Category: Spam

The opening paragraph says it all:

Think looking at spam is offensive? Try listening to it.

If I ever lose my vision, just shoot me, okay?

(via GeekPress)

Test your popup blocker.

Or, as Indiana Jones III would say, “Nazis Popups. I hate these guys.”

The page has a set of common popup types you can click on (my software blocked all of these), and some less common types (some blocked, some got through). There’s also a review of “good” popups (3/4 of which are blocked on my machine), and a catalog of popup blocking software.

All that’s missing is an analysis of what sort of settings on what software will block the stuff that got through.

For the record, I’m currently using the popup blocker in Slimbrowser and also using PopupCop (which occasionally catches something that Slimbrowser lets slip through). That keeps me with a pretty popup-free browsing experience, though not even they can protect against the intrusive horrors at TVGuide.com.

The new IE is supposed to have an M$-bundled popup blocker in it. We’ll see how that works, one of these days.

(via GeekPress)

What are “‘counterfeit'” pills, as opposed to “counterfeit” pills?

Can I be fooled by “counterfeit” pills on your site, Bdbzizmfyx? Can I call you Bdb?

I wouldn’t dream of actually opening your e-mail, Bdb, but, damn, that’s a funny subject line. Bold, brassy, compassionate, alarmist, self-serving — it’s the triple-threat of spam subjects!

There is certainly a keen irony in seeing a message with the subject “Forget spam blockers…” in the spam quarantine folder …

Because, after all, you know you’ve “arrived” blog-wise when some asshole drops comment spam in your blog. Huzzah!

(Same cretin who tried dropping it on all the blogs here. Thank you for playing. Good-bye.)

Spam mail from folks with nonsense names (brxtlfrk@spamking.com), or clearly made-up and unrecognized names (bambi del toro)? No problem.

Spam mail from spoofed internal company addresses, complete with domain names, on the from line (fred.smith@mycompany.com)? Easily filtered.

Spam mail from spoofed internal company addresses that strips off the domain name, leaving a combination that’s a recognizable (and, if it’s someone you know, recognized) name (dave.hill)?

Uh … well, that takes an extra second or two of brain filter time, which is, to say the least, annoying.

Happy Monday Tuesday.

Or at least justice:

BUFFALO, N.Y. (AP) – A man who sent 850 million junk e-mails through accounts he opened with stolen identities was sentenced to up to seven years in prison on Thursday.
Atlanta-based Internet service provider Earthlink Inc. said it hoped the sentence and an earlier $16.4 million civil judgment against Howard Carmack will deter other spammers.

It probably won’t — but it will probably deter that one for up to seven years.

(via the Flea)

Spambots that are looking for e-mail addresses to use, please feel free to visit this site. Don’t forget to recommend this one to all the friends you sell mailing lists to. And what collection of harvested e-mail addresses, ripe for the UCEing, would be complete without this little gem?

(Note: none of the above will do any harm to Real Live Humans if they go to visit — only folks who are trying to harvest e-mail addresses from the web.)

(via GoaF)

With all due apologies to Les, I have to give that particular title to the spammers who have evidently taken my domain name, come up with every possible permutation of letters (out to ten characters or so), and spewed them in a horrid spray across the Internet in an attempt to get people to buy all manner of goods and services — or, alternately, in an attempt to spread Trojans and Virii across the Web. The result is easily forty to fifty bounces a day back to my home account, and a growing fear that, sooner or later, someone’s going to blacklist my domain over this.

So, in case anyone is wondering, you have my assurance that there is nobody here named Qoaqkkxbwy, Hyldpx, Kdeclai, Bonytdeg, Gafnuw, Opdxrwy, Hnvdyfcw, Jtxvy, nor Aedpo, let alone someone interested in selling you Hydr0c0d0ne and V1c0d1n, or X.anax. You have my word on it.

Based on the high volume of bounces, undeliverables, returned-because-of-viruses, etc. in my home e-mail inbox over the last week, evidently someone is spoofing my primary address. In other words, e-mail is going out addressed from me, using my e-mail address, but not really from me. It’s technically not that difficult to do, and is akin to someone sending out junk mail (you know, the paper kind) with the return address label picked at random from a phone book.

In other words, there are any number of people getting e-mail from me offering to increase (or decrease) the sizes of various things on their body, to provide them with prescription-free pharmaceuticals, and to describing various hot stock (or video) picks.

Swell.

The biggest danger from spoofing is being blacklisted — having ISPs or services that they turn to decide that “this address (or even this domain) is being used for unscrupulous purposes, so we’ll simply block all mail from it.” While most blacklist operators dig a bit deeper than just e-mail addresses (given the increasing prevalence of spoofing), not all of them do, so there is a real danger there. And, alas, there’s not much I can do about it, unless I discover that I’ve been blacklisted and can then appeal to whatever powers that are.

Harrumph.

Anyway, an object lesson. Don’t just assume the return addresses (and/or names) on those spams you receive are actually the folks involved. They probably aren’t, in fact, and by using your e-mail client to block them from ever again darkening your virtual door, you may be shutting out someone who will need to contact you some day in the future.

Like me. See, I’ve got these extra Rolex watches …

The FTC has decreed, based on Congressional anti-spam mandates, that all porn spam must be explicitly (so to speak) labelled.

Starting May 19, sexually explicit e-mail will have to bear a label reading ” Sexually-Explicit:” and the messages themselves will not be allowed to contain graphic material, the FTC said. […] Pornographers will not be allowed to include sexually explicit pictures in the body of the message, though they will be allowed to include hyperlinks or other methods to access their material.
Like other e-mail marketers, they will also have to include their postal address and an easy way for recipients to opt out of future mailings.

I’ll get back to you on the 20th and let you know how many fine, upstanding pr0n vendors are complying. Especially all of the overseas ones …

Maybe we can get them to say “Please” and “Thank you” next.

(via BoingBoing)

Is it just me, or is everyone getting a ton of spam about Rolex watches?

I recently installed Outlook 2003 on my machine, which is kind enough to protect me from other virus-laden Microsoft products by refusing to let me open up an Access MDB somebody sent me.

Huh?

Fortunately, it doesn’t delete the little puppy, it just keeps me from accessing it. Which means that I can forward it. To my personal account.

Which I did, and Outlook Express doesn’t have the same restriction, and I can now access it. Yeesh.

I have two levels of pop-up protection.

First off, I have (from of old) PopUpCop, which does a really fine job of pop-up filtering, particularly of different types and different technologies; it has a good control interface, too.

And I have the pop-up protections of SlimBrowser, which cover what PopUpCop doesn’t.

I have to be careful, though. If I tell PopUpCop to turn off scripts, then I can use the little B/I/U editing buttons in my blog (and others), since they use onclick scripts. And if I tell SB to block pop-ups based on appearance, then it treats those same onclick commands as something dangerous, and shuts down legitimate (whitelisted) pop-up windows (like, say, MT comment windows, for those who use that interface).

Annoying. Because, of course, when I let that stuff through, other crap gets through, too.

A constant struggle, I tell you. Rat bastard pop-up vendors …

From: staff@hill-kleerup.org
To: dave@hill-kleerup.org
Subject: Email account utilization warning

Um … I’ll just consider myself chided by myself (since I run hill-kleerup.org), rather than open up a copy of what I’m pretty certain is the Beagle virus.

Still, I thought it was amusing …

Fascinating look behind the scenes of who gets to name computer viruses — and why every virus seems to have multiple names. The answer is pretty straightforward — everybody in the anti-virus world slaps their own name on things. But the race to be the first to report often results in confusion for security experts, not to mention end-users.

Schmugar at Network Associates said he has named about 200 viruses and worms, though not all have stuck. He tries to pick a name that refers to something unique or memorable about a virus’s coding or behavior. In the recent case, he noticed the words “my domain” in the computer worm’s programming. The words stuck in his mind, probably because they were related to the worm’s advanced address-building capability. He shortened the reference to “mydom.” Then he stuck in an extra “o,” making “doom” part of the name.
[…] That afternoon, Network Associates started warning its corporate customers about the “MyDoom” computer worm. (Its full name, “W32/Mydoom@MM” also contains information recognized by computer security workers about what operating systems the worm hits and how it replicates itself.) Customers of Symantec Corp., meanwhile, got warnings about a worm called “Novarg.” Trend Micro warned customers about a worm it called “Mimail.r.”
Symantec derived its name from another, encrypted line of coding in the same worm; Trend Micro first thought the worm was a variant of a bug called “Mimail” because the two had some traits in common, and identified it as a sequel of that worm.
There is a simple rule for which company gets naming rights: The person or company that finds and posts information about a virus first gets to name it. But that’s a rule that is often dropped in the heat of the moment. It’s not clear whether Network Associates actually named the worm first or not — but “MyDoom” is the name that caught on.
[…]”By the time we realized what was happening,” said Shipp at MessageLabs, “Network Associates had already attached the name ‘MyDoom’ and we thought that was pretty good. . . . ‘Novarg’ didn’t really trip off the tongue, but ‘MyDoom’ just seemed to be the name that everyone was going to go for.”

The only rule that everyone seems to follow is to avoid naming it after the virus writer (however identified in the code) or with the name the writer intended.

Interesting stuff.

And this week’s entry into Increasingly Nasty Worms and Virii goes to W32.Beagle.J@mm (and similar names), which is busy spreading joy across the Internet.

The worm arrives as an e-mail from “administrator” or “support” or some other official-sounding type from your own domain. It tells you in reasonable English about a problem with your e-mail account, and conveniently includes a Zip file for you to open, along with its password.

Needless to say, once opened and executed, it does all sorts of nasty things.

And, needless to say, you should:

1. Have a good anti-virus program and a current subscription to its updates protecting your system at all times.
2. Not open e-mail attachments unless it’s someone you know and an attachment you’re expecting. If you get something that looks official, go to your ISP or host’s (or the company that it claims to be from’s) web page and look for a mention of it there.

3. See #1.

Etc., etc., etc.

All this should go without saying, but apparently cannot be.

(via Les and others)

Doyce noted with some worry yesterday that computers are on the verge of being smarter than humans when it comes to chess. On the other hand, it may be a good thing that computers (or, more properly, software programs) are beginning to be more accurate than humans when it comes to spam.

The authors of two spam filters, CRM114 and DSPAM, announced recently that their filters have achieved accuracy rates ten times better than a human is capable of. Based on a study by Bill Yerazunis of CRM114, the average human is only 99.84% accurate. Both filters are reporting to have reached accuracy levels between 99.983% and 99.984% (1 misclassification in 6250 messages) using completely different approaches (CRM114 touts Markovan, while DSPAM implements a Dolby-type noise reduction algorithm called Dobly).

I’ll note that my own lowly Bayesian filter, POPfile, is currently running around 98.24% accurate (including its training period). I’m almost worried about getting a higher accuracy rate — much better, and I’d slack off in checking to see if there were any false positives, which might not be a good thing.

(via BoingBoing)