CAUCE

Sexism in The Tech Sector : Time to Grow Up & Speak Out

These days, I’ve seen many breathless posts about how 'we' "need" to encourage girls to study math so eventually they become computer or other sorts of geeks.

Personally, I don't think technology is the only valuable thing in the world; writing, music, and the rest of the arts, medicine, human relations, politics, and so on are pretty important things too, and let’s face it content was, is, and will always be king.

That said, if men continue to act like jerks, it is no wonder women will go into anything but technology.

Over the past few days, there were numerous reports out of the Blackhat / DEFCON gatherings in Las Vegas about blatant sexism.

The first, that CISCO had a 'pose with a babe' opportunity

@CiscoSecurity: Tweet us a picture with our Raven girls at Booth 101! #BlackHat

The tweet, and the picture have since been deleted, after the denizens of Twitter tore them a new one.

However, it didn’t stop there. Apparently there were presentation slides filled with comely women, and the best yet! Some idiot hired STRIPPERS to play a public game of 'Hacker Jeopardy'.

 

@0xabad1dea: Of course after checking morning twitter I learn defcon had strippers at jeopardy or something. Of only one gender, of course.

@DrPizza: That a girl was being stripped as a reward at hacker jeopardy at #defcon was pretty incredible.

 

This has to stop now.

Beyond the women in attendance being rightfully horrified (personally, I'd never attend again, until Blackhat makes an unmitigated, solid commitment to change and apologizes for past indiscretions), there are probably other men, such as myself, who find this offensive, prurient, and degrading to women, and, in fact, all attendees, indeed to our entire industry. The people behind this have the emotional age of 14. If you feel the need to see a half-naked girl who will never willingly sleep with you, GO TO A STRIP CLUB.

By the way: I can count the number of times I've been to a strip-club on my fingers, I've never had a good time at places like that, I feel degraded going there. Don't get me wrong, I think attractive women are the best thing on the planet, but there is a time and place to enjoy such interests, and at work isn't the place nor the time for masturbatory fantasies, and yes, when I attend conferences, it is to work. Someone pays my way, they get to expect something in return, and that something isn't me thinking of half-naked women.

(Just for a real quick second allow me to establish my street-cred by noting that I worked in the music industry for many years, so any claims of me being puritanical will be met with gales of laughter.)

MAAWG.org and other conferences have recently come up with Codes of Conduct which, while good, are depressing in the necessity to even have them. Do we really need to remind people to keep their petty prurient prejudices to themselves? Apparently so.

I can’t help but wonder what the reaction would be was these bigots to express themselves on Blacks or Jews at conferences. I’m pretty sure we’d have put an immediate and total stop to such things, and ostracized the perpetrators, instead of turning a blind eye, and passively tolerating this.

When I posted this rant on Facebook, in a more, plainly spoken manner (read: passionate and profanity-laced) version, a friend of mine reacted to thusly:

"The problem with making the decision, as a woman, to stay home and not go to places where this [stuff] happens, is that if you stay home, you then lose some/most/any of your status in the group.

Yeah, there's [crap] (like the time someone in the delivery industry said on a mailing list "we'll take you to the strip club, then you get to be a part of delivery.") but if women just avoid the people perpetrating the [crap], then women lose opportunity and access. On the other hand, if women call it out, then we also risk losing status as "one of the guys" or "not one of *those* women" (usually "feminist") or whatever. "Swallow [crap], or ruin the entire afternoon?" with a side of "and struggle in the field because I've now asserted that I am human too and expect respect."

I'm not sure there is one answer, but men speaking up about how the sexism [that clearly] exists in the tech sector is inappropriate is certainly part of the solution."

I think she is dead right. One need only look back at the Adria Richards debacle to see what happened to a woman who spoke up.

For those who don’t know, Ms. Richards overheard a couple of men at a conference prattling on in what she took to be a sexist manner. She snapped a picture of them, and tweeted it. Apparently the conference she was attending had a harassment policy, and they took her to task for not following protocol.

Some say she reacted or over-reacted inappropriately; I’m not one of those. Tolerate sexism and it is degrading. Speak up, and you are labeled a bitch. (The developer nomenclature to which she objected, ‘forking’ and 'dongles' isn’t accidental either. It is juvenile.)

I think it is noteworthy that Ms. Richards has not posted to Twitter since the incident in March, and her employer, Sendgrid, took the coward’s way out and fired her because of a small DDoS. They even made themselves out to be victimized by the situation. Well, enough is enough.

We all, as leaders in this industry need to speak out loudly, and clearly that we, as adult men, will not tolerate this bigotry towards our colleagues and friends any longer. Conferences need to put an end to objectification of any sort, immediately, and we all need to grow up.

Neil Schwartzman, Executive Director

Announcing CAUCE

Archive.org has the following press release announcing the formation of CAUCE. Happy birthday to us!

Internet, May 9, 1997--The Coalition Against Unsolicited Commercial Email (CAUCE) announced today that it is calling for a legal ban on unsolicited Email advertising. CAUCE has drafted an amendment to the federal law that bans unsolicited fax advertisements, to extend it to cover unsolicited Email advertising on the same terms. The proposal would give Email users control of the kinds of advertising they are willing to accept in their mailboxes, whether they prefer to shut it off completely, or ask for more.

The junk fax law (more formally, portions of 47 USC 227), provides that businesses may offer goods and services in fax messages only if the recipient has asked for the information or has a previous business relationship with the company. Recipients may ask to be taken off mailing lists at any time. Violation can result in a civil penalty of $500 per message, or more in the case of clearly willful violation or failure to provide a valid return fax number. Extending the same terms to Email should work equally well, according to CAUCE.

The arguments against junk Email and junk fax are very similar. Cost shifting to the recipient and denial of service are two of the most important. For example, many Email users and mailing lists have a daily limit on traffic, so UCE can displace other traffic and prevent it getting through.

"Starting from an existing law has several important advantages," said CAUCE co-founder Edward Cherlin. "We have a law that has worked well, that covers a very similar problem, and that has passed a constitutional challenge in court. The only thing really wrong with the junk fax law from our point of view is that so few people know it exists, so junk fax still continues on a small scale. That makes education the number two priority for us, behind getting the law passed."

The CAUCE Web site at http://www.cauce.org is an important part of the organization's education campaign. It offers information about UCE and the proposed amendment, a FAQ (Frequently Asked Questions) page, and a sign-up page where visitors can join CAUCE to receive a newsletter on Spam issues, or register their support for the proposal. Electronic signatures will be sorted and delivered to the appropriate Senators and Representatives.

The site also explains why other proposed solutions to UCE don't work, and how UCE harms other businesses. Because of UCE, many people are unwilling to deal with any online business. In particular it is impossible to create anything like a complete Internet Email directory service, since it would be used to generate mailing lists.

"We're not against commerce on-line. We're just against paying to receive junk mail. It's time-consuming to deal with, and it's incredibly costly - a cost which has to be passed on by the Internet Service Provider (ISP) to their subscribers." said CAUCE member John Mozena.

The Coalition Against UCE (Unsolicited Commercial Email) was founded by Scott Hazen Mueller, Vice President for Engineering for Whole Earth Networks, Edward Cherlin, Vice President for Business Development of NewbieNet, a free educational service for novice Internet users, and Doug Muth, a UNIX system administrator. The lobbying effort in Washington is led by Ray Everett-Church, a contractor with various ISPs on computer security issues.

For more information on the Coalition and its lobbying efforts, visit its Web home page at http://www.cauce.org. The CAUCE Web site explains the Spam problem, gives the text of the current law prohibiting junk faxes and the proposed amendment, and answers common questions about the proposal.

More information on UCE, or "spam", can be found at http://spam.abuse.net/spam. The current text of 47 USC 227 is available at http://www.law.cornell.edu/uscode/47/227.html.

More information on CAUCE can be found at http://www.cauce.org.

For more information on the coalition and its lobbying efforts, contact:
Scott Hazen Mueller
Phone: (415) xxx xxxx
E-Mail: scott@zorch.sf-bay.org
Edward Cherlin
Phone: (916) xxx xxxx
E-mail: cherlin@newbie.net.
WWW: http://www.newbie.net/Newbie_Pages/new39.html
Ray Everett-Church
Phone: 202 xxx xxxx 
E-mail: everett@everett.org

Boston Marathon Scams

Don't Be Scammed

Predictably, within hours of the tragic bombings yesterday that took place in Boston, scam domains in their hundreds, and fake social media pages began to spring up. To profit from a tragedy is contemptible, and CAUCE officers are doing their level best to ensure these domains are blocked, and taken down as quickly as possible.

Like you, we all mourn those who had their lives taken from them in Boston, and stand with those who were injured and affected by these vile deeds.

If you want to contribute in some way, please donate blood or money to the Red Cross. Go directly to their website here : http://www.redcross.org/news/press-release/Red-Cross-Statement-on-Boston-Marathon-Explosions 

The Spamhaus Distributed Denial of Service – How Big A Deal was it?

If you haven't been reading the news of late, venerable anti-spam service Spamhaus has been the target of a sustained, record-setting Distributed Denial-of-Service (DDoS) attack over the past couple of weeks.

Al Iverson over at Spamresource has a great round-up of the news, if you didn't manage to catch this item, go check it out, then come on back, we'll wait ...

Of course, bad guys are always mad at Spamhaus, and so they had a pretty robust set-up to begin with, but whoever was behind this attack was able to muster some huge resources, heretofore never seen in intensity, and it had some impact, on the Spamhaus website, and to a limited degree, on the behind-the-scenes services that Spamhaus uses to distribute their data to their customers, who happen to be some of the biggest sites and services on the Internet. Spamhaus notes they protect as many as 1.7 billion email accounts.

Some reasonable criticism was aimed at the New York Times, the BBC and Cloudflare for being a little hyperbolic in their headlines, and sure, it was a bit Chicken Little-like, the sky wasn't falling and the Internet didn't collapse.

But don't let the critics fools you, this was a bullet we all dodged.

For one, were Spamhaus to be taken offline, their effectiveness in filtering spam and malware would rapidly decay, due to the rate at which their blocklists need to be updated. The XBL anti-botnet feed and the SBL list both have many additions and deletions every day. These services are used to protect mail servers and networks against the most malicious criminal traffic. If they go down, a lot of major sites would have trouble staying up, or become massively infected with malware.

There are also a ton of small email systems that use the Spamhaus lists as a key part of their mail filtering (for free as it turns out). Were those lookups prevented, or tampered with, those systems would buckle under the load of spam that they dispense with ease thanks to Spamhaus.

To put it into perspective, somewhere between 80% & 90% of all email is spam, and thats the stuff Spamhaus helps filter. So it doesn't take a Rocket Scientist to figure out that if filters go out, so do the email systems, in short order. AOL's Postmaster famously said, at an FTC Spam Summit a decade ago, before the inception of massive botnets, that were their filtering to be taken offline, it would take 10 minutes for their email systems to crash.

Due to some poorly researched media reports (hello, Wolf Blitzer!), there is a perception that this is a fight between two legitimate entities, Spamhaus and Stophaus; some press outlets and bloggers have given equal time to the criminals (we use that word advisedly, there is an ongoing investigation by law enforcement in at least five countries to bring these people to justice). Nothing could be further from the truth. The attackers are a group of organized criminals, end of story. There is nothing to be celebrated in Spamhaus taking it on the chin, unless you want email systems and networks on the Internet to stop working.

So yeah. this was a big deal.

Postscript: There were some reports early on in the attack that some of the Spamhaus feeds may have been hijacked. There is no indication that that is ongoing.

 

Facebook, their Walled Garden, and McAfee Anti-Virus – What Really Happened

On Sunday, a number of Facebook users reported being locked out of the system. When they attempted to log in they were presented instead with the a series of screens, informing them that their computer was infected, and providing a link to a free scanning service by McAfee antivirus software.

Being locked out upset people to no end, because it was the first they had heard about their computer being infected.

It appears that Facebook users on a grand scale are receiving a notice that their account is temporarily locked and could be infected with a virus. These users are then encouraged to download a free tool by McAfee to scan their system. There has been much speculation on the issue. Our best guess is that there is a bug in Facebook's filters or algorithms that is yielding a false positive malware result for a large portion of these users. We have reached out to Facebook regarding the matter and will update this thread if we hear anything back.
Other users with Mac computers insisted they were safe.

If only that were true. Over just these past few weeks we have read about Facebook itself being hacked due to a vulnerability in Oracle’s common cross-platform (Windows, Mac, UNIX) software component Java. Media-player Adobe Flash has had a tough time of it too being repeatedly patched, then re-hacked within days, and that runs on all sorts of computers. One Adobe rep, looking very tired, said recently that things were so busy with security issues staff had taken to sleeping at the office. Like, as in ‘moved in’.

Our point? It was entirely reasonable to think that Facebook was detecting infected computers trying to log into their systems.

Wait what? Facebook is scanning their users computers?

Yes, they are. This isn’t a new activity. For example, Google and Facebook helped quell a massive infection called DNSChanger by diverting infected users to special pages with disinfection information U.S. Cable ISP behemoth Comcast also scans their users’ computers and in the case of repeated, untreated infections, user accounts are placed in a so-called ‘walled garden’ limiting Internet access until they can be fixed.

Walled Gardens are a reasonable approach, and an effective way to deal with the rampant levels of compromised computers that can damage networks, and the users’ themselves, by stealing personal information on the machine. In fact, CAUCE has representation on the FCC’s Communications Security, Reliability and Interoperability Council (CSRIC) working group advocating a similar approach industry-wide.

CAUCE has also been involved in parallel discussions in Canada, where the idea is still nascent, but is likely to take hold shortly. But what does all this have to do with Facebook Users? Facebook scans computers connecting to their network for infections, and places compromised user computers in a walled garden until the problem can be remediated. They offer free tools to help. They write certain rules for the scanning engine to detect the infections Reasonable enough. According to a Facebook rep., speaking on condition of anonymity said the problem last Sunday was a new employee wrote rules that were a bit too aggressive, and they incurred many false positive results, falsely indicating computers were infected when they were not. After a couple of hours, the error was caught, and initially they withdrew the rules, and then began to find, and reverse the suspended status of those users they had initially blocked. This lead to what users were experiencing– log in once, you are told you are infected, log in again, no such notice. This is what is known in the computer industry by the technical phrase ‘oops’. CAUCE congratulates Facebook (and others) on their efforts to help mitigate computer compromises by this approach. While it is irksome, and sometimes scary to be locked out, and told your computer is infected, the worst-case scenario is that you were unable to post cat and baby photos for a short time on Sunday, and had to run a harmless anti-virus scan.

What happens when people respond to pharma spam?

NPR's Planet Money did a remarkable piece yesterday, based on research by reporter Brian Krebs and UCSD professor Stefan Savage, looking at pharma spam (black market pharmacies selling prescription drugs), who sends it, and what happens when people respond.

The most surprising discovery was that, for the most part, people actually get the drugs they order. Listen to the Planet Money episode for the full story.

Are You Donating to a Real Charity?

Please share this post.

After a tragedy, many of us want to donate to funds and charities to show our support for a community.

However, scam charities immediately pop up, looking to steal your well intentioned donations. There are at least 30 newly-registered domains created in the past 48 hours related to the tragic shootings at the Sandy Hook elementary school in Connecticut: Most, probably all are scams and rip-offs. How then, to donate so that your funds make it to the deserving victims?

Check out Charity Navigator, an online database that assesses charities based upon revenues, operating costs, and the percentage of funds that make it to the intended recipients.

Donate to the Red Cross / Red Crescent / Magen David Adom. The International Red Cross is a stalwart organization that is reliable, and extremely well-run. The Red Cross of America has a fund for the families and survivors of the Sandy Hook shootings.

News site CNN usually will make mention of an appropriate charity. They report that the United Way of Western Connecticut have set up a Sandy Hook School Support Fund at https://newtown.uwwesternct.org/

If you encounter what you believe to be a scam charity, report them to your local police, federal government or police force, and to the Internet Crime Complaint Center

TEN STEPS : What To Do if Your Data is Being Held for Ransom

 

We have your data. Fork over the money!

 

For the past few months, so-called 'Ransomware' has been very popular among online criminal gangs. A computer is infected with malware which encrypts some or all of the data on the computer, and the criminals demand a payment to restore the machine to normal.

This ofen comes with a fake warning from the national law enforcement agency of the location of the computer, such as the FBI in the US, and geo-locates the payment to dollars or Euros as appropriate. Sometimes the warning claims pirated content or illegal pornography has been found on your machine. While we don't know what you have been downloading, we can say this: Law enforcement won't infect your computer and demand ransoms.

It can happen to anyone: the Miami Family Medical Centre, in the Gold Coast of Australia has reportedly lost patients' medical records to this scheme.

So, what to do, and how to avoid being held to ransom for your favorite grandkid's pictures, your PhD dissertation, or that quarterly report you've been working on for weeks?

1. Do not try to remove the malware yourself. Some variants have trip-wires built in that erase your data permanently if you do the wrong thing.

2. Back up your files religiously.

By religiously we mean constantly, at least several times a day. You can do this automatically with many back-up programs like Apple's Time Machine that back up changed files every hour, and then all files once a day.

3. Use Cloud Services for important data - keep stuff you can't live without somewhere else, like a central server if your organization has one, or box.com, dropbox.com, Google drive, etc.

4. Keep your software and operating system up to date every day! Use Windows Update set to automatically install updates, and Secunia, to alert you to updates to your other applications, if you are a PC user. Apple machines also have automatic checks for software and OS updates.

5. Run anti-virus software. Yes, even if you have an Apple computer! While A/V software can miss some viruses, it generally catches up pretty quickly and is your first line of defense.

6. Install the MyWOT plugin onto all of your browsers. My WOT blocks access to malicious sites.

7. If you are infected, and have anti-virus software that failed to detect the malware - wait if you can. As variations of the malware come out, so too do updates to anti-virus programs - see if you can update your a/v software, as it may be able to decrypt the stolen data.

8. If you have backups, or your data is stored on a cloud service, have an expert help wipe your machine completely clean, reinsstall your operating system and software, and then restore your data from a backup version prior to the infection.

9. If you are really stuck - as a last resort, pay the ransom. Paying the ramsom reportedly works in some cases. But try everything else first, because it may just tell the criminals that you're a live one, so they can come back for more.

While we don't encourage people to give money to criminals, if the data is irreplacable, you may have to give this a try if all else fails.Then start making backups. If you need to buy a backup disk, do so, now that you know what a good investment it is.

10. Don't respond to spam. Never click on it - delete it immediately

FBI Agent Thomas X. Grasso Receives First J.D. Falk Award

News Release

For Immediate Release        

FBI Agent Thomas X. Grasso Receives First J.D. Falk Award
for Establishing DNS Changer Working Group and Protecting End-Users

Baltimore, Maryland, Oct. 25, 2012 – Convincing competitors, disparate business entities and researchers to collaborate – many donating their services and resources – to protect millions of end-users worldwide is no small feat. Yet FBI Supervisory Special Agent Thomas X. Grasso did just that by quietly working behind the scenes to create the DNS Changer Working Group that saved an inestimable number of end-users from losing access to the Web over the last two years.  Recognizing his leadership, Grasso received the inaugural J.D. Falk award on Tuesday at the Messaging, Malware and Mobile Anti-Abuse Working Group 26^th General Meeting in Baltimore.

 

The first-annual J.D. Falk Award

“Tom embodies the kind of personal sense of responsibility and accountability that built the Internet and is vital to its future growth.  First, he had the foresight to understand the problem and to realize that something could be done to prevent it.  Then it took an enormous commitment of his time and energy to muster the resources and bring dissimilar entities together to accomplish an objective that turned out to be a critical issue for many end-users,” said M³AAWG Co-Chairman Chris Roosenraad.

 

Grasso created the ad hoc committee based on the relationships and goodwill he had developed over his 12 years working with the Internet industry.  He persuaded large corporations to commit time and funds to notify infected customers, and convinced anti-virus vendors, Internet Service Providers and the security research community to cooperate in the project.  DCWG members include Georgia Tech, Internet Systems Consortium, Mandiant, National Cyber-Forensics and Training Alliance, Neustar, Spamhaus, Team Cymru, Trend Micro and others.

In November 2011, the FBI’s Operation Ghost Click led to the arrest of six Estonians allegedly behind the distribution of the DNS Changer malware and thought to be operating the illicit Rove Digital advertising network. The malware hijacked Internet searches and re-routed Web browsers of infected computers to fraudulent sites on Rove Digital’s network by altering the DNS settings the computers use to locate websites. Once the rogue servers were turned off, the malware-infected computers that had their settings redirected to them would not have been able to reach the Web.  

The DNS Changer Working Group was Grasso’s idea to encourage end-user remediation of the malware and to respond to the massive challenge of potentially millions of users losing access to the Web. The group helped monitor the DNS servers that were now legally operated by the Internet Systems Consortium (ISC) under a court order, and as a result, the infected users received a useful message to clean up their machines instead of suddenly dropping off the Internet. 

“The FBI recognizes the invaluable assistance the private sector and academia provided through the DNS Changer Working Group,” said Joseph M. Demarest, assistant director of the FBI’s Cyber Division.

CAUCE founding member J.D. Falk, an active member of M³AAWG and many other industry organizations, was passionate about safeguarding the Internet, end-user security and the impact of cooperative endeavors. The award named after him recognizes individuals for specific achievements that enhance the Internet experience, protect end-users, and embody his spirit of volunteerism and community building. It is administered by M³AAWG with the support of Falk’s employer Return Path Inc. and the Falk family.

CAUCE, MAAWG, London Action Plan release "Best Practices to Address Online and Mobile Threats" Report

New Online and Mobile Best Practices Clarify Business and Governmental Security Tactics




Baltimore, Oct. 24, 2012 – A cooperative international report available today outlines
Internet and mobile best practices aimed at curtailing malware, phishing, spyware, bots
and other Internet threats, and provides a thorough review of current and emerging
threats.  “Best Practices to Address Online and Mobile Threats” is a comprehensive
assessment of Internet security as it stands today and explains in non-technical language
the proactive steps that can help mitigate risks, according to the report’s two major
contributors, the Messaging, Malware and Mobile Anti-Abuse Working Group (M3AAWG) and the
London Action Plan (LAP).

The report is also one of the first global efforts to encourage governments to deploy best
practices, which are more often associated with businesses.  It focuses on four major
areas of concern: malware and botnets, social engineering and phishing, IP and DNS
exploits, and mobile threats. To encourage government participation, it has been
presented to the 34-member country OECD (Organisation for Economic Co-Development) for
review.

“Best Practices to Address Online and Mobile Threats” draws on the tactics that have
proven effective over the past decade to reduce online risks, then augments these with
forward-thinking recommendations for emerging vulnerabilities, such as mobile text spam
and Web abuse. The comprehensive report is available here:



Download Best_Practices_to_Address_Online_and_Mobile_Threats_(Oct_2012)

The report is also available via the London Action Plan site and by way of the Messaging
Anti-Abuse Working Group site.

“As a globally cooperative effort, the report brought together an unprecedented team of
experts who outlined safe computing tactics in uncomplicated, accessible language for
end-users, large and small businesses, and governments. This is also one of the first
efforts to update industry recommendations recognizing that public agencies are important
online enterprises, and just as companies need to implement best practices, so do
governments,” Alex Bobotek, M3AAWG co-chairman said.

CAUCE President John Levine noted "We were honored to work with Industry Canada, M3AAWG,
and the other organizations. Online security is such a massive problem that working
partnerships among governments, business, and non-profits such as CAUCE is the only
logical way forward to deal with these issues."

The international community collaboratively stepped up to generate the report in a
public-private partnership led by André Leduc, Manager of the National Anti-Spam Coordinating
Body at Industry Canada. Industry experts from M3AAWG, LAP and other
organizations, such as CAUCE, contributed to it.
CAUCE President John Levine, and Executive Director Neil Schwartzman were part of the
Paris delegation that presented the report to the OECD committee on consumer protection,
it was also reviewed by the Working Party on Information Security and Privacy (WPISP).

Online threats are evolving as Internet and mobile technologies play a more vital role in
many business models, attracting cybercriminals who target users on popular platforms such
as laptops, tablets, smartphones and other handheld devices. As the Internet economy
grows, implementing the best practices detailed in the report will help reduce illegal
activities such as spam, phishing, malware and spyware distribution, botnet deployment,
the redirection of Internet traffic to malicious websites and denial of service attacks.