Spam

FCC to Classify Text Messaging as Information Service to Fight Spam Texts, Others Oppose the Move

The FCC has unveiled two proposals as part of its plan to help reduce unwanted phone and text spam however the move is challenged by consumer advocacy groups. more

Zango Verdict is Good News for Spam Filters and Blacklists

Zango, a company that used to be called 180 solutions, has a long history of making and distributing spyware. (See the Wikipedia article for their sordid history.) Not surprisingly, anti-spyware vendors routinely list Zango's software as what's tactfully called "potentially unwanted". Zango has tried to sue their way out of the doghouse by filing suit against anti-spyware vendors. In a widely reported decision last week, Seattle judge John Coghenour crisply rejected Zango's case, finding that federal law gives Kaspersky complete immunity against Zango's complaint... more

Canada’s Anti-Spam Law Coming Into Force July 01, 2014

Canada's Anti-Spam Law, CASL, is now a done deal. Last Thursday, Treasury Board of Canada President (and champion of CASL) Tony Clement approved Industry Canada regulations in their final form. Today, Minister of Industry the Honourable James Moore announced CASL will come into force in July 1, 2014. more

Spam Fighters: Revenge is a Dish Best Left in the Freezer and Forgotten

There's no denying that the fight against spam attracts a lot of crazies, both pro- and anti-spam. One of the common attributes of the anti-spam kooks is that they often think in terms of somehow taking revenge against the spammers -- regardless of who else gets hurt along the way. In 2005, that revenge came in the form of BlueFrog, a service which purported to launch what can only be called denial of service attacks against spammers' web sites... This week, a company called SpamZa was hurriedly making a similar mistake... more

2014 M3AAWG Mary Litynski Award Nominations Now Being Accepted

In 2010 the Messaging, Malware and Mobile Anti-Abuse Working Group (M³AAWG) and the Internet industry as a whole lost a great friend and supporter, Mary Litynski. Her dedication, excellence, perseverance and tireless work behind the scenes of M³AAWG helped make the organization the success that it is today. Through this award, M³AAWG seeks to bring attention to the remarkable work that is done far from the public eye over a significant period of time... more

Google as a Real-time Blackhole List

For those not familiar with RBL, the term means Real-time Blackhole List, it is mainly used for SPAM fighting. I have recently started playing around with Google as an RBL engine, the idea is that if the search term I use hits too many hits it is likely to be SPAM. The danger of course is that the term could be simply popular -- but the trick here is that I'm using something very special as the search term -- the IP address of the poster. more

The Death of IP Based Reputation

Back in the dark ages of email delivery the only thing that really mattered to get your email into the inbox was having a good IP reputation. If your IP sent good mail most of the time, then that mail got into the inbox and all was well with the world. All that mattered was that good IP reputation. Even better for the people who wanted to game the system and get their spam into the inbox, there were many ways to get around IP reputation. more

How a Plaintiff Was Undeceived and Lost at Spam Litigation - What Nobody Told You About!

Back in 2003, there was a race to pass spam legislation. California was on the verge of passing legislation that marketers disdained. Thus marketers pressed for federal spam legislation which would preempt state spam legislation. The Can Spam Act of 2003 did just that... mostly. "Mostly" is where litigation lives. According to the Can Spam Act preemption-exception... more

Craigslist Gets a $40 Million CAN-SPAM Judgment

Classified ad site craigslist is famously protective of its contents. While they are happy for search engines like Google to index the listings, they really, really do not like third parties to scrape and republish their content in other forms. In 2013 craigslist sued a company called 3taps which had created an API for craigslist data. They also sued real estate site Padmapper, which showed craigslist and other apartment listings on a map, something craigslist didn't do at the time. more

Circumstantial Evidence of Yahoo’s CAPTCHA Being Broken

A couple of weeks ago, I read an article on Yahoo that some outfit in Russia claimed to have broken Yahoo's CAPTCHA for creation of new email accounts. Another blogger wrote that it was unlikely that the spamming outfit had achieved 100% success at breaking the CAPTCHA. Yet, in the past couple of weeks, I have noticed something that would seem to confirm the theory... more

The Root of All Email

This week, the Internet Engineering Task Force (IETF) published a number of what they call "RFCs," which originally meant "Requests for Comment" - the standards documents which specify the technical underpinnings of the Internet. Two of these, numbered 5321> and 5322, replace earlier documents defining the very core of internet email. On the surface, each of these seem surprisingly simple... Yet without general industry-wide acceptance of (and compliance with) these standards, internet email simply would not exist. more

Spam Continues to Drop

The chart in this post shows the amount of inbound mail that we see, both spam and non-spam, over the past three and a half years. You can see in the above that the amount of good mail that we see has continued to increase over time. This is because of an increased customer base, not because the total amount of good mail worldwide has gone up... However, the amount of spam has plummeted from 23,000 in mid 2010 to 5000 now, a drop of over 75%. The contrast couldn't be starker -- spammers are not spamming as much anymore. It almost looks like the battle against spam is almost over. What's still left to do? more

Officially Compromised Privacy

The essence of information privacy is control over disclosure. Whoever is responsible for the information is supposed to be able to decide who sees it. If a society values privacy, it needs to ensure that there are reasonable protections possible against disclosure to those not authorized by the information's owner. In the online world, an essential technical component for this assurance is encryption. If the encryption that is deployed permits disclosure to those who were not authorized by the information's owner, there should be serious concern about the degree of privacy that is meaningfully possible. more

Fine Grained Mail Filtering With IPv6

One of the hottest topics in the email biz these days (insofar as any topic is hot) is how we will deal with mail on IPv6 networks. On existing IPv4 networks, one of the most effective anti-spam techniques is DNSBLs, blackists (or blocklists) that list IP addresses that send only or mostly spam, or whose owners have stated that they shouldn't be sending mail at all. DNSBLs are among the cheapest of anti-spam techniques since they can be applied to incoming mail connections without having to receive or filter spam. more

Web Server Botnets and Server Farms as Attack Platforms

Are file inclusion vulnerabilitiess equivalent to remote code execution? Are servers (both Linux and Windows) now the lower hanging fruit rather than desktop systems? In the February edition of the Virus Bulletin magazine, we (Kfir Damari, Noam Rathaus and Gadi Evron (me) of Beyond Security) wrote an article on cross platform web server malware and their massive use as botnets, spam bots and generally as attack platforms. Web security papers deal mostly with secure coding and application security. In this paper we describe how these are taken to the next level with live attacks and operational problems service providers deal with daily. more