Category: Spam

I hate being bothered. I have enough bother in my life, that someone going out of their way to bother me — or, worse, bothering me in a completely negligent and in-passing fashion — is seriously irksome.

I have a wiki, and I have some wiki pages from my late, lamented spy RPG. I do not want to take them down, and refuse to do so in other than my own good time.

Wikis are easily editable, so occasionally some spammer will get a wiki page and throw crap up there. No problem. They are trivially easy to revert to previous form and to write protect. I should write-protect the whole site, but that’s another story …

So usually it’s a one-off kind of thing.

Not with Doron.

Doron put bad stuff on my wiki.

I took it off.

Doron kept trying.

Doron kept doing it as what was clearly some sort of bot which had been set up. Nothing personal to him/her. Very personal to me.

Even after the page was blocked from edit, Doron kept trying.

And the really irksome parts were (a) it was obviously automated, so Doron had no personal stake in the effort, and (b) even though the page was edit-protected, the wiki software would still register the (unsuccessful) attempt to write to the page. Which means that if I want to keep track of any edits to my wiki (yes) I need ot keep seeing mostly Doron’s failed attempts. Two or three or four notifications a day.

Rrg.

So I finally went to the trouble of investigating the IP address used, combing through the access logs.

Aha. And it’s consistent.

Blocked.

Aaaaand … within a few hours, same (futile) attempt, but from another address. And neither address resolves to the ISP, so there’s a good chance it’s being spoofed, too.

Irksome. Highly irksome.

While we’re on the subject of graphs, the one here shows MT Blacklist’s stats on spam at the various blogs I host here.

The big drop in the angle of increase in April is when I went to TypeKey authentication on comments. All of a sudden, a lot of stuff that would have gotten through to MTBL was never entering in the first place. I have had, since then, a single spam comment get through.

Of course, Trackback spam remains a problem (and the bulk of both the “Moderated” and “Blocked” items that have continued grow the graph), since TypeKey doesn’t address it. I end up cleaning Trackback stuff two or three times a week from here, which is annoying, but MTBL clearly is still doing most of the work. MT 3.2 is supposed to increase control over Trackback, which should seriously ease the problem here.

And why do I keep Trackback? Frankly, so that I can see things like what’s above — where Les or Scott or someone else has found a post here of value and interest and linked to it. That was the promise of Trackback, and, with a bit of effort, it remains, I think, viable.

And if the problem gets worse? There’s still the whole SpamLookup toolkit I haven’t deployed yet — but will, depending on what happens with 3.2.

Okay, murder is bad. Beating someone to death is grotesque and icky and not to be condoned.

That said, I’ve yet to hear anyone react to this story without at least a small, morbid chuckle. Including myself.

Spammer Beaten To Death

The director of an English language center and one of the country?s most notorious spammers was found beaten to death in his apartment in central Moscow, police said Monday.

[…] Andrei Kashutin, the managing director of IT Dvizhenia, an industry association of nearly 7,000 IT students and young professionals, said Kushnir and his company were the most well-known spammers in Russia, sending millions of unsolicited e-mail messages offering English classes at the American Language Center. “Anybody who regularly uses e-mail has come across their spam,” Kashutin said.

It is probably unlikely that his killing was actually associated with his spamming activities — unless one wants to posit the efficacy of prayer, of course.

While I’ve joked about how amusing it is to get messages from “officialsoundingusername@hill-kleerup.org” warning me that my account has expired, been suspended, has a new password, etc., it’s also gotten really annoying, as I get 100-200 of them daily. Which takes time, of course, during the download (and as I open each folder in Thunderbird), but which also makes checking my e-mail via mail2web, etc., a lot less feasible (the per-screen signal-to-noise ratio drops close to zero).

Rrg. I have to see if there’s something I can set on the cpanel level to strip that crap out.

UPDATE: Well, yes, I can in fact filter out all the “admin@” and “info@” and “webmaster@” addresses for this domain. So there.

Phishing is the attempt to get you to tell folks your userids and passwords and similar identity-thievable items, usually by tricking you.

The classic is the false bank (or credit card, or PayPal) security notice — “Your account has possibly been violated. Visit our site [click here] and confirm your account identity.” And, when you click on the link, that looks like a real bank/credit card site, you get redirected to something that looks very valid but which, in fact, is not, at which point you enter your account info … and someone else has it.

Heh.

I’m pretty immune to most of these, to the point of not even opening most. But, hey, who could refuse an e-mail “eBay Outbid Notice: NIP NIKE Golf Tiger Woods Driven Poster (Item #4523317189)”? Not I?

Of course, before I click on any links in that e-mail, I noticed that the key link pointed an IP address, not to anything eBayish. But it was darned clever (and likely to take in still more people) …

On the heels of the oh-so-effective CAN-SPAM Act of a year or two ago (the one that (a) didn’t do a thing to stop real spam, but (b) gave vendors rules they could use to legally spam people), we now have the Junk Fax Prevention Act of 2005 (S.714).

The purpose of this bill is to fix a bad FCC ruling. We agree with the purpose and the approach.

But in the process of “restoring,” they are adding a brand new “exemption” to the TCPA that was never there before to allow advertisers to legally send you advertising by fax WITHOUT your prior consent. They thought they had this before and now 14 years later discovered that they hadn’t had it so they want it to cover themselves even though none of the witnesses that testified at the committee hearing on this bill have ever been sued (e.g., the person from NAR with 1.2 million members says they send faxes to member, the members send faxes to their client, etc. and nobody has ever been sued).

The way they are doing this is to allow unlimited faxing of ads (until you get sick enough of it to complain and your complaint meets certain requirements) if you have an “Existing Business Relationship,” but the definition of an EBR is so loose that it will be trivial for junk faxers to establish an EBR with virtually any business or consumer. A spammer can establish an EBR with your company just by visiting your website, calling your phone, or sending an email (provided someone replies, even an auto-responder). That gives them the right to LEGALLY send advertising to your fax machine.

Not only that, the current bill creates a never-ending EBR, so they can junkfax you forever until you opt out. So someone who spoke with you 20 years ago can legally send you junk faxes as soon as this bill passes. And, like spam, once you’ve opted out, you’ve just proven that it’s a real fax number and you look at your faxes … now your number is more valuable to sell to others.

Want to be that there will be an exception for the US Government (or at least Congress) to that particular exemption?

(via J-Walk)

There’s an old saying that you’re not just having sex with a particular person, but with all the people that person has had sex with. (We’re speaking from a public health standpoint, only, though one could make similar arguments in other arenas).

The same, it turns out, is true in the world of software installation, where you’re not only clicking to accept the EULA (End User License Agreement) of the software you’re installing, but of all the software that they’ve okay to also install, and so on, and so on. Hilarity (of a sort) can ensue.

3D Desktop’s Flying Icons screensaver is initially presented to the user as shareware available for a 15-day free trial. Only by scrolling down in the little text window to the end of the EULA does the user find a hint that there’s another component to the deal. If you install the software, you’re also agreeing to the terms of something called Blazefind. The only way to find out what that means is to follow a link to Blazefind’s EULA.

When Edelman followed that link, the Blazefind license turned out to be the EULA for “Windows ControlAd” software from CDT. Of course, in order “to give surfers a rich Internet experience,” CDT was going to install programs from 180Solutions and others. And by agreeing to the CDT EULA, one in turn is also agreeing to the license terms and privacy policies for 180search Assistant, Internet Optimizer, TopRebates.com, and Target Saver. (The Blazefind license and the mix of programs it says it will download have changed slightly since Edelman conducted his research, perhaps due in part to 180Solutions’ takeover of CDT.) So, with just one click, one “contractually” agrees to not only the 3D Desktop license but six different EULAs and the installation of a whole bunch of spyware. Or adware, if you think there’s a difference.

It probably won’t come as a surprise to you that Edelman found that those four weren’t the only programs that were loaded on his computer in the process. But that’s covered too, since the CDT EULA grants the company permission “to install new applications, at any time, in its sole discretion with or without your knowledge and/or interaction.” And, just to add to our growing list of outrageous terms, Edelman pointed out this little gem in the arbitration section: “You also agree to pay CDT $300 per hour to attend arbitration including transport time.”

In other words, click OK to a shareware screensaver’s cryptic little license, and you have given away control of your computer and your privacy. It’s your fault you didn’t spend hours and hours typing in URL after URL to read thousands and thousands of obfuscating words to decipher who and what you’re really dealing with. And if you were to try to get some redress, well, you have to pay them more for their time then you could possibly win.

Ain’t that swell?

One can argue that such terms couldn’t possibly hold up in court — but that hasn’t kept the companies making them from fighting that. After all, they argue, you consented to these terms by pressing that one little “I agree” button. Be it on your head …

Comment and trackback spam continue to be a problem here, accumulating at a manageable but annoying pace.

Now comes a new approach (hat tip Les) from Brad Choate, SpamLookup. And it’s being highly touted by Jay Allen of MT-Blacklist fame.

Seriously looking at this one, though I want to get a feel for what sort of burden it puts on the host system (vs a mostly-just-MT-BL approach; I am running MT-DSBL, the precursor to this, as well) before I move forward.

The one thing Choate recommends that I’ve not gone forward with is turning on user registration for comments. I’d really rather not, if I can avoid it, and I’ve been able to thus far (though I’m tempted to for Margie’s blog, since her comment count vs. spam count is relatively low). We’ll see.

Big uptick in comment spam over the last few days. A couple slipped through, many got bounced into moderation, most never made it past the starting gate.

Guess Spring Break is a chance to earn some extra bucks spamming.

A nice set of tools for fighting spam and similar ick — mostly research for tracking down the miscreants involved.

(via Spam Huntress)

Okay, I must confess I’m really interested in opening up the “Biblical impotence pi11s” spam I just received at the office. I mean, conceptually, I’d love to see how they spin that.

(after a few moments …)

How disappointing. No references to chastising rods or anything else like that. Just interesting spelling for “Vicodin” and “Pill,” and a note that “this product is a 43 year definite product.”

Ah, well.

Now that Firefox has gained so much market share from IE — it’s being targeted more by spyware and pop-up ad writers. Great.

The upshot of spyware writers’ newfound attraction to Mozilla, Arrott predicts, will be that in the next six months or so computer security guides will stop recommending that people switch from IE to halt intrusions.

It’s not just spyware that users of alternate browsers are complaining about. Much-reviled pop-up and pop-under ads are also making it past blocking software, a trend that Matina Fresenius, chairman and CEO of ad-blocking software developer Panicware, attributed to the fact that most older programs were made with IE in mind. “I’m not sure if it’s specifically that advertisers are finding ways to sneak by ad blockers in alternate browsers. I think it’s just that most ad blockers don’t support the alternate browsers,” said Fresenius, whose company launched a pop-up stopper last week that is designed to work with both IE and alternate browsers like Mozilla, Opera and Netscape.

Mac users are also complaining about a rise in intrusive advertising. In the past few months in particular, Mac users have reported a dramatically higher incidence of unwanted pop-up and pop-under ads, said Ben Wilson, senior editor of the Mac site MacFixIt. Typically, Wilson said, Mac users are subjected to fewer unwanted pop-up and pop-under ads than PC users. He attributes this tendency to security features in Mac OS X’s architecture and to its smaller market share.

Still, Wilson said, a handful of ad delivery firms openly boast about their ability to subvert traditional blocking systems, and Mac users are feeling the effects of some aggressive advertiser tactics.

Now what will be interesting is how quickly the FF development community responds to the problem. On the bright side, it can’t be any slower than Micro$oft …

Large number of comment spams flying in over the last few days. All but one or two spattered harmlessly against the windshield (where, moderated, I had to actually clean them up, but it all stayed behind the scenes). Seeing some different strategies on URLs being tried, which is why fewer are being outright blocked and more are being tossed into “old post” moderation. On the other hand, once particular URLs are caught (check early, check often), I’m then astonished to see multi-hundred block counts rack up in a few days.

I do need to clear off some of the old, unused blogs I have here — they’re no more vulnerable than the currently maintained ones, but they’re one more place to maintain the defenses around.

On a related note, there’s e-mail spam, which seems almost quaintly archaic any more. But, jeez, it still comes in. I get about 20-30 a day, of which Thunderbird catches about 3/4. That still leaves plenty that I need to manually delete, which is annoying — but, at the same token, has become so routine that I almost don’t notice it any more. It’s akin to going to the mailbox and sorting out the stuff to dump in the trash can on the way back inside. Sad, that.