Vircom closes more spam loopholes
628637
Vircom has enhanced its Modus e-mail filtering product, which now includes Sender Policy Framework (SPF), which greatly reduces the volume of e-mail from spammers and phishers.
714501
Gareth Heyes has posted about a new plugin he's created , spam protection for his WordPress blog  - SpamBam.   The latest plugin uses my PHP/JS randomisation techniques to create a key and protect against spam. I've took this bold move to see what affect it has and if the blog spammers will get round it because it no longer uses javascript cookies.   His plugin includes features including a lack of cookie use, delay on spammers (slows spam scripts) and doesn't use CAPTCHAs. You can also check out this section on Gareth's blog for the latest on the plugin.
299543
A campaign by Lycos Europe to target spam-related websites appears to have been put on hold. Earlier this week the company released a screensaver that bombarded the sites with data to try to bump up the running costs of the websites.
38679
A question of TRUSTe Sites handed the TRUSTe seal of approval are twice as likely to host malware or engage in spamming as those not endorsed by any security certificate, according to a study by spyware researcher Ben Edelman.â¦
79963
Web gateway filtering specialist Finjan is reporting a new toolkit that uses randomized JavaScript to stay hidden from virus crawlers and deliver its payload via compromised Web sites.Dubbed by Finjan's Malicious Code Research Center (MCRC) as the "Random JS Toolkit," the malware development package is allowing attackers to create threats that only attempt to victimize an individual computer in the same manner a single time to protect against discovery by anti-virus systems and researchers' automated "crawlers."By dynamically changing the JavaScript employed to deliver each variant of attack being created, and by using random file names that are only delivered to the same machine or IP address once, Finjan researchers said the malware authoring package is meant to avoid the programs used by AV researchers to find new threats emerging on the Web.Typically when automated crawler programs come across new attack samples, they return to the threats' source URLs to verify their names and characteristics and to create signature files that allow their products to block the programs -- or they enter the sites onto so-called blacklists of compromised domains.However, once a machine has been infected with an attack made using the Random JS Toolkit, the threat will recognize that the machine has already been targeted and won't attempt to download it again, thereby thwarting efforts to identify or track the exploits, Finjan experts contend.During the month of December 2007, Finjan estimates that more than 10,000 individual sites were compromised with attacks built using the Random JS Toolkit. Most of the URLs serving as distribution points for the attacks were legitimate sites that had been hijacked, the company said.Among the infected sites were some that would qualify as well-known, highly trusted domains, said Yuval Ben-Itzhak, chief technology officer of Finjan.Ben-Itzhak said the toolkit serves as a prime example of the types of tactics he expects leading-edge malware authors to utilize more frequently in the coming year."We've found the initial 10,000 sites, but we're sure that there are many more that have already been infected. When we can find this number of exploits, it is clear that this must be a very significant attack that has affected a lot of people," he said. "Using the combination of techniques available in this toolkit, the threats that are being created can become very powerful and stay alive to infect people for longer periods of time."Among the types of malware infections being served up using the toolkit, Finjan has observed everything from Trojan viruses and keystroke loggers to botnet recruiting programs, he said.For its part, Finjan's real-time code inspection technology can defend against such threats because it eschews the use of traditional virus signatures or blacklists in favor of constant monitoring for any malware activity coming across a network armed with one of its devices, Ben-Itzhak maintains.Rival AV vendors, including Symantec, contend that features such as the market leader's recently developed "generic exploit prevention," based on behavioral cues, should also be able to isolate and defend against such emerging attacks.Unlike the widespread iFrame attacks that proliferated across the Web during 2007, threats created using the Random JS Toolkit will also be much harder for security researchers to track down because they do not lead back to central sites where the actual malware code itself is hosted, Finjan maintains.Since the involved malware code is loaded directly on a site, and it won't attempt infect the same computer or IP address twice, traditional URL blacklisting and signature-based techniques will likely prove futile against the attack, the company said.However, from what the security appliance vendor can deduce, Ben-Itzhak said the firm believes there is only one malware group currently using the toolkit."From what we can tell, all the information flowing back from the compromised sites is heading to the same server," he said. "This indicates that there is probably only one group controlling this malware code thus far, and that they are probably being very successful; this is just another step forward for the criminals involved to continue to improve their attack methods and remain undetected."Ben-Itzhak said that the involved server is not one that matches any of the company's lists of machines controlled by well-known malware authoring groups such as the Russian Business Network. The server the company is tracking was originally located in Europe, but has recently been moved to China -- and likely will continue to be moved around to avoid detection, according to the expert.Most of the data the security company has seen being sent to the server has been related to online banking username and password data, he said.As part of its investigation, Finjan discovered that one of the Web properties infected with the randomized JavaScript attacks was an online advertising network that serves up as many as 14 million online banner ads per week. The security device maker reported that unnamed company was informed and is currently working to clean out its systems.
121143
Spam that includes sexually oriented content viewable in the e-mail message violates the &quot;brown paper wrapper&quot; rules that are part of the CAN-SPAM law, as well as Federal Trade Commission rules.
573432
(InfoWorld) - The European Commission has warned its member states to beef up their efforts to cut spam, spyware and malicious software, after research showed that up to 85 percent of all e-mail received in the European Union is unsolicited.The findings come four years after the EU adopted anti-spam legislation in the form of the e-privacy directive. "It is time to turn the repeated political concern about spam into concrete actions to fight spam," Viviane Reding, the commissioner for Information Society and Media, said in a statement on Monday.If there is no improvement by this time next year, Reding will consider introducing new legislative measures to fight the scourge, she said.She pointed to the Netherlands as an example of how the current legal regime can be used to cut spam. Hollandâs spam-busting unit, known by the initials OPTA, has just five full-time staff and â¬570,000 (US$747,000) worth of equipment, and has succeeded in cutting spam by 85 percent. âI'd like to see other countries achieving similar results through more efficient enforcement,â Reding said.Finland was also singled out for praise. A filtering system there has cut the amount of spam to 30 percent of all e-mail, from 80 percent two years ago, the Commission said.âWe encourage other countries in the Union to develop similar filtering means,â said Martin Selmayr, Redingâs spokesman, at a press conference Monday.The Commission is urging other countries âto lay down clear lines of responsibility to use the tools available under E.U. law effectively." Better cooperation with enforcement authorities from other countries, including countries outside the Union, is essential to defeat the spammers, the Commission said.The U.S. remains the single biggest source of spam, accounting for 22 percent of all spam received in the EU, the Commission said. China is the second largest source, accounting for 13 percent. France and South Korea rank joint third at 6 percent.The U.S. and the EU have agreed to tackle spam through joint enforcement initiatives, the Commission said.Last year, Ferris Research estimated spam to cost â¬39 billion worldwide, while fellow researcher Computer Economics calculated malicious software to cost â¬11 billion worldwide.The Commission's latest communication on spam is available here in several languages.
562547
Fake patches, rogue invoices make the rounds as spammers continue trying to fool people into installing Trojans on their PCs.
714894
The Blue Frog system crippled spam-advertised websites by deluging them with opt-out requests, until a retaliatory cyberattack killed it.  Now activists are redeploying the technology to send political messages that can't be ignored. By Ryan Singel.
55052
Duff note Stock spammers have abandoned PDF files and image spam with a new campaign featuring MP3 files.â¦
239684
Flaw filler Wall Street darling VMware released patches that address multiple vulnerabilities in its products this week.â¦
440105
The game's over and patches are available, but many sites are infected with malicious code.
215836
Prompted by government regulations, endless spam, and increasingly potent e-mail viruses, many enterprises are looking to tighten the cinch around messaging security.
683096
SECURITY EXPERTS MessageLabs say that there is evidence that virus writers are working hand in hand with spammers.
221232
Lycos Europe&#39;s &quot;Make love not spam&quot; campaign has killed access to some of the Web sites of its target alleged spammers, Netcraft has found.
288910
Most of the open-source community is finding that it can&#39;t deal with Microsoft&#39;s stance on spam-protection intellectual property.
534343
Exploit code for two of Tuesday's patches have been posted to mailing lists by researchers.