Category: Spam

Even while I’ve been off and on this blog for the past few days (more off than on, it seems at times), I’ve been pleased by the relative dearth of comment and trackback spam that’s made it through. Indeed, aside from nine trackbacks that sneaked past last night (and are now blocked in several ways), things have stayed pretty clean here.

That said, MT Blacklist has been very hard at work. A number of items were forced-moderation (which means you never saw them, and I could quietly delete them when I got to it). Many others were just plain gunned down when they tried cross the wire — including several hundred from that guy who does broad pr0n attacks (the subdomain blocking worked great, and I’ve put the other two subdomains I missed into the blacklist, so they won’t get through again). (And, indeed, I can see in the log his bots are still out there trying it. Zap!)

Since September, when I installed MT3 and MT-BL2, the thing has blocked 4,320 comment and trackback spams, and sent to moderation another 456 (of which only a dozen or so were legit posts). To me, that’s a huge benefit, and praise be unto Jay Allen for this incredibly powerful and useful product.

(And, by the way, the master blacklist is beginning to be updated again. Huzzah! And it’s timely enough that the spammer I mentioned above would have been blocked today one my blacklist was auto-updated.)

All that said, there’s a critical MT-Blacklist bug (in v.2, the MT3x version) that’s been reported: under undefined but evidently rare circumstances, deleting a blog in an installation set up with MT-BL will delete a second blog in that installation. Eep! Jay’s on top of it, so just pass the word. (Deleting blogs is not a common thing, but I’ve been considering archiving and deleting some of the older blogs here, just on GPs, and am glad that I didn’t …)

And, in keeping with that, before you go doing major blog maintenance like that, it’s a good idea to back up your blogs. All of them. In fact, it’s a good idea to just plain ol’ do so on a regular basis.

A chance to strike back at spammers?

Internet portal Lycos has made a screensaver that endlessly requests data from sites that sell the goods and services mentioned in spam e-mail.

Lycos hopes it will make the monthly bandwidth bills of spammers soar by keeping their servers running flat out. The net firm estimates that if enough people sign up and download the tool, spammers could end up paying to send out terabytes of data.

Hmmm. Tempting. Very tempting.

Of course, is it ethical? And if it’s okay to do this, what other sites (or viewpoints) is it okay decide to hound off the air with similar measures?

Here’s a clue to spammers — when everyone is sending out spam that say “Hi!” or “Hey!” as the subject, (a) people will quickly learn that these are spam and delete/filter them unread, and (b) folks will get still more irked at spammers. (I’m finding I’m having to be very careful about e-mail I send to strangers to ensure that they don’t see it as spam, but recognize it, from the subject line, as legit.)

Not that I expect you to worry too much about (b), but (a) should mean something to you.

Came down this morning for a bite to eat before going off to a training session on contemplative discernment. Discerned that someone was in the middle of a trackback ping spam attack on this blog. Ran a couple of them through despamming, deleted the rest — and sat here and watched as additional pings crashed against the blacklist. Hah!

My biggest worry is how I’m going to handle that while away on business and vacation. Trackbacks in particular cannot be easily turned off, and MT-Blacklist doesn’t moderate them (for semi-obvious reasons), which creates an annoying window of opportunity.

Still, though it’s not doing much for contemplative state of mind at the moment, I’m feeling rather satisfied.

UPDATE: Whilst I was gone, dude burned up another six hours of futile additional attempts with the same strings. Again, I say: Hah!

UPDATE: Fifteen hours after I initially blocked this guy, and the blacklist log shows his processes still splashing against the filters, once every minute or two now. Over five hundred today. Jeez.

I am absolutely shocked and stunned to find out that some spammers might actually be lying to us!

As many as half of the Viagra anti-impotence pills sold on the Internet could be counterfeit, British scientists said on Tuesday.
They analyzed samples of Viagra sold on the Web and found that some of the little blue pills contained different components or less of the active ingredient than the top-selling drug made by pharmaceutical giant Pfizer Inc.
“On our initial estimate, around half of those Viagra samples could be counterfeit,” Dr Nic Wilson, of the University of London, told the British Pharmaceutical Conference.

I mean, if you can’t trust anonymous folks sending you unsolicited e-mail for prescription medicine without a real prescription, who can you trust?

Yet another variation on a tired old on-line scam. Next thing you know, they’ll be threatening you with force or something.

A refreshing relief from offers for investments, unclaimed wealth, and erection aids: How can one become a terrorist?

You\’re invited to shop for large selection of bombs and different kinds of rockets such as surface-to-air, surface-to-surface and weaponry available at reduced price. With the following types of rockets you will be able to commit terrorist attacks, destroy buildings, electric power stations, bridges, factories and anything else that comes your mind. Most items are in stock and available for next day freight delivery in the USA. Worldwide delivery is available at additional cost. Prices are negotiable.
[…] Recently received *NEW*
Hydra 70 2.75 inch Rockets
Air-Launched 2.75-Inch Rockets
FIM-92A Stinger Weapons System
Stinger 101: Anti-Air
Our clients are well known Al-Qaida, Hizballah, Al-Jihad, HAMAS, Abu Sayyaf Group and many other terrorist groups. We are well known supplier in the market and looking forward to expand our clientage with assistance of Internet.

Almost certainly a spoof — I hope — or a scam (by law enforcement or otherwise), but I think I’ll avoid the ICQ and phone numbers.

Your health is the most important thing of your life. Have a look on my page.
Or, are you interested to earn more money?

Dude, even comment spammers need to focus on a single message. Be all over the map, and you’re just going to get laughed at.

Heh.

Imagine if those annoying teen-agers and vandals that spray-paint your house and leave burning bags of dog poop on your front doorstep suddenly realized that they could simply walk in the door and set up a crack house inside.

That’s what’s happening in the world of hacking, as folks discover that not only can they get the thrills of breaking into peoples’ systems and trashing them, they can actually make money, too.

One indication of the going rate for zombie PCs comes from a June 11 posting on SpecialHam.com, an electronic forum for spammers. The asking price for use of a network of 20,000 zombie PCs: $2,000 to $3,000. Such networks typically are used to broadcast spam and phishing scams and to spread e-mail viruses designed mainly to create yet more zombies.

What are zombies (in this context, at least)? PCs that have been compromised by hackers. But rather than just destroying files or stealing credit card numbers, the hackers have left in back doors where they can send commands to have the “zombie” PCs suddenly do something — like send out the spam mailings of their choice — for which, of course, the hackers can then get paid. All the owner of the PC might notice is some performance degradation at times, and, abruptly, their Internet service being cancelled by their ISP.

As if it needs repeating, make sure you have a decent home firewall and anti-virus software, not to mention anti-spyware software. And keep them updated. ‘Nuff said.

(via Les)

An unprotect PC, connected to the Internet (capitalized or not) will be infected by something within twenty minutes.

According to the researchers, an unpatched Windows PC connected to the Internet will last for only about 20 minutes before it’s compromised by malware, on average. That figure is down from around 40 minutes, the group’s estimate in 2003.
The Internet Storm Center, which is part of the SANS Institute, calculated the 20-minute “survival time” by listening on vacant Internet Protocol addresses and timing the frequency of reports received there.
“If you are assuming that most of these reports are generated by worms that attempt to propagate, an unpatched system would be infected by such a probe,” the center, which provides research and education on security issues, said in a statement.
The drop from 40 minutes to 20 minutes is worrisome because it means the average “survival time” is not long enough for a user to download the very patches that would protect a PC from Internet threats.

I liked this quote, though:

“If the human body did patch management the way (companies do), we’d all be dead.”

(via J-Walk)

MT-Blacklist 1.6.5 is now up. Jay Allen is juggling mightily to patch a couple of existing problems, get a more significant version 2 emergency release out, and get a version out that’s also compatible with MT3. Glad he’s taking a bit of time off.

The blog spammers continue to get more clever in their attempts to bump up the Google PageRank of their sites.

Most comment spam is not designed to get people to go to their sites per se, but to increase the references to those sites in Google’s indices, thus making them more prominent in Google searches. Google awards PageRank based on links to pages — and on the PageRank of the linking pages as well.

That latter is a key to the new scam. Blog spammers are now not only putting spam in blogs, they’re then creating sham comments/links to those blogs in other blogs, in order to boost the PR of those (spammed) blogs, thus boosting the PR of their spam.

So, for example, spammers discover that Joe-Bob never cleans comment spam from his blog. Not only do they then fill it with comment spam (with links to their hives of scum and villainy), but then go to other legit (ideally high-traffic) blogs and put comments with links to Joe-Bob’s blog.

The owners of those legit blogs see the comments, but recognize that Joe-Bob isn’t selling enlargement devices and think the comment is thus legit, thereby lending their own PR to Joe-Bob’s blog, and thus to the comment spam.

“Fiendishly clever.”

The result, as Jay Allen notes, is inevitable: the MT-Blacklist is going to start carrying blogs in it, sites that are not, themselves, comment spammers, but who (shades of Middle-Eastern geopolitics) lend shelter and support to spammers by not actively cleaning out their nests. Thus, Joe-Bob might suddenly find that MT-Blacklist-protected sites will no longer allow comments that link back to his blog, until such time as it gets cleaned out and de-blacklisted.

In the spam wars, if you’re not part of the solution, you’re part of the problem …

We’ve all received “Nigeria 419” spam — the ones that tell of some deposed dictator’s wife/son/daughter, or the friend or banker of some rich engineer who died intestate, etc., who only wants some nice person in another country to send them a bank account number so that they can transfer gazillions of dollars in, and so smuggle it out of the nasty banana republic it’s trapped in — in exchange for a percentage of the take, of course.

Well, some 419ers have taken the next step: out-and-out shake-downs.

From: Secretary Towogbola [secretary_in_chargeeeee@hotmail.com]
Subject: TREAT AS URGENT {THIS IS NO JUNK MAIL}
“EXECUTION”EXECUTION”EXECUTION”‘
NATIONAL CORPORATION HEADQUATERS LAGOS.
PRIVACY. we wish to introduce our company/ourselves as a subsidiary of INTERNATIONAL ASSASINATORS AND WORLD SECURITY ORGANISATIONS,with branches in one hundred and two {102}countires.
we have received a fax message from our headquaters,new york,this morning to inform you to produce a mandatory sum of US$40,000.00 {FOURTHY THOUSAND UNITED STATES DOLLARS} only,into our account given below in nigeria within ninety six hours{96},alternatively you will be SNIPPED and GUNNED down during the period of our oncoming anniversary of fifty years.
STANDARD TRUST BANK VICTORIA ISLAND BRANCH LAGOS A/C NO. 03681173101152 {OLAJIDE .O. WILLIAMS} NIGERIA
CAUTION.
1.you are to attach and send with immediate effect,the payment slip,confirming the payment and to enable us to reconcile with our files and deploy our men already monitoring you.
2.we will as well waste no time to carry our operations,if we discover that this contact is disclosed to any second party including the following:-
{a}police {b}relation and {c}friends
3.we guarantee your saftey locally and internationally,on the completion of this contract and will not hesitate to disclose our men in your country to you and as well render our service if needed or on request.
we seek your urgent co-operation,for it is not our wish to get you eliminated.
Note : – Your death has been paid for by someone you offended sometime ago and it will be adviceable that you co-operate with us a.s.a.p.
TOWOGBOLA .A.JOHNSON SECRETARY.

Of course, given how honestly they followed through on earlier promises, I wouldn’t lose any sleep over it if one of these appears in your in-box.

My detective work for the day.

Looking through my MT Blacklist log, I can see that a lot of the bad guy hits are coming from IP 213.91.*.*

Querying the most recent IP address through ARIN, I find that the 213.0.0.0 – 213.255.255.255 block is controlled by the RIPE Network Coordination Centre in beautiful Amsterdam. RIPE is a Regional Internet Registry (Réseaux IP Européens), and they have their own database of folks routing through them.

Querying the RIPE database shows me that range 213.91.128.0 – 213.91.255.255 belongs to Bulgarian Telecommunications Company Plc., located in beautiful downtown Sofia, the honorable Bisser Tzonev, Ilia Koukov, and Lyubomir Georgiev presiding (or at least as technical contacts).

Going to their site is pretty much of a Cyrillic dead end for me. Or is it?

So I’ve sent them a nice little note, asking for their assistance in blocking this sort of stuff. I’ll let you know what, if any, response I receive.

What did Congress do when folks started getting persnicketty about spam problems? Pass the CANSPAM Act, which both legalized certain (still irkstome) forms of spam and preempted state laws on the subject. The result was — well, how much less spam are you getting today than a year ago?

So Congress is now busy getting in a big uproar about spyware on PCs. The result, some fear, may be legitimizing spyware from big commercial vendors while not doing a heck of a lot to the folks who are already breaking the law.

And, of course, it will preempt any state laws on the subject. Swell.

H.R. 2929, currently called the Spy Act, is moving through the House so fast it’s hard to keep track of what it says. The version now headed to the House floor (after being approved by the same House committee that approved what became Can Spam) does at least have a requirement that the user be notified in plain English what the spyware/adware does. Unfortunately, it also very pointedly pre-empts the much stronger Utah law. Even worse is the fact that it leaves enforcement solely to the FTC, even though FTC officials have made it clear they have neither the will nor the means to go after any but the most criminal offenders.
It’s a good bet that, once the lobbyists are finished with it, the Spy Act will read more like the Sneakwrap-Sanctioned Spyware Protection Act. Software industry lobbyists are already attacking the law’s rather mild notice-and-consent requirement as being too burdensome. In fact, organizations that have long championed the sneakwrap licensing approach now claim they are trying to save users from having to read too many notices. For example, the Business Software Alliance issued a statement saying the notices the bill mandates won’t allow consumers to distinguish between legitimate vendors and the bad actors. “We are concerned that the ‘one size fits all’ notices approach will not help to inform consumers about how their personal information is being used, and will become just another screen to click ‘I agree.'” BSA CEO Robert Holleyman said in the statement.
I can’t begin to tell you how ironic it is for someone who watched UCITA’s creation to hear the BSA argue that users should not be required to mindlessly click OK.