Spam your printer from the Web? Researcher shows how
4705
Aaron Weaver has made a discovery the world could probably do without: He&#39;s found a way to spam your printer from the Web.By using a little-known capability found in most Web browsers, Weaver can make a Web page launch a print job on just about any printer on a victim&#39;s network. The Web site could print annoying ads on the printer and theoretically issue more dangerous commands, like telling the printer to send a fax, format its hard drive, or download new firmware.Weaver, a security manager in the financial industry, based in Pottstown, Pennsylvania, described what he calls &quot;cross site printing&quot; in a research paper published Tuesday on the Ha.ckers.org Web site.For a cross-site printing attack to work, a victim would have to visit either a malicious Web site or a legitimate page that suffers from a cross-site scripting flaw, which is a common type of Web programming error. The hacker would then send JavaScript code to the browser that would guess the location of the victim&#39;s printer and send it a print job.Weaver has launched the attack successfully with both the Internet Explorer and Firefox browsers. Because the attack works only on network printers, a printer plugged directly into a PC would not be vulnerable.The attack is possible because most browsers can connect to the networking port used by most printers to look for new print jobs. So by using the browser as a stepping stone, attackers are able to connect with something they should never be able to reach: a printer on the local area network.While nobody had previously demonstrated this particular hack, Weaver&#39;s research is based on two concepts that are well-known to Web security researchers: cross-site scripting attacks and vulnerabilities in the way browsers handle the Internet Protocol. &quot;There is no precedent for [this hack],&quot; said Robert Hansen, CEO of Web security consultancy SecTheory and owner of the Ha.ckers.org Web site. &quot;But ... what he did was marry two different concepts that we&#39;ve been talking about for a long time.&quot;And if hackers figure out a way to make printers send out information about their print jobs to the Internet, Weaver&#39;s hack could have even more profound security implications, Hansen said.Researchers have already shown how the browser can be used as a gateway to reach mail or VoIP servers. They believe that the browser, with its ability to connect the Internet at large to the local area network, will be an increasingly important source of network attacks. &quot;There are definitely a lot more exploits to be found,&quot; Hansen said.Browser developers are already aware of the problem.The Firefox browser blocks ports known to be associated with known security vulnerabilities, but it leaves many of them open because Web developers often use these ports in Web testing, said Mike Schroepfer, Mozilla&#39;s vice president of engineering, via instant message. &quot;If this is a new problem, we can easily add 9100 to the blacklist,&quot; he said. &quot;Folks here haven&#39;t done enough analysis to understand the impact yet.&quot;Weaver said concerns that his research might unleash a new blight on the Internet caused him to hesitate before publishing his paper and hold off on publishing the complete exploit code.By Wednesday he&#39;d already received his first request from someone asking to look at his software -- someone saying he needed to show it to his manager in order to prove that it was a real issue. Weaver said he suspects the inquiry may have come from a spammer.So will we see cross-site printer spam flying around our networks anytime soon?Weaver believes there&#39;s a good chance of that happening. &quot;Spammers will try anything,&quot; he said.
400396
Researchers this week reported a spam run that tried to trick users into downloading a Trojan horse posing as a video of Sen. Hillary Rodham Clinton.
239180
User-generated Web content is becoming a target for hackers and cross-site scripting attacks on Web sites can lead to malware taking over the browsers of machines that use the sites.
319877
From disguising applets to look like part of Windows to co-opting security tools, Web crooks use a variety of methods to bypass your system's safeguards.
650596
Scammers still prefer old-world means, FTC study shows With Nigerian 419 scams, phishing attempts and other dubious spam flooding your inbox, you may be tempted to think the net is the epicenter for today's shysters. But it turns out print advertising beat out the internet as the most common means for spreading fraudulent pitches, according to a US consumer survey released Monday by the Federal Trade Commission.â¦
360683
By using a little-known capability found in most Web browsers, Web pages can launch a print job on just about any printer on a victim's network.
197345
I think I know how spammers are going to enter the Twitter world. It'll come in the form of replies, which basically function like email. You can direct a message with a url to anyone as long as you know their username. Here's a screen shot that illustrates spam being sent to a hypothetical user. I didn't send it of course.  Another problem, the destination of the url is likely masked through the use of a shortener so the user could be clicking through to some really nasty place, with no way of knowing in advance that's where they're going. (Such messages probably wouldn't alert you in advance that they're about meds or poker or sex.) The press and bloggers will run stories saying "Spam Comes to Twitter" and they'll be right, even though it won't be the main part of Twitter. Users will expect the company to do something about it, but I don't see what they can do other than eliminate the feature. Users will certainly want the ability to completely opt-out of replies.
511947
often via spam-style blastings that plague mailboxes worldwide -- is fake, a British researcher said Tuesday. Dr. Nic Wilson of the School of Pharmacy
681097
(InfoWorld) - Spammers have found a way to mine free Web-hosting services for cash. Online scammers have long used free hosting services such as Yahoo Geocities or Tripod as a way to get around e-mail filters that might otherwise recognize their spammy Web sites. But now some enterprising spammers have begun selling each other these free Web pages, according to security vendor McAfee Inc. For US$25 per week a spammer will sell 50 Web-hosting accounts that can be used to redirect Web traffic to sites that normally would be flagged. "These 'link providers' create and maintain thousands of free hosting accounts on behalf of the spammers," wrote McAfee's Nick Kelly in a recent posting to McAfee's Avert Labs blog. That posting can be foundÂ here. "They know that the bigger hosts are unlikely to get blacklisted because they have so many legitimate users," he added. Scammers also use the free Web pages to try to manipulate search engines, by making it look as if their Web sites are widely linked, said Adam O'Donnell, senior research scientist with Cloudmark Inc., an e-mail filtering company. And while the free hosting providers are taking steps to shut down this abuse, they appear to be fighting a losing battle. In late June, Cloudmark researchers were seeing about 1,500 phony URLs (uniform resource locators) on any given day on one of the most abused free hosting services (O'Donnell declined to name names). One month later, that number had jumped to 3,500. Spammers are simply able to out-pace the hosters' security teams, O'Donnell said. "They will gain more hosts for their pages than the company is able to take down," he said. The free hosters have been placed in a tough position because they do not want to shut down legitimate users, but they also do not have the technical resources to mine spam for Web pages that are being misused, O'Donnell said. Lately, however, the hosters have been partnering with security vendors to address the problem. Cloudmark is working with some hosting providers, hoping to sell them "reputation" information that tells them how many times their member URLs are being seen in spam. McAfee has been providing similar information to an undisclosed service provider, Kelly wrote. "This relationship has cut the abuse observed by us on that provider by over 90 percent in less than a week." He added, "let's hope those spammers are buying their new watches from pound$hop rather than Bolex this summer."
339994
The majority of viruses intercepted by MessageLabs since January have the potential for spam distribution, according to a report by the e-mail security firm. It suggests that the virus authors are now making money by collaborating with spammers.
37816
Fuzzy PDF menace Spammers have turned a widely-used anti-spam trick - fuzzy text that computers cannot recognise - to their own advantage, according to the head of an anti-spam software developer.â¦
669540
A technological weapon against unwanted ''spam&quot; e-mails that has been embraced by leading Internet companies doesn't work as well as its developers had hoped, according to a new study.
509913
SPAM has been one of the major turn offs for most web users. Checking emails have become a hassle when you cannot be sure the mail you received is from the actual sender!
756552
Criminals deploy zombies herded into netwoks of a few hundred to more than half a million compromised PCs. Uses vary from the simply annoying (spam attacks) to the unsavory and criminal.
571596
Spammers may have found a way to thwart the CAPTCHA image-recognition system commonly used to combat spam.
160498
Spammers have become enthusiastic adopters of technology designed to spot and stop them.
284802
Fast, intelligent, automatic spam detector using Paul Graham style Bayesian analysis of word counts in spam and non-spam emails. Filtering adapts to personal tastes automatically. No manual rule creation required. This release adds the final missing pieces to the new parser code.  MBX files and Content-Length headers are now supported.  Database cleanup when signals are caught has also been improved.  I would like to move 1.1 into the stable branch fairly soon so if folks would test out this release and report any problems it would be a big help!   The latest release can be found here: https://sourceforge.net/project/showfiles.php?group_id=61201&package_id=73566