Spammers use sender authentication too, study says
557084
The technology hasn't been widely adopted, but spammers are taking it up at a faster rate than legitimate e-mailers.
683096
SECURITY EXPERTS MessageLabs say that there is evidence that virus writers are working hand in hand with spammers.
223591
Security researcher demonstrates a way to use cross-site scripting to remotely spam an internal network printer.
118427
Microsoft&#39;s E-mail-filter technology, Sender ID, is unpopular with open-source advocates but popular with spammers, who are using it to bypass other filters.
93702
Scammers are using fake electronic greetings to lure recipients to malicious sites.
349241
Spammers have adopted a new standard for email authentication much faster than legitimate emailers, according to a study from security appliance firm CipherTrust published this week.
135540
It wasn&#39;t long ago that competitive entities seemed to be joining together to combat Internet users&#39; common foe, spam. However, despite the fact that big Internet players
391200
Microsoft CEO Steve Ballmer provided some perspective for anyone who thinks they are getting too much spam. &quot;There are two people who probably are the number one spam recipients in the world.
175189
(InfoWorld) - Though security industry experts were openly referring to the death of spam several years ago, the arrival of image-based attacks has resulted in a stunning renaissance in the volumes of unwanted e-mail reaching end-users' inboxes. And while filtering technologies have improved significantly and can thwart the ability of most image spam to force its way onto corporate networks today, some experts believe that the fight against the use of such AI (artificial intelligence) tactics on the part of spammers is only just getting underway. In a new report published on May 30, analysts at Cambridge, Mass.-based Forrester Research extrapolate on their theory that image spam is merely the tip of the iceberg when it comes to spammers' use of AI. The only way to prevent a repeat of the image spam surge as new models using AI come to light, Forrester analysts said, will be for technology vendors and enterprise customers to abandon their current approach of trying to filter out every type of campaign that the mass-mailers conceive and instead battle the roots of the problem. Just as Web sites and anti-spam providers have utilized techniques such a CAPTCHA -- the challenge response tests found in many different online applications that ask users to input characters planted into obfuscated image files -- to beat back unwanted bot-driven activity, so too will spammers utilize AI to create seemingly endless variations on their message campaigns to circumvent the latest filtering tools, the experts said in their report. CAPTCHA is an acronym for "completely automated public Turing test to tell computers and humans apart," a concept named after Alan Turing, the English mathematician referred to by some as the father of modern computer science. "The notion with CAPTCHA is that computer bots and other programs can't efficiently process the image, that they can't deduce the words in the image, and that's the same thing that spammers are doing today to defeat traditional filters," said Dr. Chenxi Wang, one of the analysts who authored the research. "People have devised new filters that use technologies such as optical character recognition that has curtailed the spread of image spam," said Wang. "Unfortunately image spam is only one type of AI problem, and spammers have many they will use in the future; this only the beginning of an arms race." Just as CAPTCHA has largely foiled the ability of scammers to game online registration and transactional systems, spammers will be able to use a nearly endless variety of techniques to avoid the latest and greatest message filtering tools, the analyst said. Without a major breakthrough in AI research, Wang said, there is "no way we can bridge the gap" with the number of methods that spammers will be able to use to keep their schemes humming along. Among the types of methods that spammers are already employing to beat existing image-filtering tools are spam campaigns that use distorted and obfuscated text images, graphic pictures, and audio and video files. To fight spammers over each type of content will be a losing battle, Wang said, recommending that customers and technology providers instead focus on monitoring messages for fundamental properties exhibited by each flavor, such as the links to malware sites that most of the e-mails carry. "Vendors should look through brouhaha calling for them to defend against each type of image spam and build products that attempt to capture the fundamental properties of spam," said Wang. "They can use techniques such as intent analysis and URL reputation analysis; those factors won't change with each new type of campaign that's being invented." While conceding that the fight against spammers isn't one that will ever likely draw to a close, companies such as ISPs that are working harder than ever to keep unwanted e-mail from reaching their customers say that progress is being made. Stephen Currie, director of product management for e-mail, at Atlanta-based ISP EarthLink, which reported 2006 revenues of more than $1.3 billion, said that his company has been able to reduce the amount of spam reaching its customers by 80 percent in the last 18 months. Using filtering tools sourced from software maker Cloudmark and its internally developed Scamblocker.com anti-phishing resource, along with a heavy dose of input from its users, has allowed the firm to turn up the heat on image spam and other AI campaigns, he said. "The message content fingerprinting technologies from San Francisco-based Cloudmark allow us to understand message contents without ever opening them up, and it doesn't require as much CPU power on our end as it would have even several years ago," Currie said. "But the real key has been to become very aggressive about using the feedback we get from end-users to stop spam that initially finds a way through." Just as CAPTCHA relies on human interaction to defeat automated input, the approach of using customer feedback to identify and block spam sources is one that has trumped technological means, the executive said. "Once we determine the root source of a campaign using these types of methods, we can block a lot of the IP addresses being used to stop it from sending additional mail to our servers," Currie said. "Although we're getting shipped more spam than ever, customers are telling us that they're now getting less than over the last several years, but we absolutely expect new things to come along and challenge us; it's the proverbial cat-and-mouse game." In addition to utilizing human and technological means to stop spam, EarthLink is also involved in the Messaging Anti-Abuse Working Group (MAAWG), a global ISP initiative aimed at improving the current state of electronic messaging. In mid-May, the group released its latest Sender Best Communications Practices (BCP), a set of best practices for e-mail technologies and subscription methods meant to improve deliverability rates for legitimate newsletter and marketing messages. Officials with San Carlos, Calif.-based e-mail security service provider Postini -- which claims to process more than 1 billion messages per day for more than 35,000 organizations -- said that spam levels continue to set new records and that unwanted e-mails currently account for roughly 40 percent of all traffic it monitors. In addition to high levels of image spam, the company is also tracking developments such as an increase in the volume of messages that appear to be meant to harvest e-mail addresses for subsequent malware attacks, including botnet threats. Other recent trends under investigation by the firm include spam that attempts to evade filtering tools by using strings of gibberish to confuse content scanning technologies. The company maintains that its products can help customers catch up to 99 percent of all spam if they are willing to employ the most aggressive settings available, but Postini executives said that users' fear of missing legitimate messages forces most companies to seek a balance between warding off unwanted e-mail and toning down the possibility for false positives. "Because the overall volume of spam continues to increase, clients are seeing a few more messages per day sneaking in, and it does tend to be image spam, but progress is being made," said Adam Swidler, Postini's senior manager of solutions marketing. "It's probably naive to think that this fight will ever end as long as there is a monetary driver for the bad guys, but we do think that we can help get to a place where spam is only a minor nuisance."
704456
By Anick Jesdanun  Spammers have something new in their bag of tricks.  Those ubiquitous Viagra ads have been disguising themselves as e- mail newsletters, the kind you get to find out the latest airline deals or keep up with your fantasy football team.
698329
More than three out of four (76 percent) consumers are experiencing an increase in spoofing and phishing incidents, and 35 percent receive fake e-mails at least once a week, according to a recent national study.
273776
Several Internet companies, including Microsoft and eBay, are working on new ways to keep spammers from infiltrating their sites.
40705
(InfoWorld) - "Ed," a retired spammer, built a considerable fortune sending e-mails that promoted pills, porn, and casinos. At the peak of his power, Ed says he pulled in $10,000 to $15,000 a week, storing the money in $20 bills in stacks of boxes. It was a life of greed and excess, one that preyed especially on vulnerable people hoping to score drugs or win money gambling on the Internet. From when he was expelled from high school at 17 until he quit his spam career at 22, Ed -- who does not reveal his full name but sometimes goes by SpammerX -- was part of an electronic underworld profiting from the Internet via spam. "Yes, I know I'm going to hell," said Ed, who spoke in London on Wednesday at an event hosted by IronPort Systems, a security vendor now owned by Cisco Systems. "I'm actually a really nice guy. Trust me." A quick-witted and affable guy who wears an earring and casual clothes, there was a time when Ed wasn't so nice. He sent spam to recovering gambling addicts enticing them to gambling Web sites. He used e-mail addresses of people known to have bought antianxiety medication or antidepressants and targeted them with pharmaceutical spam. In short, Ed said he was "basically what people hate about the Internet." He spent 10 hours a day, seven days a week studying how to send spam and avoid filtering technologies in security software designed to weed out garbage e-mail. Most spam filters are effective 99 percent of the time; he aimed for that remaining window, using tricks such as including slightly different images in his spam, which can fool filters into thinking the e-mail is legitimate. "The better I got at spam, the more money I made," Ed said. He would start a spam run by finding an online merchant who wanted to sell a product. Then he'd acquire a list of e-mail addresses -- another commodity that has spawned its own market in the world of spam. He'd also set up a domain name, included as a link in a spam message, that, if clicked, would redirect the recipient to the merchant's Web site, enabling Ed to get credit for the referral. The spam would then be sent from a network of hacker-controlled computers, called botnets. Those machines are often consumer PCs infected with malicious software that a hacker can control. Ed would "rent" time on those computers from another group of hackers that specialized in creating botnets. If one of the spam recipients bought something, Ed would get a percentage of the sale. For pharmaceuticals the commission was around 50 percent, he said. Response rates to spam tend to be a fraction of 1 percent. But Ed said he once got a 30 percent response rate for a campaign. The product? A niche type of adult entertainment: photos of fully clothed women popping balloons. To track the money, merchants set up a "referral sales page" where spammers can see how much they make from a spam run. Ed would log in frequently, watching the money increase. He was paid into electronic payment transfer accounts, such as e-gold or PayPal, or into his debit card account, which he could cash out in $20 bills. That became problematic when the cash became voluminous. He says he made $480,000 his last year of spamming. But the lifestyle of being a spammer was taking a toll. In essence, he had no life. It's hard to go into a bar and explain your job to a woman by saying "I advertise penis enlargement pills online," Ed said. "It doesn't go down very well." He rationalized his actions by saying spamming is not like robbing someone, although the lurid impact of spam was clear. Some nine million Americans have some dependence on prescription drugs, Ed said, and he noticed that the same people were buying different drugs each month. "These were addicts," he said. Additionally, "the product is always counterfeit to some degree. If you're lucky, sometimes it's a diluted version of the real thing," he said. Viagra is cut with amphetamines, and homemade pills are common from sketchy labs in countries such as China, India, and Fiji, Ed said. So Ed got out of the business. He's written a book, "Inside the Spam Cartel: Trade Secrets from the Dark Side," which he said has had some take-up inÂ law enforcement circlesÂ eager to learn more about the spam business, which he projects will only get worse. As broadband speeds increase, spammers will increasingly look to market goods by making VOIP (voice over Internet Protocol) calls or sending out videos, Ed said. The ultimate unsolvable problem is users, who continue to buy products marketed by spam, making the industry possible. "I think in 10 years we'll still get spam," Ed said. "Be prepared to be bombarded." Â
554133
A technological weapon against unwanted &#39;&#39;spam&quot; e-mails that has been embraced by leading Internet companies doesn&#39;t work as well as its developers had hoped, according to a new study.
720664
Some spammers are getting their messages through using techniques designed to spot and stop them. A survey shows that spammers are the biggest users of a technique designed to find out if e-mail comes from the net address it says it does.
725343
Spam messages are increasingly plaguing e-mail inboxes, but more Internet users are accepting them as a fact of life, a new study has found.
96436
Lycos vigilante attack on spammers has been hit by a vigilante attack. Spammers are suspected.