Geek News: Latest Technology, Product Reviews, Gadgets and Tech Podcast News for Geeks


YouTube Acknowledges Spammy Comments

Posted by JenThorpe at 9:56 PM on November 28, 2013

YouTube logoHave you noticed an increase in the amount of spammy comments on your YouTube page in the past few weeks? You aren’t alone. YouTube has acknowledged on its Creator Blog that they have received a lot of feedback from creators about the increase in comment spam.

The increase in spammy comments began after YouTube decided to make new YouTube comments powered by Google +. The idea was that this would allow the content creators on YouTube to more easily see the comments from the people that mattered to them (like their friends, for example). Instead, something unexpected happened. The YouTube Creators Blog notes:

While the new system dealt with many spam issues that had plagued YouTube comments in the past, it also introduced new opportunities for abuse and shortly after the launch, we saw some users taking advantage of them.

To combat this problem with spam comments, YouTube is going to do some updates. The updates will include better recognition of bad links and impersonation attempts, improved ASCII art detection, and a change to how long comments are displayed. They are working on improving comment ranking and moderation of old-style comments. YouTube is also going to release tools that will allow creators to do bulk moderation soon.

Twitter banning Bit.ly, other URL Shortners on Direct Messages (DM)

Posted by J Powers at 9:36 AM on October 21, 2013

Twitter logoToday I was trying to send a direct message to a friend. Included was a bit.ly link to a page I needed him to see. For some reason, Twitter kept saying there was an error and cannot send the DM. After checking his page to make sure he was still following me and sending a couple test DMs successfully, I realized the problem was the bit.ly link.

I did a search and found that indeed – Twitter was blocking DMs with bit.ly links. They found many different links could not be sent via DMs. CBS.com was one of those who were blocked by Twitter DMs.

Of course, this is because of Twitter allowing n0n-followers to DM people. You have to opt-in to the option, but with this you can get messages from many different people.

The Twitter error Message Needs to Be Fixed

So direct messaging with a link could come back saying the person might not be following you. That could be totally confusing – especially if you know they are. I almost chalked it up as a twitter database error but decided to check and see if there was any changes.

The only advantage of allowing non-followers to DM is if your Twitter account is a corporate one or you have over 10,000 followers and don’t want to follow them all back.

The Problem with Blocking Bit.ly – the Mask-Around

Spammers are smart and/or intuitive. Instead of using bit.ly, they’ll use another system that gets around the twitter issue. Twitter might then block that, but in the meantime, you don’t see a bit.ly link – you see a My.website link. Give a spammer/hacker 2-3 days with an $8 /year website domain and they could make enough to buy another $8 domain and start the process over again.

Of course this is a very common problem with url shorteners. Tiny URL added spam block and virus protect tools shortly after they started. Bit.ly also has some preventative measures (using companies like Sophos, Verisign, Websense and more). Still, they are not responsible for 3rd party content using their links.

Bottom Line – Don’t click on unknown links

Usually bad links start with “Hey, is this you” or “I got a way you can make money” which really translates to “I got a way for ME to make money using you”. If you choose to opt-in to letting anyone DM you, keep in mind you will get spam in your message box. If you don’t feel confident you can sniff out the good from bad, then simply don’t check the box.

Text Spam DrivingYou Crazy?

Posted by susabelle at 7:49 PM on March 24, 2012

Being a new owner of a smart phone, I had never heard of text spam.  After all, my phone number is on the federal and my state’s no-call lists, so why would I ever think I’d get spam in the form of SMS/text messages?

Well, I do get them, at least one a day.  After a couple weeks of this, I started to get aggravated.  I knew I didn’t want to just text “stop” in return.  That’s like trying to unsubscribe to email spam; all it does is bring on more spam.

Well, it turns out I can have my carrier (who happens to be ATT) do some of the work for me in cutting down on SMS/Text spam.  I can forward my spammy texts to 7726 (that spells SPAM).  When I do so, I usually get a text back from ATT asking me for the phone number from which the spam came. I text that number back, then get a thank you text from my carrier.

What happens after that is not completely clear, but I think the more people use this service, the more likely it will be that wireless carriers will be able to take action against spammers.  Time will tell if I’ll get less spam via text message, but I’m hopeful.

Time for Yahoo to Close Groups?

Posted by J Powers at 11:16 AM on August 22, 2011

It’s another Monday and seems to be another day of inbox Spam. However, I’ve noticed recently how more and more spam groups are being created on Yahoo! and joining me. They basically say the same thing:

I’ve added you to my akljsdfklj group. a free Yahoo! Group to send and receive group messages.

Description: asdflkhasdf

To gain access, click the link…

This is another reason that Yahoo! just doesn’t care about their product. I use Google Groups all the time and don’t get any spam messages like this. Yet, every week I am removing stupid posts like in the image.

Where is the confirmation? I really have to click on a link and tell them this group is spam? Why not have some protocols in place to avoid me getting annoyed like this?

Here are some ideas that anyone running a group website could implement:

1. Multiple fields on form

Make them fill out more information than your name and small description. Make them enter in some contact information. Require a description field to be 20 words or more (not just characters). Have an algorithm determine if the description is jibberish or actually says something.

2. CAPTCHA

It’s annoying, but in a way, it’s meant to be annoying. That way, you know someone is human. Yahoo! does have some CAPTCHA algorithms that they could use in this group. It also kills the bots attempts to register groups.

3. Confirmation

Email confirmation means they have to register an email address first. That might also stop some bots from creating groups.

These are not revolutionary ideas. They have been used before and can be used again. The more we can stop spammers and bots, the less phishing scams and malware can be created. When that happens, people and companies save millions of dollars.

So Yahoo! – If you’re just going to let it continue, then why not shut down YahooGroups and get out of the business. It’s what you’re doing anyway…

Malware Myths

Posted by Andrew at 12:35 AM on August 3, 2011

GData has found that many people’s preconceptions about malware are wrong and are putting them at risk of malware infection. The vectors for viruses and trojans have significantly changed in the past couple of years and infections now mainly come from websites rather than emails and USB sticks. The growth of malware in the past five years has been phenomenal and since 2005, over 2 million malware threats have been identified.

GData surveyed nearly 16,000 web users in 11 countries regarding their views on internet threats. People are generally more knowledgeable now, with only 4% admitting to having no antivirus software on their computer, although 5% didn’t know. 48% of those questioned have free AV software and 41% have paid software. The survey is not entirely clear if it was Windows PCs only or any computer, including OS X and Linux.

GData identified 11 malware myths that can lead to a higher risk of infection. Here they are.

Myth 1: When my PC is infected, I will notice in one way or another (93%)
No, modern malware writers are smart and code their viruses and trojans to make sure that they work stealthily and unnoticed in the background.

Myth 2: Free AV software offers the same elements of security as paid for packages (83%)
Anyone who has bothered to compare the feature sets of free v. paid versions of security software from nearly any company will know that this isn’t true. Usually the free ones are missing features such as firewalls or anti-spam filters.

Myth 3: Most malware is spread through e-mail (54%)
As mail spam and antivirus filters have got better, malware in attachments has become rarer as it has become less effective. Consequently most spam / malware emails now only come with links to infected websites rather than payloads.

Myth 4: You can’t get infected just by loading an infected website (48%)
Sadly not true. Websites loaded with malware that take advantage of vulnerabilities in the browser and operating system can infect a PC even when the user is “just looking”.

Myth 5: Most malware is spread through downloads at peer2peer and torrent sites (48%)
Undoubtedly some malware is passed on via peer-to-peer but today websites are the prime source of infection.

Myth 6: It is more likely to encounter malware at a porn site that at a horseback riding site (37%)
Much as we might like this myth to be true, serious adult sites are professional and run to a high standard. The web site is key to their business and they make sure the sites are secured and up-to-date with patches. On the other hand, hobby websites are run by enthusiasts who are rarely IT experts and these websites are easily compromised by criminals who then upload malicious code to the site which subsequently infects visitors.

Myth 7: My firewall can protect my PC from drive-by-download attacks (26%)
Sadly, not true. Firewalls are a useful security component but because much malware is web-based and web traffic is generally allowed (because you couldn’t access websites if you didn’t), firewalls provide only limited protection against them.

Myth 8: I don’t visit risky sites, so I am safe from drive-by-downloads (13%)
This is much the same as Myth 6, but the point to take is that your trust in the website brand does not have a direct correlation to the likelihood of being infected. In the recent past, a couple of high-profile trusted sites have become vectors for malware without the owner’s knowledge.

Myth 9: If you don’t open an infected file, you can’t get infected (22%)
The emphasis in this myth is on the “you”. In a perfect world this might be true, but modern PCs and operating systems are so complex and do so much in the background that it’s possible for a malicious file to infect a PC regardless of what the user actually does.

Myth 10: Most malware is spread through USB sticks (13%)
In the past a large proportion of viruses and trojans would have been passed on using USB memory sticks and while they can still be a vector (Conficker!), now more malware is spread by websites.

Myth 11: Cyber criminals aren’t interested in the PC’s of consumers (8%)
As most people recognised, consumer PCs are definitely of interest to consumers, either to form part of a botnet or else to monitor for passwords for on-line services.

There is a natural assumption amongst Internet users that pornography sites are more dangerous than other leisure sites. This is a myth. Amateur hobby/leisure sites are often not professionally run like many pornography sites, making them much easier prey for hackers,” says Eddy Willems, G Data Security Evangelist. “In the past, malware was written by developers who wanted to show off their technical skills, meaning it was visible to infected users. Now cyber criminals design, sell and make use of malware that enables them to take control of PCs’ computing powers in such a way that users do not notice the infection. This covert approach not only puts users’ data at risk, but also allows cyber criminals to send spam e-mails and malware, and participate in DDoS attacks. Internet users must correct their misconceptions in order to stay safe online.

You can download the full report (.pdf) if you want more information on the survey itself and the myths.

So stay sharp out there. The bad guys are out to get you.

Phantom AOL eMail

Posted by susabelle at 7:34 AM on June 14, 2011

I’m still getting mail from dead people.  An AOL account belonging to a friend of mine who passed away almost three years ago has been hijacked and sends me at least one spammy email a day.  I tried to block her emails using my spam blocker, but some still get through.  She had three or four AOL email addresses, and all of them send me spam email.

Now I’m getting spam email from a mechanic I used a few years ago.  The same type of spam email, and I’ve tried to call him, but he appears to be out of business.

But good old AOL, they aren’t out of business, and they never delete email addresses in their system, so I’m destined to get multiple emails a day from these defunct accounts.  And seriously, mail from the dead is just creepy!  AOL doesn’t seem to be responsive to requests to shut down these accounts (I’ve tried that) and they don’t even want to talk to you unless you have an AOL ID to sign on with.  There is no way I want to sign up for an AOL account just so I can complain about another AOL account.

Short of turning on blocking, spam filtering, etc., what is the solution?  How many of millions of AOL (or Yahoo, or Hotmail) email addresses are really defunct, but still sending out spam email because they’ve been hacked?  And why does it seem so hard for these emails to get turned off or deleted?  I sure wish I knew the answer.

Sophos Security Threat Report 2011

Posted by Andrew at 7:50 AM on January 19, 2011

Digital security firm Sophos today released their Security Threat Report for 2011, which reviews all the ways that the bad guys are out to get you. It’s a glossy 52 page report and is worth a quick read to understand the threats that are out there, especially in areas that you might not be familiar with.

The report covers the key threats from 2010:

  • Fake anti-virus software and scareware – through a warning dialog, users are scared into paying for and installing fake anti-virus software, which at best does nothing and at worst steals passwords and credit card information.
  • SEO poisoning – manipulating search engine results to point users to fake and rogue websites, which are loaded with browser exploits and malware.
  • Clickjacking or UI redressing – hiding malicious buttons underneath innocuous images, e.g. clicking on a “Like” or “Share” image actually emails out malware to all the users friends.
  • Survey scam – in order to complete a questionnaire that typically offers a non-existent but  sought-after prize, software has to be installed or access given to personal data. This information is then used to propagate the questionnaire onwards, earning affiliate revenue for the application developer.
  • Spam – not exactly a new entrant in 2010 but the rise of spam on social networking sites is an increasing problem.
  • Spearphishing – a variant on the original phishing but in this case the attack is well targetted and much more convincing and consequently more likely to succeed.
  • Stuxnet worm – a traditional vector but with a new target, the Stuxnet worm went after SCADA systems and industrial PLC controllers. Very sophisticated, leading to conspiracy theories involving industrial sabotage.
  • Malvertising – the infection of advertising on legitimate websites that links to malware or fake anti-virus software.
  • Compromised sites and accounts – Legitimate websites and typically celebrate accounts are hacked to serve infected webpages or link to malware sites.

The report briefly covers the threats posed to iOS, Android, Windows 7 and Blackberry smartphones before moving onto to review issues with Facebook, Adobe products, removeable media and USB drives. Windows 7 and OS X are also discussed.

The report continues with some of the success stories when the justice system has managed to catch up with the criminals before closing with advice and guidance on how to avoid getting hit.

Give it a read. Warning – 4MB .pdf download.

US Relays Most Spam

Posted by Andrew at 3:14 PM on May 3, 2010

The USA is the worst country in the world for relaying spam, according to Sophos’ latest report on spam.  The US was responsible for 13.1%, followed by Brazil and India at 7.3% and 6.8% respectively, with the UK, Russia and Italy tied in 7th place.  In a further twist, China has completely disappeared from the top 12 and now relays only about 1.9%.

The full hall of shame is below.

1. USA 13.1%
2. India 7.3%
3. Brazil 6.8%
4. S Korea 4.8%
5. Vietnam 3.4%
6. Germany 3.2%
7=. United Kingdom 3.1%
7=. Russia 3.1%
7=. Italy 3.1%
10. France 3.0%
11. Romania 2.5%
12. Poland 2.4%
Others 47.3%

Given the amount of attention that China receives as the “Country of Cybercrime”, the table shows that US and Europe ought to be looking a bit closer to home when it comes to spam.

Sophos estimates that 97% of email received to business servers is actually spam and only 3% is legitimate email.  Frankly that’s a both scary and a disgrace.  The level of resources needed to cope and the subsequent cost incurred by business shows that spam ought to be much higher up on the agenda of our lawmakers.

Perhaps they could take a break from the usual “digital rights” arguments and do something that would help everyone. That would get my vote.

Please Teach Aunt Martha What SPAM is.

Posted by J Powers at 9:10 AM on March 25, 2010

So the numbers are getting better. According to the Messaging Anti-Abuse Working Group (MAAWG), 80% of Internet users are aware of the botnets and spam in email. They know that there is no national lottery or company that spells their product V1@gra. Still, 20 percent of users are still taking SPAM seriously. That is seriously a bad number and it shows, because the report says we continue to select the spam.

Think about it – There are 305 million in the United States alone. That means sixty-one million people will respond to SPAM. Sixty-one million will be at risk of loosing thousands of dollars and possibly their credit line. Sixty-one million might get malware on their machine, which might enter your machine. Now apply that 20% to the 6.6 Billion from around the world. That means you can market a SPAM campain to 1.2 billion viewers and expect about 120 million to respond (using the 1:100 ratio).

We, as responsible IT reporters, talk about awareness to SPAM. But now I think it’s time for us to start pleading that you need to change your stance from an advocate, to a teacher. Turn your efforts into educating your parents, grandparents, friends, cousins and other people what SPAM, botnets and Malware really is and how to avoid it.

If we became a world with a 95% awareness to SPAM, we might just fight the ongoing problem. I just recorded a segment on my Podcast (Day in Tech History) for March 30th. I talked about how SPAM had creeped back up to where it was just before the MoColo server was taken down. That was noted on March 30th, 2009; 4 months after the server was raided.

Now, granted, 5% of non-aware people is still a big number. About 15 million in the US and 300 million worldwide. However, that number is more palatable than 61 million and 1.2 billion. I would like to believe in 5-10 years we could reach that number naturally. The only problem is that spammers are like everyone else – They learn from their drawbacks.

Sometimes I am impressed with some of the messages received. My curiosity sets in, so I want to take that message a little further. However, I do that in a controlled environment. Never on the production machine, where my email addresses could be mined. Never to a link that looks like it’s this:

ww.whatever.com?user=your@email.address&SSN=333333333&otherdata=whatever_we_can_think_of

(in those cases, I will remove the extra data). Never a short-link in the email (example: bit.ly/Tbd87jh) If I go to a page with any type of login – especially one that looks like a popular website such as Facebook or Twitter – I stop.

Curiosity may get my cat, but it shouldn’t get yours. That is, unless you take the same amount of precautions. Of course I also do it to make sure I can explain what you need to look out for.

Spam, botnets and Malware can be big business for those who utilize it. They prey on those who don’t know better. They make new tricks to take your hard earned money. The only way to really turn the tables now is to sit down with the kids like you are going to tell them the birds and bees, but in this case, it’s a discussion on how SPAM is bad.

Don’t forget to also sit down with Mom and Dad and have that same discussion.

Wear Your Email Safety Helmet

Posted by GNC at 7:15 AM on October 6, 2009

Whenever I want to feel fearful and depressed I usually visit one of the news websites. Earthquakes, murder, war, theft, snoops, kidnappers, recession, depression, corruption, and all other sorts of horrible news. When I read the news sites I’m reminded of how unsafe the world is. Soon I tire of the bad news and move on to investigate the net for news on tech and design. Today Foxnews.com had the audacity to remind me that I am unsafe even on the web. The site highlighted the news from Microsoft that thousands of Hotmail passwords had been exposed. It scared me to death. I nearly jumped to my Hotmail account before I even finished the article. Reading on I discovered that Microsoft had deactivated all the affected accounts until true control could be restored. Why do I care? Hotmail only collects my spam from sites that demand an email address. Hotmail lets through all the other spam anyway! But I digress.

email icon The point of all this is: we are never safe. Their is no safe haven in the world or the web.  Every company does it’s best and so must we.  Yet, sometimes problems may come. If we live with that understanding we can truly do our best to protect ourselves. When we react in panic there is not a clear path of thinking. So with this reminder of our web-identities fragility, what should we do? Let’s refresh four basic email and online account rules:

  1. Always use a secure password. Your birthday, name spelled backwards, address, mothers name, dog’s name, middle name, favorite food, and initials hardly qualify. Use one of the many free random password generators on the web or if you insist on an easier to remember one then create a mixture of information that you can remember. For example and purely fictitious: !S1eP99t9 This could be a combination of the month and year you and your spouse were married. Now while I would only call this a basic password it sure beats “Fluffy”. Of course if you want your bank account to be protected by Fluffy, then more power to you.
  2. Never use the same passwords for multiple accounts. For that matter don’t do what I did at the start and use the same password with just the last letter different! Why would you want someone to have a free-for-all with all your accounts? Use different passwords and find an open-source or free password vault. I personally love 1Password for the Mac.
  3. Change your passwords periodically. I must admit it takes the misfortune of someone to remind me to do this.
  4. Don’t use a public computer. Many public computers are not adequately protected against the installation of malicious password key logging applications. Just don’t log in on a public computer. Just say no. And certainly don’t buy something online with your credit card information! Browse the web on it, read the news, just don’t give any information.

I understand these are basic tips, but sometimes we just need to be reminded to stay alert and on guard.  Kind of like reminding our kids to wear their helmet when they ride a bike.  Resist the urge to become lazy online. I don’t want to read about you on Foxnews.com.