Category Archives: spam

Sophos Security Threat Report 2011

Information, malware, Security, spam, spyware, Virus, , , ,

Digital security firm Sophos today released their Security Threat Report for 2011, which reviews all the ways that the bad guys are out to get you. It’s a glossy 52 page report and is worth a quick read to understand the threats that are out there, especially in areas that you might not be familiar with.

The report covers the key threats from 2010:

  • Fake anti-virus software and scareware – through a warning dialog, users are scared into paying for and installing fake anti-virus software, which at best does nothing and at worst steals passwords and credit card information.
  • SEO poisoning – manipulating search engine results to point users to fake and rogue websites, which are loaded with browser exploits and malware.
  • Clickjacking or UI redressing – hiding malicious buttons underneath innocuous images, e.g. clicking on a “Like” or “Share” image actually emails out malware to all the users friends.
  • Survey scam – in order to complete a questionnaire that typically offers a non-existent but  sought-after prize, software has to be installed or access given to personal data. This information is then used to propagate the questionnaire onwards, earning affiliate revenue for the application developer.
  • Spam – not exactly a new entrant in 2010 but the rise of spam on social networking sites is an increasing problem.
  • Spearphishing – a variant on the original phishing but in this case the attack is well targetted and much more convincing and consequently more likely to succeed.
  • Stuxnet worm – a traditional vector but with a new target, the Stuxnet worm went after SCADA systems and industrial PLC controllers. Very sophisticated, leading to conspiracy theories involving industrial sabotage.
  • Malvertising – the infection of advertising on legitimate websites that links to malware or fake anti-virus software.
  • Compromised sites and accounts – Legitimate websites and typically celebrate accounts are hacked to serve infected webpages or link to malware sites.

The report briefly covers the threats posed to iOS, Android, Windows 7 and Blackberry smartphones before moving onto to review issues with Facebook, Adobe products, removeable media and USB drives. Windows 7 and OS X are also discussed.

The report continues with some of the success stories when the justice system has managed to catch up with the criminals before closing with advice and guidance on how to avoid getting hit.

Give it a read. Warning – 4MB .pdf download.

US Relays Most Spam

spam, , , , ,

The USA is the worst country in the world for relaying spam, according to Sophos’ latest report on spam.  The US was responsible for 13.1%, followed by Brazil and India at 7.3% and 6.8% respectively, with the UK, Russia and Italy tied in 7th place.  In a further twist, China has completely disappeared from the top 12 and now relays only about 1.9%.

The full hall of shame is below.

1. USA13.1%
2. India7.3%
3. Brazil6.8%
4. S Korea4.8%
5. Vietnam3.4%
6. Germany3.2%
7=. United Kingdom3.1%
7=. Russia3.1%
7=. Italy3.1%
10. France3.0%
11. Romania2.5%
12. Poland2.4%
Others47.3%

Given the amount of attention that China receives as the “Country of Cybercrime”, the table shows that US and Europe ought to be looking a bit closer to home when it comes to spam.

Sophos estimates that 97% of email received to business servers is actually spam and only 3% is legitimate email.  Frankly that’s a both scary and a disgrace.  The level of resources needed to cope and the subsequent cost incurred by business shows that spam ought to be much higher up on the agenda of our lawmakers.

Perhaps they could take a break from the usual “digital rights” arguments and do something that would help everyone. That would get my vote.

Please Teach Aunt Martha What SPAM is.

spam, , , ,

So the numbers are getting better. According to the Messaging Anti-Abuse Working Group (MAAWG), 80% of Internet users are aware of the botnets and spam in email. They know that there is no national lottery or company that spells their product V1@gra. Still, 20 percent of users are still taking SPAM seriously. That is seriously a bad number and it shows, because the report says we continue to select the spam.

Think about it – There are 305 million in the United States alone. That means sixty-one million people will respond to SPAM. Sixty-one million will be at risk of loosing thousands of dollars and possibly their credit line. Sixty-one million might get malware on their machine, which might enter your machine. Now apply that 20% to the 6.6 Billion from around the world. That means you can market a SPAM campain to 1.2 billion viewers and expect about 120 million to respond (using the 1:100 ratio).

We, as responsible IT reporters, talk about awareness to SPAM. But now I think it’s time for us to start pleading that you need to change your stance from an advocate, to a teacher. Turn your efforts into educating your parents, grandparents, friends, cousins and other people what SPAM, botnets and Malware really is and how to avoid it.

If we became a world with a 95% awareness to SPAM, we might just fight the ongoing problem. I just recorded a segment on my Podcast (Day in Tech History) for March 30th. I talked about how SPAM had creeped back up to where it was just before the MoColo server was taken down. That was noted on March 30th, 2009; 4 months after the server was raided.

Now, granted, 5% of non-aware people is still a big number. About 15 million in the US and 300 million worldwide. However, that number is more palatable than 61 million and 1.2 billion. I would like to believe in 5-10 years we could reach that number naturally. The only problem is that spammers are like everyone else – They learn from their drawbacks.

Sometimes I am impressed with some of the messages received. My curiosity sets in, so I want to take that message a little further. However, I do that in a controlled environment. Never on the production machine, where my email addresses could be mined. Never to a link that looks like it’s this:

ww.whatever.com?user=your@email.address&SSN=333333333&otherdata=whatever_we_can_think_of

(in those cases, I will remove the extra data). Never a short-link in the email (example: bit.ly/Tbd87jh) If I go to a page with any type of login – especially one that looks like a popular website such as Facebook or Twitter – I stop.

Curiosity may get my cat, but it shouldn’t get yours. That is, unless you take the same amount of precautions. Of course I also do it to make sure I can explain what you need to look out for.

Spam, botnets and Malware can be big business for those who utilize it. They prey on those who don’t know better. They make new tricks to take your hard earned money. The only way to really turn the tables now is to sit down with the kids like you are going to tell them the birds and bees, but in this case, it’s a discussion on how SPAM is bad.

Don’t forget to also sit down with Mom and Dad and have that same discussion.

Wear Your Email Safety Helmet

Information, Microsoft, spam, Virus, , , , ,

Whenever I want to feel fearful and depressed I usually visit one of the news websites. Earthquakes, murder, war, theft, snoops, kidnappers, recession, depression, corruption, and all other sorts of horrible news. When I read the news sites I’m reminded of how unsafe the world is. Soon I tire of the bad news and move on to investigate the net for news on tech and design. Today Foxnews.com had the audacity to remind me that I am unsafe even on the web. The site highlighted the news from Microsoft that thousands of Hotmail passwords had been exposed. It scared me to death. I nearly jumped to my Hotmail account before I even finished the article. Reading on I discovered that Microsoft had deactivated all the affected accounts until true control could be restored. Why do I care? Hotmail only collects my spam from sites that demand an email address. Hotmail lets through all the other spam anyway! But I digress.

email icon The point of all this is: we are never safe. Their is no safe haven in the world or the web.  Every company does it’s best and so must we.  Yet, sometimes problems may come. If we live with that understanding we can truly do our best to protect ourselves. When we react in panic there is not a clear path of thinking. So with this reminder of our web-identities fragility, what should we do? Let’s refresh four basic email and online account rules:

  1. Always use a secure password. Your birthday, name spelled backwards, address, mothers name, dog’s name, middle name, favorite food, and initials hardly qualify. Use one of the many free random password generators on the web or if you insist on an easier to remember one then create a mixture of information that you can remember. For example and purely fictitious: !S1eP99t9 This could be a combination of the month and year you and your spouse were married. Now while I would only call this a basic password it sure beats “Fluffy”. Of course if you want your bank account to be protected by Fluffy, then more power to you.
  2. Never use the same passwords for multiple accounts. For that matter don’t do what I did at the start and use the same password with just the last letter different! Why would you want someone to have a free-for-all with all your accounts? Use different passwords and find an open-source or free password vault. I personally love 1Password for the Mac.
  3. Change your passwords periodically. I must admit it takes the misfortune of someone to remind me to do this.
  4. Don’t use a public computer. Many public computers are not adequately protected against the installation of malicious password key logging applications. Just don’t log in on a public computer. Just say no. And certainly don’t buy something online with your credit card information! Browse the web on it, read the news, just don’t give any information.

I understand these are basic tips, but sometimes we just need to be reminded to stay alert and on guard.  Kind of like reminding our kids to wear their helmet when they ride a bike.  Resist the urge to become lazy online. I don’t want to read about you on Foxnews.com.

Do You Open Spam Email? If So, Why?

spam

According to a recent study by the Messaging Anti-Abuse Working Group, subtitled “Of course, I never reply to spam – except sometimes,” we are clicking on spam more often than may be assumed.  According to the survey, half of the respondents clicked and/or replied to spam messages for the following reasons:

  • Clicked on it by mistake: 17 percent
  • Not sure why they did it: 13 percent
  • Sent a note to complain about the spam: 13 percent
  • Interested in the product or service: 12 percent
  • Wanted to see what would happen: 6 percent

Further, the study states that 1 in 6 users actually responds to a spam message in some way, and up to half of those purchase a product or service offered in a spam email.

Doesn’t sound like a lot, but when you consider how many millions of spam emails go out every day (it is estimated that 85% of all email being sent is spam), that is a considerable number.  A spammer’s overhead is very very low; even a few sales will line a spammer’s pockets quite nicely.

I always wonder who it is who buys this stuff.  Besides – ahem – “male enhancement” products, I also see spam for hair growth, weight loss, and physical fitness products.  And there’s the millions of insurance offers, mortgage offers, and the Nigerian scams as well.  Is anyone really dumb enough to apply for a mortgage through an link in an unsolicited email message?

Obviously, someone is, or the spammers would have no reason to exist.  My husband is always looking at spam and clicking on things, “just for the fun of it,” he tells me.  I keep reminding him this is why I have to keep his computer so locked down, because at least 20% of those messages include links to either dangerous software, or to Internet sites that will infect your computer.  He seems unwilling to be trained, ergo, I’ve got him so throttled his computer can barely function.

I feel bad for those that don’t have a household techie that can take the sting out of spam-clicking.  Spammers are like drug dealers:  they would have no income if it weren’t for the fact that people were actually buying what they were selling!  When people stop responding to spam, the spam will go away.

Your first initial can earn you more spam

spam

I guess its my own fault for being called Matthew, but my email address (almost all of them) start with a letter that means I get more spam than those with other starting letters. Those letters are “A”, “M”, “S”, “R” and “P”. Email addresses that start with these letters on average have 40% of their incoming messages being spam.

The results of a study by the University of Cambridge and reported by the BBC looked at around 550 million emails going to a British ISP to determine what factors could attract spam and found the link to how the first letter of your address can affect your spam levels

The most popular letters for spammers were “A”, “M”, “S”, “R” and “P”. about 40% of all the messages arriving in the e-mail inboxes of accounts with addresses that had one of those characters as their first letter were junk. Much less popular were “Q”, “Z” and “Y”. For these cases, spam was running at about 20% or less.

Other factors were a bit more obvious, like having email addresses that are susceptible to dictionary attacks and having multiple addresses that are the same name at different domains. What annoys me about this study is that they were able to identify which messages where spam a lot better than my ISP. I might do well to change my name to Ziggy.

Spam King Follow-Up

spam

To follow up from Todd’s mention on the Podcast today, officials have found the Spam King: Edward Davidson, his wife and daughter in a murder-suicide. Apparently the Spam King and family were found 25 miles out of Denver in an SUV. All three were shot with indication that Edward pulled the trigger.

Here is where the story gets weird. There was a 7-8 month old boy that was also in the SUV and was unharmed. Also, Edward shot a Teenage girl who then ran for help. She was treated at the local hospital.

Davidson was serving 21 months in minimum security prison for sending email using hijacked computer networks.

It is a sad, tragic ending to this story. Nobody should take lives like that, whether it’s their own or somebody else’s. I am just speechless.