CAUCE

Follow-up-up To Loudmouths Wanted: Sorry, not sorry

In March, I posted a call to action to those of us in the community who have the inclination to fight against a movement to redact information critical to anti-abuse research. Today i felt compelled to react to some of the discussions on the ICANN discussion list dedicated to the issue of WHOIS reform: 

Sorry, not sorry: I work every working hour of the day to protect literally hundreds of millions of users from privacy violating spam, phish, malware, and support scams. 

 

Should access to WHOIS data be redacted in any way beyond what it is at present, my work will be made impossible. I spend 90% of my day in WHOIS data, the other 10% sculpting the data in a manner to provide reason and proof to hosting provider and registrars to take action against real-life criminals on their networks.

 

I also prepare cases for law enforcement to act upon. Contrary to popular belief in some quarters, LE cannot possibly begin to know about the stuff I (and my many, many colleagues) see, until we tell them.  That’s how it works. Any of the big botnet and crime ring take-downs and arrests you’ve ever seen have involved a public-private collaboration between individuals, researchers such ads myself, and law enforcement.

 

So, I’d like to issue congratulations to all those who want to redact. You will, without a single iota of uncertainty, will expose many more people to real – not potential or hypothetical –  privacy issues of a far more serious nature than you could possibly imagine, all in the badly mangled, misguided, and muddleheaded notion of what privacy actually is in the real world. ‘Cut off your nose to spite your face’ has never been more apt.

 

I hope you tell your Mom, family and your friends what you are trying to do here, while I spend my time trying to protect them from real evil: Revenge porn. Identity Theft. Plain old theft. Stalking. Photographic representation of the rape of children. Trolling, leading to the destruction of people’s lives. Emptied bank accounts.

 

Tell them you don’t want me to be able to do my job, and that you are trying to make it impossible, because you think access to the data that has been public and without challenge under the world’s privacy laws for twenty years is better off limited to the point of uselessness, sacrificed on some misshapen altar of privacy. 

 

If I sound angry at what you are attempting to do, then I’ve hit my mark. i am furious. The security sector is furious. We are terrified that you may have any degree of success in this regard, because you apparently don’t know, or don’t care what the actual results will be. Placating with ‘gated access’ means there will be some among my peers and colleagues, far more talented and effective than I, who simply cannot gain access, and the resulting mess will be on your head, and at risk of overstating my case, the blood on your hands.

 

So again, congratulations. Mother’s Day is coming up. Be sure to make mention of this in the card you send. Now, if you’ll excuse me, I’ll go back to diving in the data lake of WHOIS, trying to keep spam and far worse evil off’ve your network.

 

K bye tnx.

Neil Schwartzman

Executive Director

Coalition Against Unsolicited Commercial Email

http://cauce.org

Twitter : @cauce

 

Protecting yourself from Vishing

Many people are very trusting when they receive phone calls claiming to be from their bank, credit card company, or ISP.  However, scam phone calls are becoming more and more common every day. From the IT Support phone calls about a computer virus, or a call from your local cable company that is providing a new customer deal that is too good to be true (but are secretly trying to steal your account credentials) we are all encountering these more and more often.

As a consumer, you need to protect yourself and challenge anyone calling you so they are forced to validate who they are before you give them any information.

This is the summarized transcript from a call I had just this morning with "a representative" claiming to be from American Express* but being unwilling to validate that they were actually calling from the credit card company.

Caller: Hello, This is [Female name I missed] from American Express, is this "My Name"?

Me: Yes

C: I'm calling about an offer we sent you in the mail, did you get it?

M: What was the offer concerning?

C: If you could just validate some information I could explain the offer...

M: Sure - Can you please validate you're Amex first, then I'll validate who I am...

C: Sir, I need to validate who you are before we continue...

M: Before we continue I need you to validate you're actually Amex.

C: I don't understand what you're asking? I'm just calling to talk about an offer we sent you.

M: Great, tell me about this offer.

C: Sir, I just need to validate you're who you say you are.

M: Great, please validate that you are Amex first.

C: Sir, Please validate your DOB.

M: You called me, and I said hello and yes that's who you've reached. Please validate you're Amex.

Repeat the last 7 lines a few times and then I got tired of the conversation, said goodbye and hang up the phone.

As a consumer frequently targeted by Phone scams, it's time to start taking a stand against these phone calls and force companies to validate who they are before giving away you personal information. Companies will need to adapt to a smarter, more suspicious consumer that is looking to protect their identity.

* Maybe it actually was Amex, but they failed to validate this to me and the call ended. 

 

CRTC Do Not Call List (Canada)

FTC Do Not Call List (United States)

 

LOUDMOUTHS WANTED FOR ICANN WHOIS Replacement Work

TL;DR? It’s worth reading, BUT, if not - ICANN has yet another group looking at WHOIS, and there is ahuge push to redact it to nothing. I spend easily half my day in WHOIS data fighting online crime, losing it would not make my job harder, it will make it impossible. 

PLEASE JOIN THE ICANN GROUP and help us fight back against people who are fighting in favour of crime. 

M3AAWG has submitted at least three comments in this regard, but that’s not how ICANN works, they consider numbers of submissions to be more important than who is making a statement. M3 with hundreds of member companies, counts for one vote.

Do it now; it is time for the security community to stand up strong to this nonsense. Thanks.

 

https://community.icann.org/display/gTLDRDS/Next-Generation+gTLD+Registration+Directory+Services+to+Replace+Whois

 

Thanks,

 

Neil Schwartzman

Executive Director

Coalition Against Unsolicited Commercial Email

 

Rant shared with permission:

Subject: 

ICANN WHOIS Replacement Work

Date: March 24, 2017 at 4:05:52 PM GMT-4

 

We have been trolling them with facts for a month now. I learned a lot about that group in that time. Here’s a blood pressure boosting wall-of-text rundown:

 

The group is a bunch of registrars and “right to be forgotten” privacy people. They want to kill DomainTools and all similar services. 

 

The "privacy" advocates want domain ownership to be anonymous without a court order. They have no concern about privacy violation caused by criminals. They don’t care that anonymous free speech is already available or that the domain system they are trying to create will be tremendously dangerous for dissidents and so forth to trust. They want to create privacy by forcing us to delete data we have collected from public sources. They are extremist fanatics with ideas unburdened by knowledge. People on this mailing list have done far more to protect privacy than these so called advocates.

 

And for the registrars, it appears they are intent on saving money as they don’t want to deal with the complaints or maintenance of whois. They seem uninterested in the fact that their small savings will cause huge losses for someone else. Some are dismissive of law enforcement, and some have spoken hostile words about Spamhaus, where the only other mouths I have heard such words from belonged to spammers. The arrogance from some of them is palpable.

 

I am not exaggerating. The list archives are public, and you should decide for yourself.

_______________________________________________________

 

I don’t want this to be an entirely negative reactionary issue. There are opportunities. If enough people *who actually use WHOIS and own domains* participate, we can make WHOIS better. 

• Have you ever been irritated with a bad domain that enjoys the benefits of WHOIS privacy? 
• Have you ever been irritated that a registrar makes you visit their website and answer a CAPTCHA to see the WHOIS record, only to find out their website is broken?
• Have you ever been irritated with a registrar that gives your search warrants the middle finger and discloses no whois?
• Have you ever been irritated with registrars that minimize their exposure on DomainTools(and other WHOIS archivers) so they can appeal to abusers?

 

If we don’t participate, the risk is that bad policy hurts the Internet while increasing the profit of a minority. It has happened before. Here are some past ICANN policy issues:

• the .ZIP TLD, apparently no one involved saw a potential problem, but they certainly saw profits
• An explosion in general of TLDs that increased profits for registrars, with few controls on price abuse to the benefit of registries and the expense of everyone else.
• Companies spending hundreds of thousands of dollars to get a TLD, and domains on new TLDs- to prevent anyone else from using their name.

 

Make no mistake, killing our visibility will reduce the money they spend on abuse complaints and subpoenas. It is insane that this minuscule industry dictates policy that increases risk for the global financial system.

 

_______________________________________________________

 

In case you didn’t see this, here is a list of quotes said in earnest by people who ICANN is taking policy input from. Feel free to cross reference them with the public archives, and you will see that they absolutely believe this, and that they dominate the conversation:

 

“Shit Registrars Say"

 

On defenders losing access to WHOIS:
"Buhu my work will get harder"

--

On law enforcement stating that access is crucial:
"Good thing that police are law "enforcement" not legislators. They can ask for anything they like, it is not like it has legal binding status. It is a wish list, nothing more..." 

--

Stepping on toes:
"Harvesting and storage of whois data to be re-wrapped and sold is illegal and many registrars state this on the terms and conditions.
[...]
storage of whois data is illegal unless it was for a lawful purpose and the only one I can think of is transfers. 
[...]
This will step on some registrars toes as well as [Brand Protection professional]'s toes who have a business model around the supply of whois data for commercial gain (namely charging for it)."

--

On the legality of Domaintools and WHOIS archives:
"Who says we need a Whois Archive? The GDRP have explicitly a section about the right to be forgotten, that will say all records deleted!

The way f.ex Domaintools operate today are not in the terms of a lot of whois providers conditions and in some cases illegal" 

--

On what you can do with WHOIS data you query:
"Depends on the terms you accept when you make the whois inquiry. You may be violating the terms of the registrar or registry providing the whois service. "

----------------------------

 

Feel free to share my observations with others(TLP:GREEN) because we should spread awareness. This is regulatory capture at significant expense to us but we can stop it. Participate, vote, and we can make ICANN great again.

 

You can join the ICANN working group via this page. There is no barrier to entry, no cost, and no minimum requirement beyond filling out a statement of interest. 

 

https://community.icann.org/display/gTLDRDS/Next-Generation+gTLD+Registration+Directory+Services+to+Replace+Whois

 

We’ve played bad cop/worse cop enough. Yall to show up and say something. Right now our community's concerns receive mockery and disrespect. You need more than one voice there. You need a multitude. These people need to become a minority.

Chart of Legal Actions taken under CASL

A PDF Chart of all legal actions taken by enforcement agencies since CASL came into effect. The PDF has live links to the case files.

CASL Cases.pdf

TC Training Session Links

ASN Tool http://bit.ly/TCRISE1

CRT.sh http://bit.ly/TCRISE2

 

 

findmyiphone-alert.info
findmyiphones.online
findmyiphone-icloud-appleld.com
findmyiphoneid-login.us
fmi-support.services

icloudbackup.com
icloud-fmi.net
icloud.co.findmyldevices.com
icloudbackup.com
icloud.verificar-ubicacion.com

icloud-manager.com
icloud-manager.iphones-support.com
icloudremovalservices.com
icloud.com-viewlocations.us
itunes-payment-update.com

itunes-giftcardasas.serv-z0.com
itunes-giftcard.us

itunesconnect.view-order.config.4id.assistant-repair.newconditions.reparacionescayro.es
itunes.store.apple.com-billpayment.services

itunes-applestoreid.com

itunesconnect.view-order.config.4id.assistant-repair.newconditions.reparacionescayro.es

Evangelizing Best Practices – Taking Operation Safetynet on the Road

The passing of J.D. Falk, five years hence

J.D., if nothing else, was all about the best practices, and standards. Today marks five years since he ambled off this mortal coil, leaving a hole in the hearts of friends and family, some published documents that bear his name, others his imprimatur, and a lasting impression upon we, his colleagues in the anti-abuse community. In other words, he made the difference we all aspire to.

[Author’s note: As I write this (October 23), the second massive denial of service attacks in two weeks, threatening to take down significant sections of the Internet has just ended. Could full implementation of Operation Safety net have prevented this? While technology on both sides, attackers and victims is constantly evolving, I am forced to say yes, OSN could readily have helped. – ns]

The M3AAWG/UCEnet (nee London Action Plan/CAUCE omnibus best practices document, entitled Operation Safety Net – Best Practices to Address Online, Mobile, and Telephony Threats has been a boon to government, industry, and end-users, and, to be honest, to me personally.

Cutting through the complicated techno-jargon too often bandied around in our industry, which serves to befuddle the audiences we must influence are we to affect the foundational changes needed to secure the net infrastructure, the 76-page report written by security experts from around the world was originally requested by the Organization for Economic Co-operation and Development in 2012, then updated in 2015.

As the lead author and shepherd André Leduc noted recently, "Translating our technical and engineering way of talking into plain language was probably the most important part of this work. We wanted to create a report that a security officer or an engineer could give to colleagues and management to help them understand cyber-attacks and why their organizations might be targeted. We also wanted to make it easy for government policy makers in both the developed and developing countries, where they may not have much technical experience, to take action."

André Leduc recently won the 2016 J.D. Falk Award, deservedly, for his work on this remarkable project.

I was on the small team along with former M3 Co-chair Alex Bobotek, and my long-time cohort CAUCE President John Levine who presented the first iteration to the OECD Consumer Safety Working Group in Paris.

After that, the real work began. While everyone at M3 knew about the document, that was kind of like preaching to the converted, and we needed to get the document out into the rest of the world, who were (and still are) blissfully unaware of the steps we all must take to batten down the hatches.

To make the best practice information more accessible, the report, originally published in English, has been translated into French and Spanish, as well as localized in summary form in Japanese and Thai. That’s where I come in.

One of the most delightful things I get to do these days is speak and train in various parts of the world, and OSN has been a foundational part of my materials since it was first published. I had the opportunity to facilitate inclusion of the document into the IGF’s Antispam Toolkit (although OSN deals with issues far more broadband than ‘mere’ spam) at the meeting in Joao Pessoa, Brazil. As well, through the help of the M3Anti-Abuse Foundation I presented the work to the African ISP association in Tunis, Tunisia, well as to a group of law enforcement officials in Thailand.

Working with M3AAWG organization Team Cymru, CAUCE sent me to present in Santiago Chile, again to law enforcement, and with partner organization World Hosting Days I put our work in from of hundreds of new and established hosting companies and registrars, in Singapore, and Bangalore, India.

This month I travel to Japan, to lay out the ground work to protectorates of critical infrastructure – Japanese (atomic) power companies want to know more, and better, how to protect themselves from simple vandalism, or, what could be far, far worse, to the point of being catastrophic.

As my colleague, friend, and CAUCE board member Kelly Molloy quipped ‘this is why spam matters’. Spam is a conveyance. Operation Safetynet, the solution

I just reviewed my memorial blogging at the time of J.D.’s death, I ended with this: "Simply put, honour his legacy by continuing it".

I’m so very glad to say so many are doing exactly that.

"Spam King" Sanford Wallace finally goes to jail

Sanford Wallace has been sending spam for over 20 years. Despite losing innumerable lawsuits, he's managed to stay out of jail until now. His luck finally ran out, in a case where he was convicted of contempt of court and hacking many Facebook users.

Laura at Word to the Wise wrote about how Spamford's mail got her into spam fighting in the 1990s.

Article at The Register

Canadian regulators use CASL to take down a botnet

The Canadian Radio-television and Telecommunications Commission (CRTC) used Canada's Anti-Spam law to take down a control and command server in Toronto for the Dorbot botnet.

The CRTC's press release is here. They worked with industry and government in many countries. Microsoft sent out a release with more details on the way Dorkbot works.

In addition to its anti-spam provisions, CASL sets rules for downloaded installable software, which ranges from benign smartphone apps and browser plugins to malicious botnets and password stealing malware. The CRTC investigation is ongoing so they haven't disclosed the details, but the authority to take down the C&C server appears to come from the prohibition against unauthorized downloads and installs. CAUCE congratulates the CRTC on this sophisticated and effective use of its new enforcement authority.

CRTC fines another big company that should have known better

Today the Canadian Radio-television and Telecommunications Commission (CRTC) announced that Rogers Media, one of the largest mobile phone and cable companies in Canada, had agreed to pay $200,000 to resolve long running violations of Canada's Anti-Spam Law. For over a year, July 2014 to July 2015, Rogers sent e-mail with opt-out links that didn't work, or if they did work Rogers continued to send mail anyway. The details of the undertaking Rogers agreed to are here.

Rogers is a big sophisticated company, and there's no good reason they can't manage their mail to stop sending ads when people ask them to. This kind of spam is particularly hard to filter, since the same message might be sent to a Rogers customer who'd agreed to receive it, and to someone else who't told them to stop.

The Case of Spamford Wallace: Guilty at Last!

My anti-spam community friends were all abuzz today with the news that Spamford Wallace had pleaded guilty in a Las Vegas court to "compromising approximately 500,000 Facebook accounts" in order to deliver "more than 27 million spam messages."

What might amaze the General Reader is that this is the SAME Spamford Wallace case that began with an indictment on July 6, 2011.

 

According to the Indictment, Wallace created an account on November 4, 2008 under the name "David Frederix" and then tested posting spam messages to his 'real' wall "Sanford MasterWeb Wallace" experimenting with which posts would best evade Facebook's filters.

 He then made a script that would automate the process of logging in to a Facebook account, obtaining a list of all of the Friends of that account, and then posting his advertising message to each of those friends' walls.  Spamford then created a domain registrar account at Moniker Online and another at Dynadot (using the name Laura Frederix) and between the two created 2,500 domain names that would be used in these spamming attacks against Facebook users.

 On November 5 and 6, 2008, Sanford sent approximately 125,000 spam messages to Facebook users using this method.  On December 28, 2008, another run was made, posting nearly 300,000 spam messages, by logging in through 143 different IP addresses that were used as proxies to disguise his origins.  On February 17, 2009, another 125,000 messages were posted.

 At this point, a civil injunction was served on Sanford Wallace in the case of Facebook Inc v. Sanford Wallace (Northern District of California No 09-00798 JF) where Judge Jeremy Fogel ordered Sanford Wallace to no longer access Facebook's computer network.  (Orders issued on March 2, 2009 and March 24, 2009).  Sanford logged in on April 17, 2009, in violation of this order, while flying on a Virgin Airlines flight  from Las Vegas to New York.

 In 2011, Sanford was back on Facebook, using a profile called "David Sinful-Saturdays Fredericks"

 Counts 1,3, 7 - Fraud and Related Activity in Connection with Electronic Mail, carry a possibility of 3 years imprisonment.

 2, 6, and 9 - Intentional Damage to a Protected Computer, carries a maximum sentence of 10 years imprisonment.

 4, 5 and 8 - Fraud and Related Activity in Connection with Electronic Mail, carries a 3 year imprisonment possibility, and a possible $250,000 fine.

 Counts 10 and 11  - Criminal Contempt, have unspecified potential penalties.

 What's Happened Since?

Lots and lots of lawyering. . . behold the process of a Fair and Speedy Trial!!!!

• 04AUG2011 - the indictment was unsealed
• 04AUG2011 - notice of related cases was received.  These included:

1. the case of Facebook v. Sanford Wallace, Adam Arzoomanian, Scott Shaw, and John Does 1 through 25, for Violation of the CAN-SPAM ACT, violation of the Computer Fraud and Abuse Act, Violation of the California Business Code Section 229489 AKA the California Anti-Phishing Act, and Violation of California Penal Code section 502, the California Comprehensive Data Access and Fraud Act.  That case describes:  "At least one of the Defendants, Sanford (aka "Spamford") Wallace, is a notorious Internet scam artist who has been involved in various illegal spamming and malware activities since the mid 90s.  Indeed, Mr. Wallace has both Federal Trade Commission and civil judgements against him for these activities that total in excell of $235 million."  Myspace, Inc. v. Wallace; FTC v. Seismic Entertainment Prod., Inc; CompuServe v. CyberPromotions, Inc (Ohio, 1997)
2. This case resulted in a Default Judgement in favor of Facebook signed by Judge Jeremy Fogel on 29OCT2009. 

• 22AUG2011 - bail hearing
• 28SEP2011 - case reassigned to a new Judge (Judge D. Lowell Jensen)
• 30SEP2011 - Order to Waive Appearance proposed )amd gramted_
• 03OCT2011 - Status hearing held
• 04OCT2011 - case reassigned to Judge Edward J. Davila
• 31OCT2011 - Pretrial services form 8 submitted.
• 28NOV2011 - Status hearing held
• 09JAN2012 - "Fair and Speedy Trial Act" exemption requested due to AUSA Attorney being engaged in another trial, and for additional time for the defendant's need for effective preparation of counsel. "The ends of justice served by granting the requested continuance outweight the best interest of the public and the defendant in a speedy trial." - extension granted until 09APR2012.
• 02APR2012 - extended to 07MAY2012 by mutual consent.
• and again to 06AUG2012, and again to 01OCT2012, and again to 19NOV2012
• Status hearings held 14JAN2013, 11MAR2013
• 11MAR2013 - hearing grants a modification to pretrial release conditions to allow Spamford to travel to Albuquerque, New Mexico for work.
•  More delays 31MAY2013, 08AUG2013, 20SEP2013, in each case ordering that time be "excluded" from consideration in the Fair and Speedy Trial Act to allow for effective preparation for the case.
• 02NOV2013 - Sanford's attorney (K.C. Maxwell) files a sealed document asking to be relieved from the case 09DEC2013.
• Extension granted to 03FEB2014
• 17MAR2014 set as the date to hear the Motion to Withdraw as Counsel.
• Continued to 31MAR2014, when Wallace assigns his new counsel, William W. Burns, Esquire.
• 25JUN2014 new counsel asks for more time to prepare
• 18JUL2014 William Burns petitions the court to withdraw as counsel
• 21JUL2014 Burns Relieved
• 21JUL2014 a Financial affidavit is delivered to the court pertaining to Spamford Wallace
• 01AUG2014 - "The individual named above as defendant, having testified under oaht or having otherwise satisfied this court that he or she (1) is financially unable to employ counsel and (2) does not wish to waive counsel, and because the interests of justice so require, the Court finds that the defendant is indigent, therefore, IT IS ORDERED that the attorney whose name, address and telephone number are listed below is appointed to represent the above defendant." (Wm. Michael Whelan, Jr. / 95 South Market St, Ste 300 / San Jose, CA 95113 / (650) 319-5554 cell)
• 19AUG2014 - time extended to allow Whelan to prepare
• 22SEP2014 Status conference held, Jury Trial date set for 05MAY2015 through 22MAY2015.
• 29SEP2014 Whelan petitions the court that drug testing no longer be required since Sanford has never tested positive. (Granted 15OCT2014)
• 02MAR2015, status hearing extends case until an 08JUN2015 status hearing
• 12JUN2015 - new financial affidavit entered under seal
• 30JUN2015 - a change of plea hearing is requested for 27JUL2015
• 24AUG2015 - Sanford Wallace pleas guilty to a single count - Count 3.  Sentencing scheduled for 07DEC2015 at 1:30 PM

 Guilty of Count Three

So, if we go back to the indictment, what does this mean that Sanford has plead guilty to?

 

---

 COUNT THREE: (18 U.S.C.  §§1037(a)(1) and (b)(2)(A) - Fraud and Related Activity in Connection with Electronic Mail.

 22. The factual allegations contained in Paragraphs One through Eleven above are realleged and incorporated herein as if set forth in full.

 23.  On or about December 28, 2008, in the Northern of California and elsewhere, the defendant, SANFORD WALLACE, knowingly accessed a protected computer without authorization, and intentionally initiated the transmission of multiple commercial electronic mail messages from or through such computer, in and affecting interstate and foreign commerce, to wit: the defendant accessed Facebook's computer network in order to initate the transmission of program that resulted in nearly 300,000 spam messages being sent to Facebook users.

 What were 1 through 11?  The only really important paragraph is number 5:

 5. From approximately November 2008 through March 2009, WALLACE developed and executed a scheme to send spam messages to Facebook users that compromised approximately 500,000 legitimate Facebook accounts, and resulted in over 27 million spam messages being sent through Facebook's servers.)

 

---

Post by Gary Warner, originally appeared on his Cybercrime & Doing Time Blog