Spam

Interoperability Testing Event for DMARC Email Anti-Spoofing Specification

At the end of January, the DMARC (Domain-based Message Authentication, Reporting & Conformance) specification was publicly announced and resulted in widespread media coverage, blog posts and discussion. Since that time various individuals and organizations have been working on writing code for DMARC validators and report parsers. The dmarc-discuss list has been fairly active as various questions and issues have been raised and clarified. Now it is time to see how well the various implementations play together in live testing. more

Spammers’ Aid Program

A couple of months ago, Microsoft Sweden launched a program called Spammers' Aid. This is a program (created and provided by Microsoft?) that is designed to help spammers reform their ways. The idea is that since spam is continually decreasing in email and spammers are finding it more and more difficult to get their mail delivered into the inbox, why not use the skills they acquired while spamming (sales and marketing, tech skills) and apply it for good? This program teaches them how. more

Good Study by UCSD on Economic Realities of Spam and Profit Motives

I recently had a chance to read a report titled, "Show Me the Money: Characterizing Spam-advertised Revenue" produced as a joint effort from the University of California, San Diego (UCSD), International Computer Science Institute, and UC Berkeley by Chris Kanich, Nicholas Weaver, Damon McCoy, Tristan Halvorson, Christian Kreibich, Kirill Levchenko, Vern Paxson, Geoffrey M. Voelker and Stefan Savage. I also had a chance to hear Chris Kanich speak about the topic - Show Me The Money! This post contains my notes with some photos taken from that report. more

IBM Predicts the Future for 2016 and It Includes No Spam

IBM published a video where it predicts what the world will look like in 2016 (see bottom of this post for the link). It includes the following five predictions. I want to start with the last one -- that junk mail (i.e., spam) will disappear. You'll need to watch the video to get the nuances of the prediction, but IBM says that in five years, Junk Mail will become a thing of the past. more

Censorship, Email and Politics

Spamfiltering blocks email. This is something we all know and understand. For most people, that is everyone who doesn't manage an email server or work in the delivery field or create spamfilters, filtering is a totally unseen process. The only time the average person notices filters is when they break. The breakage could be blocking mail they shouldn't, or not blocking mail they should. more

Hot Legal Action in Canada!

The best part is ... this isn't one of those 'now that I've got your attention' tricks, like one of those old "free beer" posters; there really is a ton of stuff happening above the 49th parallel this summer. To begin with, as a precursor to Canada's Anti-spam Law coming into effect later this year, the Office of the Privacy Commissioner, the Canadian Radio-television Telecommunications Commission, and Industry Canada have all issued regulations, the latter two in draft form with an RFC. more

The ENISA Botnet Report: Thoughts on the State of Play in Smart Phones

At the ENISA presentation on her botnet report at eco in Cologne, 9 and 10 March, one of the slots was dedicated to threats to the mobile environment. The message I was supposed to come home with was: we can still count the numbers of mobile viruses manually, <600; the problem will never be the same as on a fixed network as traffic is monitored and metered: We detect it straight away. We are studying the problem seriously. Are mobile operators really prepared for what is coming? more

What Next for Email Service Providers?

It's been a very bad month for ESPs, companies that handle bulk mailings for their clients. Several of them have had internal security breaches, leaking client information, client mailing lists, or both. Many have also seen clients compromised, with the compromised credentials used to send spam. The sequence of events suggests all the ESPs whose clients were compromised were themselves compromised first. (That's how the crooks knew who to attack.) more

Why the Fukushima Analogy Was Apt

A few days ago, CAUCE published a blog post entitled "Epsilon Interactive breach the Fukushima of the Email Industry" on our site, and the always-excellent CircleID. A small coterie of commenters was upset by the hyperbolic nature of the headline. Fair enough, an analogy usually has a high degree of probability that it will fail, and clearly, no one has died as a result of the release of what appears to be tens of millions of people's names and email addresses. But, the two situations are analogous in many other ways, and here's why. more

Epsilon Interactive Breach the Fukushima of the Email Industry

A series of attacks on the Email Service Provider (ESP) community began in late 2009. The criminals spear-phish their way into these companies that provide out-sourced mailing infrastructure to their clients, who are companies of all types and sizes. ... On March 30, the Epsilon Interactive division of Alliance Data Marketing (ADS on NASDAQ) suffered a massive breach that upped the ante, substantially. Email lists of at least eight financial institutions were stolen. more

Blacklist Operations and Practices: Excerpts from an ASRG Draft

The Anti-Spam Research Group (ASRG) published a draft for an Overview of Email DNSBL Best Practices. We can take a step back and review paragraph 2.2.5 (Conflict of Interest)... Some DNSBLs used for blocking/negative reputation have had a practice of requiring fees or donations to charities from the listee for delisting. It is generally considered entirely appropriate for a DNSBL to charge for access to it by its users -- the definition of a commercial DNSBL. more

Where Every Phisher Knows Your Name

Spear phishing is the unholy love child of email spam and social engineering. It refers to when a message is specifically crafted, using either public or previously stolen information, to fool the recipient into believing that it's legitimate. This personalization is usually fairly general, like mentioning the recipient's employer (easily gleaned from their domain name.) Sometimes they address you by name. Much scarier is when they use more deeply personal information stolen from one of your contacts... more

Best Practices: A Meaningless Term

Chad White wrote an article for MediaPost about best practices which parallels a lot of thinking I've been doing about how the email marketing industry treats best practices. After several conversations recently about "best practices," I'm convinced that the term is now meaningless. It's been bastardized in the same way that the definition of "spam" has shifted to the point that it has very different meanings to different groups of people. more

Out of Office Alerts are So Out of Here

Do Out of Office alerts these days serve a purpose anymore? They seem to work well a decade ago when you were really out of the office and your computer sat under your desk and you couldn't check email till you got to it. Today, we as an industry and as individuals now have laptops, iPads, Smartphones, Wifi, WiMAX, etc. keeping us 100% of the time on the Internet at one time or another. And you know we all at one point throughout our days whether or not on vacation or after 5 PM check email as part of our everyday lives. more

Judge Kocoras Cuts Down $11MM Award Against Spamhaus to $27,000 - e360 v. Spamhaus

e360 v. Spamhaus is one of these cases that's been around so long it feels like an old friend. A few years ago, e360 got some press for winning an eleven million dollar damage award against Spamhaus. In a less heralded development, following a bench trial on damages, last week a district judge modified e360's damage award down to only $27,000 on its tortious interference and defamation claims. more