CAUCE

Resources for Cleaning Your Network

Image by dr.jd via Flickr

The first step (but certainly not the last) towards saving the internet from spam, malware, and other abuse is to keep your own network clean.

A friend of CAUCE, who wishes to remain anonymous, offers these tips and resources to help you identify problem traffic emanating from your network, and clean it up.  Though primarily written for ISPs, many of the items below should apply equally well to any network owner.

Zero-point: Problems which aren't identified don't get fixed. So...

First and foremost, proper identification of the ISP's IPs in both RIR (APNIC) and rDNS. Along with that, working and properly processed Abuse e-mail contact for APNIC and "abuse@domain" for the generic rDNS primary domain. Correct domain whois goes hand-in-hand.

Then, in no particular order...

Block port 25 on dynamic ranges, as recommended by MAAWG.

Complaint Feedback Loops and other abuse reporting mechanisms: Spamhaus and Word To The Wise both have links to get started on those, and ISPs serious about cleaning up should subscribe all their IP ranges to as many of those FBLs as they can handle. (The best for spam detection would be subscribing to all of them but volume can get quite high so they may wish to pick and choose what fits their needs the best.)

That includes SpamCop, but it's worth its own mention. Unlike most other FBLs, SpamCop reports spamvertised URLs as well as spam source. Note that it has both direct spam reporting and "Summary" reports which provide IP-by-IP reporting for a subscribed range on an hourly or daily basis.

www.abuse.net can help them direct spam reports to the right place.  SpamCop seems to look at Abuse.net, too.

CBL offers rsync of its data within terms of use posted on its website. An ISP with that data can use grepcidr across its IP ranges to identify currently active spam-bot IPs.

Spamhaus PBL provides participating ISPs with CBL's list bots in the respective ISP's IP ranges, so that's another easy way for ISPs to get that same data.

Botnet C&C and malware related IPs identified by the FIRE group can be
found by ASN with http://maliciousnetworks.org/ .

Senderbase.org, Trustedsource.org and Senderscore.org websites all have searchable reputational information which can help an ISP corroborate reports they get with a wider sample of traffic...very useful.

I'm sure there are more such resources, I'd be interested in them and I hope others will chime in, but for an ISP which is already overrun with spam issues, those websites should at least give them grist to start grinding away at the problems. I suspect the more difficult challenge will be to get them to actually back the effort.

Any ideas?  Post them in the comments, and maybe our anonymous friend will join in too.

Related articles by Zemanta

• Computerworld: Outbound spam: the canary in the coalmine (boxofmeat.net)
• Which "experts" do you listen to? (spamtacular.com)

T'is the Season for Apartment Rental Scam Spams - Consumer Alert

Summer tends to be moving time here in Montreal, as it is elsewhere. This year, I have decided to move, and thought it would be an opportune time to share a warning about some scams that are related to this seemingly harmless activity.

First off is the 'Too good to be true' Craigslist posting (or Kijiji, or any other public listings site!). Last time I moved, I went searching on CL for a new place, as so many do. I found a nice listing, and emailed the purported landlord. I got an email back from someone claiming to be on missionary work in Africa, and if I would just send him or her some money, the place was mine; I could pick up the key when the cheque cleared.

I researched a bit further, and found that what the scammers had done was re-post a previous listing on CL from a few weeks past, dropping the price enough to make the offer seem great, but yet remain credible. A call to the landlord and an email to Craigslist Abuse had the listing and a few others taken down.

Scam two: Advance Fee Fraud - I am now subletting my place, and today, a very nice lady ostensibly in Benin is offering to send me money to reserve my flat, sight unseen. No doubt, it will be a cheque, which I would deposit. Then, complications will arise, she will ask for her money back, less a fee for the hassle. The cheque would take some time to clear, but by then, the money would be safely in the hands of the scammers.

Bottom line: Never rent an apartment or house from someone who isn't present to show you around, and pay with a cheque noting the address, and the date of the first month of rental. Here in Quebec, we have government issued lease forms available everywhere, always use them, and make sure the person renting has the authority to do so. Otherwise, come moving day, you may find yourself without a place to live.

Never pay out money from cheques you receive before your bank has had time to clear the payment, and are 100% willing to state the transaction is legitimate. Otherwise, you will find yourself on the hook for the money.

As always, the old saw 'if it seems too good to be true, it probably is' applies. Remain skeptical, especially in your online dealings.

Neil Schwartzman
Executive Director, CAUCE

I need a job, and just got some spiffy email about a new job site!

Posted on behalf of: Neil Schwartzman, Executive Director CAUCE

A friend of mine just wrote to me about a new service called NotchUp.com so I looked them up on DomainTools.

Now, why would a company obfuscate their domain registration? I can't think of a good reason why. That isn't to say that NotchUp.com is not a fine upstanding company, I don't know, but having correct and open information in your domain registration means you are taking responsibility for your online conduct.

Unemployed folks, and others looking to change jobs should be very careful when joining a job recruitment site; they can be real hornet's nest. For one, job applicants are giving out a tremendous amount of personal data that can be misused to the ends of personal identity theft. As well, many of them are not worth the bother, or can be out-and-out malicious.

Another friend was the victim of a drive-by virus-infected when someone ostensibly reached out to him about a VP-level job, one for which he was suitable (he's a sales guy, so it might not have been entirely targeted).

The CAUCE advice?

• Stick with the biggies - to name a few; Linkedin, Monster, Workopolis, Craigslist
• Check out new companies and new job sites from the comfort of your own browser!
• Run the domain through DomainTools
• Get yourself a copy of the great tool from McAfee Site Advisor, a plug-in that works for both Internet Explorer and Firefox, and check out their reviews.
• Use the Alexa Firefox plug-in to check out if the site has a reasonable amount of traffic.
• Use your favourite search engine on the name and the domain name of any potential job site or employer. Then search again and add the qualifier + spam. Or + scam
• Never respond to Unsolicited email
• If the job seems too good to be true, (especially if you are desperate!), stay away!

For example, LinkedIn currently has many 'work at home' jobs touted, money-laundering for 419 and phish-stolen money. Getting involved in those schemes helps sustain spamming, and you can be arrested. (LinkedIn are doing a fine job of deleting these as fast as they come in, but the bad guys slip through, nevertheless)

Good luck with your job search, don't let the bad guys swindle you!

Q&A: Talking Points Against spam

Q:
Dear CAUCE,

I need your help. I work for an organization that sends an email newsletter once a week. Someone in my office came up with the bright idea that we should auto-subscribe every person in our offline database and let them "opt-out" if they don't want to get it. While this email is not necessarily of a commercial nature, I personally still consider this unsolicited email to be spam. Can you provide me with a white paper or talking points on why this is a terrible idea so that I can make this case to my bosses?

Should I send CAUCE copies of the spam I recieve?

Please do not send us any copies or samples of the spam you receive. As a group we receive thousands of spam messages every day, as individuals we receive hundreds to our personal accounts.

We are an advocacy group, not a spam reporting service or the "internet police." We do not hove the resources or the authority to assist you with individual spam messages.

For help reporting, please talk to your internet service provider or use the current tools provided to you by your web mail providers (i.e. Junk button in Hotmail, or the "Report spam" button in Gmail).

Q&A: I'm being forged - HELP!

Dear CAUCE Team,

We are looking for support resources to thwart a massive spam/forgery attack that misuses our company name -- claiming we are the spam source. The spam contains url links to numerous computers that apparently download viruses. We are looking for assistance and guidance in dealing with this. Any suggestions?

Regards,
Forged

Q&A: Are unsubscribes just a courtesy or a requirement?

From time to time we get questions from our members and we will try to answer many of them here.

I work for an organization that has a "community" portion of its site. People sign up and among the "benefits" they get is a newsletter. There is no way to opt out of this newsletter and we get a lot of complaints about it. This organization is run by an individual who would not be likely to listen to any employee who pointed out that an opt out or unsubscribe option would not only be courteous but also probably less illegal than what we're doing now.

Q: How can we shake the boss up to alert her to the fact that people should be able to unsubscribe?

Are Invitations spam?

Q1 - I would like to know if inviting viewers of my email to subscribe to my newsletters that I send out from MyNewSite.com seen as spam?

Q2 - As I surf on the internet and come across a group or individual I would like to invite to subscribe to my group on Mysite.com and the newsletter?

I bought/rented a list of Opt-in names, but now I'm being accused of spamming. Why? What should I do different?

If somebody offers to sell you a bulk list of 'opt-in' email addresses, you're almost certainly getting a spam list. What you're going to receive from them is a list of addresses belonging to people who have not agreed to receive messages, or a list that's been mailed to so often that it is no longer useful to other mailers. To put it another way, whatever they might have opted into, it wasn't mail from you.

As a sender, it is your job to confirm that your list is truly opt-in. Where do you begin? Doing your homework saves headaches later - headaches driven by poor results, spam complaints, blacklisting, wasted time and money, and bad PR. In other words this is not a responsibility you can shirk by saying 'I have no way of knowing how accurate or authentic these names are' or 'They guy from the list rental organization says it's opt-in'. It's your responsibility to know about the names your communicating with. Sending unsolicited commercial email will bring a number of problems to your email program, to mention a few; Major DNSBL listings and ISP blocking, recipient complaints, and a negative sender reputation

Why does my government allow spam?

Governments are catching up with spam laws, but sadly many have not legislated this yet. Canada has no spam laws, even though the "Federal Anti-Spam Task Force" recommended this in 2004. Country specific laws can be found at Spamlaws.com

The United States has legislated email with CAN-SPAM (Controlling the Assault of Non-Solicited Pornography and Marketing Act) in 2003. This law require several elements of a commercial email message conform to a minimum set of standards. Here is a rundown of the law's main provisions:

• It bans false or misleading header information
• It prohibits deceptive subject lines
• It requires that your email give recipients an opt-out method, which must be processed within 10 days of receiving by the sender
• It requires that commercial email be identified as an advertisement and include the sender's valid physical postal address

Unsolicited bulk e-mail that complies with these rules is legal under CAN SPAM, even though such UBE is widely considered to be spam.

The Internet community is also working on several global initiatives to help stem the tide of unsolicited commercial email, CAUCE recently endorsed the Senders BCP published by MAAWG, written mostly by Email Service Providers with input from ISPs, Corporations and RBL providers.