Spamzy

If you’ve been reading any tech news sites lately, you’ve probably noticed two distinct trends:

1) Lots of reporting of the storm worm, with sub-stories related to mass hijacks of publicly-owned websites for the purposes of infecting the public’s PC’s with the Storm worm. (With still further subsets focusing on the “Russian Business Network” (or “RBN”) being behind the whole setup.)
2) Lots of arrests, convictions, and imprisonments of large-scale illegal spammers. (Including one murder-suicide of a previously incarcerated illegal spammer.)
3) More raids in Romania of online scammers, predominantly eBay scammers.
4) Lots of arrests and indictments related to the TJ Maxx identity theft incidents from last year.

As with last year, 2008 is proving to be an extremely bad year for illegal spammers.

I define an illegal spammer as the following, which is more specific than CAN-SPAM:

- They don’t care who they send to, or whether they actually ever wanted to hear from them in the first place.
- Further to that point: they actively seek out email addresses of total strangers to start spamming them. They know that these email addresses are not actively seeking to be sent spam. They don’t care.
- They try to get as much deliverability out of their messages whenever they know that their messages are being specifically filtered against (remember: they know these people don’t want the messages in the first place.)
- They spam the same individual numerous times per day. (And in many cases: per hour.)
- They spam urls representing largely illegal or fraudulent websites, selling either fake or counterfeit products, in violation of international law.
- They never opt anyone out, ever, and never honor any inbound communication regarding spamming.
- In many cases, their sites actively filter for any words related to spamming in their email or contact forms. They are well aware that they operate in violation of the law, and the public’s privacy.
- Their “opt-out policy” is to tell anyone who complains to “find your delete key.”

Robert Soloway was just such an individual. He knowingly spammed millions of people, several times per day, promoting “products” which either didn’t work (his so-called “turnkey email marketing solution”) or a variety of other bogus products. He ignored, and then later actively retaliated against any complaints regarding spamming.

Soloway was recently quoted as saying “I can honestly say, even though I’m going to federal prison, for once in my life, I have a focus. I’m very sorry for what I did. I’m hoping people can forgive me.” (source) This is in very stark contrast to previous statements he had made in chat rooms and web forums. e.g.: “I always win … regardless of the judgment amount … losing is not an option, and I never ever, ever have to pay a single cent to anyone.” (source)

Well we now know just how wrong he was.

I’m not going to comment on the Eddie Davidson murder suicide. It was very tragic and ultimately had very little to do with his prior spamming exploits (other than the fact that he escaped from the prison he was sent to for doing so.) What I will comment on is that Davidson was an active and willing informant to the FBI and other law enforcement agencies, something very few press outlets covered. He was already providing lots of information on how stock spamming worked, and was allegedly assisting in the case against his former business partner Darrel Uselton, known to be a rampant, unrepentant stock spammers for years. Jack and Darrel Uselton are both awaiting trial on Sept. 29th and continue to be under investigation by several states and the US Securities and Exchange Commission (SEC). (See the Texas AG’s press release dated July 9, 2008.)

That doesn’t bode well for many spammers, and could also have the ancilliary effect of further damaging Alan Ralsky, currently under a similar indictment in Michigan related to his repeated stock spamming activities, and profiting from stock market manipulation.

There was also the conviction of Michael Dolan relating to his AOL phishing and spamming practices.

All of this is summed up rather nicely in a recent forum thread I was made privy to in the past few weeks.

If You Live In The U.s.a - Please Stop Spamming, It’s just not worth it anymore

gerogeyboy0101
Posted: Jul 16 2008, 03:45 PM

On a roll…
*

Group: Members
Posts: 253
Member No.: 1368
Joined: 21-September 04

I have met online and dealt with many of you throughout the years, and some of you are simply terrific people who got caught up into something a long time ago that used to be innocent and legal, but now has been blown into astronomical proportions of bad.

People all over the USA are going down for illegal activity related to spam. I myself became a target for the IRS and was questioned by the fbi all because I told the truth about the fact that I had received 1099’s from two spammers that had spam lawsuits against them.

Surveillance technology and the Patriot Act and further bills being signed into being are completely destroying liberal, human, and privacy rights for citizens in the united states.

I don’t know if some of you guys realize it but these guys do not close, they do not stop. They take our tax dollars and get paid to sit in rooms and spy and follow leads, and investigate and do whatever it takes to catch whoever they can whenever they can. They are relentless and uncaring. If you’re going to spam and you have to, hey, a man (or woman) has gotta do what they gotta do. But using proxys or botnets or unauthorized access on anyones computer is simply not worth it anymore.

They will put you away for years, no ifs, ands, or buts about it. I’m not trying to scare anyone, Im just saying, be careful, and watch your asses, because they are out to get you 24/7.

The thread contnues with a lot of basically “shrugging” comments about how this has always been the case, followed by general agreement that everybody should be careful not to use their real identities when “doing business”, and then referring to the US as a “fascist” country.

They are all missing the point.

All of these recent arrests are pointing to a rather obvious point: if you commit crimes, no matter where you are or who you claim to be, you will be found, you will be arrested, you will be prosecuted, and you will be convicted. The few times this has not happened, it still results in suspects vastly changing their lives by moving to a completely different geographic location, and setting up whole new identities. If you’re spamming illegally, and especially if that spamming is surrounded by other illegal acts (hacking, hijacking of public computers, infection of public computers, fraud, wire fraud, computer trespassing, unauthorized sale of controlled substances, securities fraud, etc. etc. etc.) trust me: you are going down. Maybe not today. Maybe not this year. But you will.

Regarding the Russian Business Network: this shadowy group are continuing to erode the public perception of the country of Russia. Russian cybercriminals are behind perhaps 90% of the virus-laden emails the general public has been receiving. There are several reports that have linked them to the following:

• Recent attacks against websites and network infrastructure of the country of Georgia, starting at precisely the same moment as the attacks on the ground.
• Spam messages claiming to be from either MSNBC or CNN featuring links to bogus “breaking news” stories.
• Server hijacks and exploits causing them to deliver these same infections.
• Spam for “Canadian Pharmacy”, a known Spamit / Glavmed sponsored property.

And of course there are the less-substantiated claims that they also have been behind spam campaigns and hijacked hosting for a variety of child pornography website operations, and that they were also involved in the cyber-attack against Estonia last year.

Prosecution of whoever is behind this group, especially within Russia, is unlikely. But that’s soon going to become less of a problem since much of their target audience is actually geographically located within the US, as are (it is believed) several of their operatives. Also: a lot of the people who spam on behalf of these Russian groups and individuals (notably Spamit / Glavmed) are located in the US, Canada, and several countries in Europe. Arresting them can cut off a major source of cashflow and infrastructure. It also can draw out further details of where these individuals can be found, and subsequently arrested, if not by Russian police, then by international law enforcement. It’s a pretty small planet, after all.

The cyber-attacks against Georgia have garnered some very widely viewed headlines, and not just in tech publications. This does not help the Russian government in its bid for entry into the WTO. That was previously hindered by the renowned shuttering and resurrection of AllOfMP3.com. (Which now alternately operates as MP3Sparks and MemphisMembers.) It also isn’t doing any favors for Russia in terms of how international law enforcement sees them, which I’m sure is of no consequence to the Russian government anyway. That the recent cyberattacks have gained significant news attention is now raising some questions for other governments: if they can attack Estonia and Georgia, who’s to say they can’t attack a larger western power? Or a specific government, or utility, or financial network? The fact is: they can. Illegal spammers and their supporters have killed off any site which gets close enough to the truth to make them uncomfortable: the KillSpammers forum (which is not completely gone, just on hiatus. ,) spam-court, castlecops, blue frog, etc. They will do it whenever it suits them, or when they feel that the evidence is such that it will cause problems with their cashflow. I don’t doubt that they’d eventually try to attack Citibank, or PayPal, or the US Federal Reserve if it suited their needs at the time.

But that can only keep going for so long. A very bright light has been shone upon the RBN, and they are certainly aware of it. One day, inevitably, something’s gotta give, one way or the other.

In any case, the past two years have made two things abundantly clear:

1) While the process may be slow, law enforcement and the courts do enforce laws against these criminals, and apply penalties resulting in real jail time
2) The public at large is definitely fed up with continually receiving email spam (or really spam of any type.)

The tally so far this year:

• Indicted:
  • Alan Ralsky
  • Scott Bradley
  • Judy Devenow
  • John Bown
  • William Neil
  • Anki Neil
  • James Bragg
  • James Fite
  • Peter Severa
  • How Wai John Hui
  • Francis Tribble
  • Albert Gonzalez, AKA Segvec
  • Christopher Scott
  • Damon Patrick Toey
  • Maksym Yastremskiy, AKA Maksik
  • Dzmitry Burak
  • Sergey Storchak
  • Aleksander Suvorov, AKA Jonny Hell
  • Hung-Ming Chiu
  • Zhi Zhi Wang
  • Sergey Pavolvich
  • An unknown hacker named “Delpiero”

• Arrested:
  • Alan M. Ralsky [but out on bail]
  • Albert Gonzalez, AKA Segvec
  • Maksym Yastremskiy, AKA Maksik

• Convicted and Imprisoned:
  • Robert Soloway
  • Michael Dolan

That’s 25 total. And that’s actually an incomplete total since there were an additional 22 arrested back in April, notably including “Vladuz”, a Romanian cybercriminal behind rampant amounts of eBay phishing attempts. So for 2008 alone, we’re nearing 50 criminal prosecutions against these criminals, and it’s only August.

So I think I would have to agree with ol’ “gerogeyboy0101″ up there: if you’re spamming at all, do us all a favor and get the hell out of “the business.”

SiL / IKS / concerned citizen

Oh and P.S.: anybody notice that a lot of inbound spam purporting to be for VPXL or “Canadian Healthcare” now redirect to the SpamWiki entry for SanCash?

e.g.:

chipadd.com [a king replica site]

now points to:

http://www.spamtrackers.eu/wiki/index.php?title=King_Replica

Hehe. Nicely done, whoever you are.

SiL

Read more:
Some Spammers Are “Getting Out Of The Business”

The latest threat to online banking accounts involves fraudsters using multi-step schemes that involve different interaction points with financial institutions.

Cyber-criminals commit this multi-channel fraud by first breaching an account via the online channel to steal valuable information such as account balances, check images, or signature blocks, in order to commit wire, check and other types of offline fraud that never gets linked to the original breach online.

Unfortunately, the online channel’s role in these schemes is often overlooked. This is precisely what makes this kind of fraud so effective - and hard to catch. Financial institutions only register the final transaction fraud, and cannot account for the original breach, which often occurs in the online channel. Add this to the fact that consumers don’t know it is happening, and the fraudsters have a perfect opportunity to continuously get away with this crime.

Case in point is what happened recently to a leading financial institution that serves tens of thousands of customers daily. Despite aggressive efforts to safeguard its online environment, fraudsters pulled off a startling multi-channel fraud scheme.

Here’s how the fraud scheme worked:

1. The fraudster called the institution’s customer service number and, using social engineering techniques, reset the online account password and contact phone number.

2. The fraudster accessed the online account, learned more about the customer’s online activities, and downloaded check images containing the customer’s signature.

3. The fraudster then called on a separate institution using the stolen information to open a new account in the victim’s name.

4. A wire transfer was arranged to empty the victimized account and credit the new account at institution #2. Because the names on the accounts were the same and the fraudster had provided a phone number under his/her control and a valid signature, an offline verification of the transfer by phone, as a second means of identification, passed and was authorized.

5. The fraudster withdrew his loot piecemeal, visiting separate branches in a state different than the victim’s.

Legacy Fraud Detection Methods Blind to Online Activity

When fraudsters use schemes involving multiple interactions with different touch-points across an institution, they aren’t caught because the precursor online channel breach is often overlooked.

Common industry practice registers the final fraud transaction as the breach point, and case forensics employ limited resources to return insight that cannot trace the original breach to the online channel. When accessed only for reconnaissance, the online channel records no “transaction” for detection. This is precisely what makes multi-channel fraud so effective - and so hard to catch. Moreover, what kind of fraud is our previous example to be classified? Is such a loss wire fraud, check fraud, or simply “online account fraud”?

A next-generation approach to online fraud prevention is needed if we are to continue to inspire customer confidence in the online channel. According to Javelin Research’s 2007 Identity Fraud Survey Report, it takes an average of 60 days for consumers to even detect that fraud has occurred. This leaves fraudsters with a perfect opportunity to commit successful multi-channel fraud crimes if financial services providers don’t take pre-emptive steps to protect both their customers and their bottom line. New best practices and back-end technologies that focus on online behavior can better isolate and prevent multi-channel fraud at the source.

Modeling Individual Account Behavior Stops Fraud at Its Source

An emergent best practice is to employ predictive models of individual customer online behavior to detect when the “customer” logging in isn’t who they say they are, even if they pass authentication. Beyond simple machine signature technology, user profiling technologies rely on trended analysis of behavior account by account. They start by understanding what “normal” behavior is for each individual customer - and admit that there is no single pattern of “normal” behavior to write an anti-fraud rule against.

Dynamic, model-based analysis of account activity “does the math” - piecing together what are by themselves may seem like weak indicators of fraud until a powerful pattern emerges. Behavior that deviates from what is expected becomes suspicious - the more the deviation, the deeper the suspicion. This comprehensive analysis allows for more granular risk scoring and better correlation with offline activity patterns. A byproduct of this behavioral analysis also allows for a rich history of online activity that aids investigation and forensics.

Using these techniques, institutions can identify the fraudster via the alerts to online activity outside the customer’s predicted behavior. Deploying strong analytics at the source - the online channel - ensures that fraudsters’ attacks are shut down before any damage is done.

Credit:
Don’t Overlook the Online Channel: Combating Multi-Channel Fraud at the Source

AntivirusDoc is a new rogue anti-spyware program - a fake spyware remover, which uses trojans, such as the infamous Zlob or Vundo to enter the system. This parasite uses a range of intimidation techniques to get the user to purchase it’s “licensed version”. AntivirusDoc will flood the user with popups and fake system notifications to scare the user he is infected.

There is no reliable information available on the company behind AntivirusDoc or the product itself. AntivirusDoc is a scam and should be treated as such: do NOT download or buy it and block it’s homepage using your HOSTS file.

See the original post here:
AntivirusDoc

WiniFixer is a rogue anti-spyware program. It is, essentially, a fake spyware remover, which uses scare tactics (popups, fake system notifications) to convince the user that he is infected, in hopes that he will buy WiniFixer to dispose of the problem. This parasite usually infects the sytem by using trojans, such as Zlob and Vundo. WiniFixer is a “product” of Pandora Software - a program of highly dubious nature, which is also behind such scams as SpyAway and the recent InfeStop. WiniFixer is a clone of the said two rogues.

WiniFixer is a scam and should be treated as such: do NOT download or buy it and block winifixer.com using your HOSTS file.

View original post here:
WiniFixer

I can’t keep track of how many different passwords I have, although I know it’s not nearly enough — I tend to be lazy like most people and re-use the same passwords for many different accounts.
But here’s a new idea — what if passwords for online accounts were replaced entirely by cryptographic keys that sat on our desktops like icons, and functioned in the background, so we wouldn’t need to remember a string of letters or numbers?

An interesting blog post this morning discusses the obstacles and implications of this kind of technology, in part quoting a recent New York Times article —

In short, we need a log-on system that relies on cryptography, not mnemonics. As users, we would replace passwords with so-called information cards, icons on our screen that we select with a click to log on to a Web site. The click starts a handshake between machines that relies on hard-to-crack cryptographic code.

An obstacle to this kind of system are the current initiatives toward Open ID and single-sign on services, strategies that are backed by large industry players such as the Equifax, Google, Novell, Microsoft, Oracle, etc. In the open ID system, you would log in to a session on the web with one password, which would be accepted by any application/account supporting the open ID infrastructure.

To me Open ID sounds like a step backwards, toward less security…
then again, I would think that encrypting everything could also make your system run significantly slower, and that it wouldn’t prevent all the risks either…

Here is the original:
Will Passwords Become Obsolete?

There’s an increased risk that multi-faceted attacks or “converged threats,” warns messaging security provider Cloudmark.

The company says it’s discovered new, advanced threat techniques which combine spam, phishing and malware into a single attack distributed across e-mail, the web, mobile devices and social networks.

“Convergence is everywhere, including in the online attacker community,” WHIR News has Cloudmark chief technology officer Jamie de Guerre saying.

The attacks, “look for holes in traditional security solutions designed for a specific type of attack, such as a spam for a specific medium like e-mail, evading traditional security because they mash-up elements of spam, phishing and viruses,” says Cloudmark., which says it’s also has identified several new converged threats including “Smishing,” a mobile phishing attack that usually uses VoIP phone number accounts stolen by email phishing attacks to stage the mobile breech.

“Cloudmark also found what they call a ‘crush’ attack, distributed through SMS messaging, email and social network communication, crush attacks entice users to log into a Webpage and unknowingly opt in for a premium rate SMS service by telling users ‘Someone has a crush on you!’ followed by a link,” says WHIR News, adding:

“It also found that modern email viruses no longer distribute viruses as an attachment; they instead host the virus on a separate website and distribute emails that link to that Website.”

Read more:
Beward ?Smishing? ? mobile phishing attack

Have you ever wondered how your email addresses got into the hands of so many of the spam emailers out there? There are a quite a few ways they get them, and some may be surprising to you.

Read more:
How Do Spammers Obtain People’s Email Addresses?

Titan Shield is a trojan that displays an icon in the system tray. This icon shows a message, which says that the compromised computer is infected with dangerous spyware parasites and asks the user to download and install a removal program, which actually is Titan Shield, corrupt illegally distributed spyware remover. Once the user clicks on such message, the trojan opens a web site distributing Titan Shield. It may also try to download the application. The trojan is able to change the Internet Explorer default home page and redirect the web browser to malicious web sites. Furthermore, it can restart the infected computer without asking for user permission. Titan Shield automatically runs on every Windows startup.

Here is the original:
Titan Shield

Virut is a virus that infects any executable files and screensavers that the user accesses. The parasite also opens a back door providing the attacker with unauthorized remote access to the compromised computer. The intruder can upload and run arbitrary files.

Here is the original post:
Virut

If you trust the media and are looking to the future, you might be thinking a good deal about Cloud Computing — according to ComputerWorld, this could be the next big movement.

I’ve heard the buzzwords but wasn’t exactly sure what they meant–luckily, when there’s media hype, there are definitions, too. According to this article, cloud computing is exemplified by Software as a Service — outsourced, hosted platforms and software that perform services for companies.

Another article puts it slightly differently:

OK, let us look at what form of computing in being provided via the cloud. In this model, all IT applications and facilities (i.e. compute, storage and network) are provided as a service rather than dedicated infrastructure. This is intended to allow any user, independent of client platform, to access IT services without knowledge or concern of their location or form. Sound familiar — it’s a service-oriented architecture (SOA)!

In addition, cloud computing incorporates almost every computing manifestation within the IT world: distributed, grid, utility, on-demand, open-source, Web services, P2P, Web 2.0 and, last but not least, software as a service.

It also accommodates thin, thick and mobile clients and allows integration of corporate, commercial and service provider cloud-accessed resources. As an example, in this model, storage is a service resource that is accessed via the cloud, not a dedicated user resource.

Honestly I read that last one first and found the definition a bit dense. It sounds like a summation of everything that makes up our Internet infrastructure already, so how is that different than the Internet itself? Well, cloud computing isn’t about what service or devices are being supported — it’s more about how it’s being provided– it is a location-independent style of computing. The first article calls it “platform as a service.”

Have you heard better definitions of what cloud computing is and does? Share them in the comments below. Thanks!

See the original post here: