Peter Black's Freedom to Differ

Optus spam fine

The ACMA has fined Optus under the Spam Act 2003:

Optus has been slapped with fines of $110,000, the second biggest penalty ever issued under the Spam Act.

The Australian Communications and Media Authority (ACMA) has accused Optus of sending 20,000 electronic messages without accurate sender identification.

Optus says the messages promoted the OptusZoo entertainment service and the company assumed customers would make the link between the sender ID of 966 and its alphanumeric equivalent ZOO.

"Optus assumed that recipients of their messages would make the connection between 966 and ZOO," ACMA Chairman Chris Chapman said.

"However, this was not considered sufficient identification, as '966' could be used to represent any number of permutations on a telephone keypad."

The ACMA says it decided to issue the infringement notices because Optus did not adequately address the issue.

Read more here (from ABC News).  Read the ACMA's media release here.

Happy birthday

Spam turns 30:

Spam - the scourge of every e-mail inbox - celebrates its 30th anniversary this weekend.

The first recognisable e-mail marketing message was sent on 3 May, 1978 to 400 people on behalf of DEC - a now-defunct computer-maker.

The message was sent via Arpanet - the internet's forerunner - and won its sender much criticism from recipients.

Thirty years on, spam has grown into an underground industry that sends out billions of messages every day.

Statistics gathered by the FBI suggest that 75% of net scams snare people through junk e-mail. In 2007 these cons netted criminals more than $239m (£121m).

Statistics suggest that more than 80%-85% of all e-mail is spam or junk and more than 100 billion spam messages are sent every day.

The majority of these messages are being sent via hijacked home computers that have been compromised by a computer virus.

Read more here (from BBC News).

Broken email

The Observer looks at whether email is a broken business tool:

The deluge of email flooding workers' inboxes every day has become so overwhelming that it is now a 'broken business tool' in urgent need of fixing, companies have been warned.

The average employee spends an estimated 90 minutes to two hours a day wading through hundreds of messages, suffering interruptions and distractions with every ping from their PC or BlackBerry. Worldwide email traffic has now hit 196 billion messages a day, according to the research firm the Radicati Group, and is predicted to reach 374 billion per day by 2011.

Some organisations, such as worldwide accountancy consultants Deloitte and the publisher Cedar, have held 'No email days' to encourage staff to use the phone or talk to each other instead. But these are only stopgap measures.

'Email is a broken business tool,' said Jason Preston, new media manager at the Parnassus Group, a social media consultancy. 'There's been no innovation to separate the junk letters from the real ones.'

Read more here.

Twitter: "an idiot and spam-free zone"

The Guardian asks why there are no spam or trolls on Twitter:

Because it's rather like an RSS feed - you choose to read it - and nobody so far has worked out how to spam a feed.

Twitter, for those not in the know, is a collection of microblogs where people post their minute-by-minute thoughts and actions. Anyone can sign up and start posting "tweets", or updates. Your tweets can be made and viewed via Facebook or your mobile as well as via the website (twitter.com).

However, this is asymmetric, unlike Facebook, which requires you to confirm a friend request before they can see your status updates, which are the same sort of idea as tweets. On Twitter you can choose to follow anyone whose tweets catch your eye; and similarly, unless you limit your tweets only to your friends, anyone can follow you even if you choose not to follow them. Not everyone follows everyone who follows them. You follow?

Given the number of trolls, fools and idiots on the internet, Twitter is remarkable for being largely idiot-free, as blogger Russell Beattie points out. "Think about any other online community system ever created," he observes at tinyurl.com/2scblt. "All of them have had to deal with the core problem of idiots. Anytime a virtual group gets to a certain size, the morons come."

Spam usually comes in the form of email, and you can find your inbox full of emails from Twitter. But you can change the default setting, which emails you when someone starts following you, when you get a direct message from someone or when Twitter itself sends out a newsletter.

...

On the Twitter stream itself, you can in theory spam users, as Dave Winer notes on his Scripting News blog (tinyurl.com/36vjwz). The reply function means that "you can direct a message with a url to anyone as long as you know their username", he points out. However, unlike ordinary spam, you can block a user who insists on replying to you with offers to boost your penis size.

It's not just ordinary people out there, though. Businesses are Twittering, such as JetBlue, the US no-frills airline, which tweets on new routes and deals on airfares, but as Winer notes, you don't have to follow JetBlue or any other commercial Twitterer. The problem will come once someone works out how to reply to users on a large scale.

Until then, though, Twitter remains, pretty much uniquely on the web, an idiot and spam-free zone.

Read more here.

That's a lot of splogs

Wordpress suggests that one third of blogs are splogs:

Would you believe that about a third of blogs are spam? At least those are the numbers for Wordpress, according to Matt Mullenweg, the blogging platform’s founder. But think about how many spam blogs there are out there. You’ll find them in pingbacks, search results, and linking through spam comments. Is it hard to believe that about a third of blogs out there really are spam?

Read more here (from Mashable).

Just making sure that phishing is illegal

Techdirt questions why the US Senate is considering a law to make phishing illegal:

As the saying goes, when your only tool is a hammer, everything starts to look like a nail. The folks in Congress sure do an awful lot of whacking at various nails these days. The latest is a new bill in the Senate that seeks to outlaw phishing. One tiny point is important here: phishing is already illegal. So, really all this bill does is allow these politicians to claim that they took a stand to stop phishing. Except, it's actually worse than that. Not only will this bill not do anything to stop phishing, it will actually make life worse for plenty of non-criminals. That's because a part of the bill would outlaw hiding domain name registration information. Now, there are plenty of legitimate reasons for not wanting to reveal your info in the whois database -- but according to this bill, it won't be allowed any more. If you want to own a domain, you'll need to cough up your name, address and phone number to whoever wants it -- and they better be legit. If you provide false info, you'll also be breaking the law. So, it won't do anything new to stop phishing, but will make it much more difficult to own a domain anonymously. That's quite a nail.

Read more here.

Why phishing works

Rachna Dhamija, J. D. Tygar and Marti Hearst from the Harvard School of Engineering and Applied Science have published an academic paper explaining "Why Phishing Works".  Here is the abstract:

To build systems shielding users from fraudulent (or phishing) websites, designers need to know which attack strategies work and why. This paper provides the first empirical evidence about which malicious strategies are successful at deceiving general users. The authors first analyzed a large set of captured phishing attacks and developed a set of hypotheses about why these strategies might work. They then assessed these hypotheses with a usability study in which 22 participants were shown 20 web sites and asked to determine which ones were fraudulent. The study found that 23% of the participants did not look at browser-based cues such as the address bar, status bar and the security indicators, leading to incorrect choices 40% of the time. It also found that some visual deception attacks can fool even the most sophisticated users. These results illustrate that standard security indicators are not effective for a substantial fraction of users, and suggest that alternative approaches are needed.

Download the paper here.

Nick Hodge jokes "Our Benevolent Federal Government should Filter More"

Microsoft geek Nick Hodge may joke when he titles his post on the Labor Government's "clean feed" proposal, Our Benevolent Federal Government should Filter More, but in the post itself he mentions spam, Nigerian scams, phishing and identity theft to make this excellent point:

All of the above are illegal either directly in statute or in common law.

In none of the above cases can any Government provide a safe environment to all its citizens all the time. Just how far is our benevolent Federal Government willing to go to protect it’s citizens?

I’d prefer the Federal Government set up a division of Department of Foreign Affairs online ready to help out netizens as they travel to this unique universe, not just fearfully blocking. Use the technology to educate people.

Read the whole post here.

What's phishing?

TechCrunch's Michael Arrington reports on a phishing scam involving Facebook:

I’m not sure what the bad guys want with a bunch of Facebook user account credentials, but phishing scams seem to be hitting the site. Scott Fish notes that some users are seeing Wall posts that contain links to phishing sites to gather Facebook credentials.

An example message is:

lol i cant believe these pics got posted….its going to be BADDDD when her boyfriend sees these- http://www.facebook.com.profile.php.id.371233.cn

Note that the URL in the quote above, which leads to what looks like a Facebook sign in page, is not Facebook. So if you visit the site (don’t), DO NOT enter your Facebook credentials or any other personal information.

Only your friends can add Wall posts on Facebook, so any posts linking to phishing sites are either from hacked accounts or else people have added the phishing guys as a friend.

Read more here.

Cybercrime 2.0

The Washington Post pays tribute to those clever cyber-crooks:

The year 2007 may go down in the annals of Internet crime as the year when organized cyber criminals finally got serious about their marketing strategies -- crafting cyber schemes that were significantly more sophisticated and stealthy.

Security experts say criminals are increasingly trying to ensnare Internet users by lurking on familiar Web sites and using purloined data to craft scam e-mails that are more believable, and thus more likely to entice an unsuspecting user.

"The attackers are now following the same path that businesses have, in trying to advertise themselves in their own special way on the more popular Web sites," said Tom Liston, an incident handler at the Bethesda, Md.-based SANS Internet Storm Center and a senior security consultant with Intelguardians, a Washington-based Internet security consulting group. "They're doing exactly what every business tries to do, which is to find innovative ways get themselves out in front of as many eyeballs as possible."

Read more here.

More spam than legitimate email

Read/WriteWeb breaks the bad news:

Reasearchers at IDC predict that this year the number of spam messages sent will eclipse the amount of legit email correspondence for the first time ever, reports USA Today. Approximately 10.8 trillion spam messages will have crossed through inboxes in the past year, compared to 10.5 trillion legitimate person-to-person email messages. The numbers indicate that spam is a growing problem, despite the promise of better filtering technology.

"Two years from now, spam will be solved," said Bill Gates in 2004 addressing World Economic Forum in Switzerland. But 2007 will go down as the worst year yet for spam, a trend that has held for the past four years, according to Rebecca Steinberg Herson, vice president of marketing at Commtouch, an email security firm.

In an interview last month with USA Today, Gates reminded that though the volume of spam has increased, more of it is being deleted by spam filters. "Sure, there's a lot [of spam] out there, but software is deleting 99.9% of that anyway," he said, though Microsoft has revised that claim to 85% - 95%.

Read more here.

"Australia's Spam Legislation: A Modern-Day King Canute?"

Mark Bender analyses Australia's spam legislation in this research paper:

Bender, Mark R., "Australia's Spam Legislation: A Modern-Day King Canute?" (September 2006). Monash U. Department of Business Law & Taxation Research Paper No. 2 Available at SSRN: http://ssrn.com/abstract=916724

Abstract: This paper considers a number of aspects of Australia's recently introduced unsolicited commercial email (UCE or spam) legislation, the Spam Act 2003 (Cth). The magnitude and nature of the harm caused by the spam problem is outlined, as are the key provisions of the legislation enacted in an attempt to reduce spam. Observations are made as to some of the perceived shortcomings of the Act, and of lawmakers' approaches in general in trying to legislate against spam. The fundamentals of Australia's legislative approach are contrasted with those of the corresponding US legislation and some key distinctions drawn, notably the Opt-In/Opt-Out dichotomy, Australia having used the former approach, while the US used the latter. Some alternative approaches and suggested enhancements to the Australian legislation are also considered, including proposals by Bill Gates and Lawrence Lessig. Finally there is a summary of and some limited comment on the first case brought under the Australian legislation.

MP3 spam

I was surprised to read on Ars Technica about the rise and rise of MP3 spam:

As anti-spam tools and e-mail users become more sophisticated, spammers are turning to new mediums to get their unwelcome messages through filters and into inboxes. One of the more recent developments is spam with attached MP3 files. One security software vendor, MXSweep, is reporting that MP3 spam now accounts for between 7 and 10 percent of all spam being sent.

Anyway, it doesn't seem like a good idea:

The files are given innocuous-sounding names like elvis.mp3, oursong.mp3, smashingpumpkins.mp3, or coolringtone.mp3. The payload is disappointing: a voice recording touting the virtues of some corporate stock; in other words, it's pump-and-dump stock spam in a new format. It's also a dumb idea. The overlap of those gullible enough to click on MP3 files of unknown provenance and those willing and able to invest in a stock that they've never heard of is certainly minute. It's bound to be more of an annoyance than anything else and seems unlikely to result in the desired stock purchases.

Read more here

US tops the list of spam-offending countries

ZDNet News covers this latest report into spam:

The U.S. remains the world's biggest spammer, according to security firm Sophos, which on Friday released its quarterly report on the world's top spam-offending countries--dubbed the "Dirty Dozen."

The U.S. came in well ahead of its rivals, according to the report, being responsible for

28.4 percent of all spam

. South Korea was second (5.2 percent), followed by China (4.9 percent), Russia (4.4 percent) and Brazil (3.7 percent).

"It seems as though a major American spammer is arrested every other week at the moment but, despite these high-profile law-breakers being put away, the U.S. continues to relay far more spam than any other nation on the planet," Carole Theriault, senior security consultant at Sophos, said in a statement.

"This level of activity can't be attributed solely to the slick operations of a few cash-hungry criminals. The problem is there are thousands of spammers using many thousands of compromised zombie computers in the U.S.," Theriault said.

Read more here.

Microsoft, Hotmail and spam

Club Troppo's Nicholas Gruen acknowledges that "Microsoft is a remarkable company" but wonders why they can't find a better a spam filter for Hotmail:

I have a hotmail account which I no longer access much, but ... I clicked [in] to look at the 22 emails I had this evening. All spam.

Still it must be pretty hard for Microsoft’s software to tell that emails with subjects like ‘up the ass’, and ‘Asian cocksucker’ are spam emails. I don’t know about you but I’m always sending emails like that around.

In case you’re thinking I’m looking at the junk intray - there are apparently 16 emails in there that the spam checker caught. I wonder what they say? Call me old fashioned but I reckon the subject ‘deep anal fucking’ ought to raise a few suspicions.

So, so true.  Read the full post here.

Skype phishing scam

Over TechCrunch, Duncan Riley alerts us to a surprising phishing scam:

Why in the world would a scammer want my Skype details? I have about $12 AUD in credit, which I suppose could be used to make calls, but it hardly seems worth the effort.

Notably, Gmail did not pick the email up as being a scam.

I checked the html for the email: the alleged skype link goes to a page on cec-icmc.org that is set up to look just like a page from Skype.

A quick search on Google results in other instances of Skype scams, but I didn’t find one exactly like this. In context, I don’t use Skype Out that often and Skype occasionally sends emails telling me that I have to use Skype Out to maintain the Skype Out credit, along with my Skype In number. This phishing scam keeps to the similar theme, in that Skype legitimately does on occasion request account updates.

A word of warning to the many, many Skype users out there: don’t trust emails claiming to be sent by Skype. If you’re already smart to this: good for you.

Read more here.

Facebook takes action against "Black Hat" applications

From TechCrunch:

Some of the most popular Facebook applications are using highly questionable tactics to spread themselves virally. Users have noticed and complained, and Facebook took action today to put stop the most egregious behavior.

Read more here.  About time!  A good move by Facebook.

Parody spam

The Nigerian email scams annoyed one person enough to write a parody spam.  Read it here.

Spam!

Spam!: The life of a spammer is a clever character study of a typical spammer.  The Daily Reel describes it in this way:

Creator Casimir Nozkowski continues the "First!" trilogy with this character study of a typical spammer.  In three minutes, we are given a chilling glimpse into the self-delusion that enables a man to become a polluter of email boxes.  "Why call it spam? Why not call it veal?" asks this most virulent of Internet pests, before busting into some freestyle rap.

Read more here.  And now watch the video:

Combating phishing

Technology Guardian has a good summary of the various techniques being used to combat phishing.  Read it here.

Free the Spam King?

From Wired:

Last week, Seattle-based "spam king" Robert Alan Soloway was arrested and charged with fraud, money laundering and identity theft. He is facing up to 65 years in prison and a fine of $250,000. I'm not holding my breath expecting this arrest to stop the flood of junk e-mail I receive, however. Law enforcement cannot stop spam with periodic high-profile busts, or with sentences greater than those received by rapists or murderers. Unfortunately, there's no quick fix, and we should search for something other than these symbolic incarcerations.
...

Spam is a difficult challenge, but it's one we will not solve with Soloway's incarceration. We need a broader and more comprehensive plan that incorporates technology, private investigation and enforcement and public education. Otherwise we create more problems for e-mail users than solutions, while failing to stop the money flow. And we embarrass ourselves by punishing spammers more severely than criminals who physically hurt people.

Read more here.

Spam wars

Venkat Balasubramani explains why the last six months have not been particularly kind to the antispam community:

Late last year, the U.S. Court of Appeals for the Fourth Circuit limited the reach of both state and federal spam laws to e-mails that contain "material" falsity or deception. And last week, a federal district court dismissed a Can-Spam claim on the basis that the plaintiff, James Gordon--who was not a traditional ISP--did not suffer the type of injury envisioned by the law, and thus lacked legal standing to sue.

The court also signaled its intention to award attorney's fees. While the decision will likely have minimal effect on claims brought by traditional ISPs, it is sure to take the sails out of the cottage industry built around spam litigation.

Read more here (from CNET News.com).

Do Not Call Register

With the Do Not Call Register getting quite a bit of media attention this week (for example, see here), I thought I'd link to a short piece I wrote last year summarising the legislation.  You can read my summary here.

"MySpace: Who Tom Sued and Why"

The lawsuits against MySpace are well known, but Mashable has a fascinating post on who MySpace has sued:

We frequently hear that MySpace is being sued - most recently by parents - but MySpace has also taken action against plenty of users who are abusing the site.

MySpace has always offered a rich platform for small and large business to advertise with but several companies have had to face MySpace in court for their efforts. While co-founder Tom Anderson has been quoted encouraging promotion on MySpace, many users have taken this freedom too far. Be it from fake profiles or tidal waves of unsolicited messages the results are the same: degradation of the community and poor user experience.

The action action against “Spam King” Sanford Wallace is well known, but here are some other cases that went largely unnoticed in ‘06 and ‘07 (some resolved very recently) ...

Read the rest here (including copies of documents relating to the cases).

Temporary email addresses

Today I stumbled upon what seems to be a good way to minimise spam - provide a temporary email address when required to give an email address when signing up for websites.  There are a couple of sites that provide such a service:

• Guerrilla Mail provides you with disposable email addresses which expire after 15 minutes. You can read and reply to emails that are sent to the temporary email address within the given time frame.
• Spambox gives your more flexibility as it creates a temporary email address that will expire after the time period you chose (30 minutes, 1 hour, 1 day, 1 week, 1 month, 6 months or 1 year).  For the duration of that period, all the emails sent to this email will be transparently forwarded to your real email.
• My Trash Mail gives you the choice between temporary email and secure temporary email.

I also discovered a site that allows you to send secure anonymous email - Anonymous Speech - which as it is located in Japan is governed by Japanese law and allowed to delete customer data legally from its servers.