accepting such a position, or even engaging the scammers in a discussion please ask yourself 'would anyone really pay me several thousand dollars to receive high-priced goods, or cash their cheques, and if so WHY?' Such workers end up on the hook for receiving stolen goods, or bank fraud, the scammers leave the workers holding the bag. Do yourself a favour, and don't get involved in such scams. If you are wondering if it sounds too good to be true, it always is.

Deep Inside a Reshipping Scam: Mules Victimized by "Air Parcel Express"

by RSA FraudAction Research Lab on 11/12/2009
Since last fall the RSA FraudAction Research Lab has tracked several different reshipping scams engineered by online fraudsters to "Cash Out" merchandise purchased using stolen payment cards through the involvement of mules. We will profile one such scam in-depth — Air Parcel Express — that was discovered by RSA. First we will outline who is involved in a reshipping scam and how they generally operate.

The recipient view of marketing email

CAUCE Treasurer-Secretary Dennis Dayman posted this gem over at deliverability.com, essentially, his wife, a civilian as it were, has some things to say about marketing email.

Should I Stay or Should I Go?

by Neil Schwartzman

"If I stay there will be trouble; …If I go there will be double." — Joe Strummer (1952-2002)

"We can be heroes, just for one day." - David Bowie (1947- ) 

Working in the anti-spam and online malware fight can be depressing or at best invoke multiple personality disorder.

We all know things are bad on the net, but if you want a dose of stark reality, check out Brian Krebs' fantastic Security Fix blog on the Washington Post site. Written with both technical accuracy and readability for the rest of us, a rare thing indeed, Brian is the current raving-fav among the security set, due to his high profile, and willingness to call a spade a spade.

He has shone the spotlight of national media on some real embarrassments, situations like ICANN dragging their feet regarding the decertification of rogue registrar EstDomains (a service much-favoured by malware authors and spammers), (they are now offline), Atrivo, a California-based ISP which played a pivotal role in sustaining the Storm botnet, (they are now offline) and Krebs played a part in the latest victory for us good guys on the net, noting McColo was a host for botnet command-and-control technologies  (yes, they too are now offline!)

So why the ambivalence Neil? Good question! Speaking to an old friend who asked me what I was doing these days, I recently likened the fight against this relentless onslaught to having one's pinky in a dyke, and there are days when I don't even think we have a dyke! We've certainly seen dedicated anti-spam/anti-malware volunteers suffer from burn-out, and drop off, over the years, a loss to all of us as an Internet community.