An up-close look at Russian spambot herders

Ryan Naraine at eWeek has a must-read article on how the recent surge of “pump and dump” spam is being delivered. Working with Joe Stewart, a senior security researcher at SecureWorks in Atlanta, Ryan was able to deliver a detailed picture of how these sleazy operations work and why they’re so hard to shut down.

Sobering numbers: 70,000 infected machines capable of pumping out a billion messages a day, virtually all of them for penis enlargement and stock scams.

Excellent graphics, too. This one shows that Windows XP Service Pack 2 is hosting nearly half the attacked machines.

It would sure be interesting to find out which exploits are responsible for all these infections. 

… as Mike Dimmick points out in the comments, many of these bots are installed because users download and install dangerous software and hand the keys to their system over to the bad guys: “That’s why the ISPs have to take charge and block spam from leaving zombie computers – ordinary users frankly can’t be trusted not to infect themselves.”

Sad but true.

Technorati tags: , , ,

It’s spam

As I noted last month, spam is up. But it hasn’t been accompanied by any increase in originality. Here’s the latest from my Junk Mail folder:

Really enticing subject lines there. 

… And from a different spam, this excerpt:

Hey, aphanipterous harebottle

Those farmers hear the girl crying.

After Checking our records, our office is willing to offer you unbeast Hovenia anywhere from 373K at 6.53% to 788K at 5.72% Fixed. ferly overprosperous hippodamous Those fishermen keep the room warm.

I think they want me to apply for a mortgage. With this pitch, what sort of hit rate can they possibly get?

Technorati tags:

Hijacking my good name

Newsweek’s Steven Levy has an interesting story this week about how his domain name, stevenlevy.com, has been hijacked by spammers touting penny stocks:

My domain name is being used as a phony return address by spammers wishing to hide the real origin of their come-ons. I discovered this when I suddenly began receiving dozens of bounced e-mail messages and out-of-office replies referencing mail I hadn’t sent. (My ISP forwards all stevenlevy.com mail directly to me.) Sometimes the original message was sent along, and to my horror, each one was a carnival-barker plea to buy the penny stock of some obscure enterprise, like the tiny company with some mineral rights in British Columbia that was shifting its focus to entertainment and media opportunities in China.

The same thing happened to me in the past 10 days, with porn e-mails going out under my name, a fact I discover when the bounce messages come back to me.

Ironic coincidence? Or a malevolent attempt by spammers to target technology-based domains? I don’t know. But I do know that it’s annoying, and if I owned a business that depended on e-mail for my customers to make purchases and receive support the effects of having my domain name used this way could be catastrophic.

 

Spam of the month

Now, this takes some serious cojones:

After the last annual calculations of your fiscal activity we have determined that you are eligible to receive a tax refund of $63.80. Please submit the tax refund request and allow us 6-9 days in order to process it.

A refund can be delayed for a variety of reasons. For example submitting invalid records or applying after the deadline.

To access the form for your tax refund, please click here [link removed]

Regards,

Internal Revenue Service 
    
   © Copyright 2006, Internal Revenue Service U.S.A. All rights reserved..

The link, of course, goes to a phony site.

Irs_phish

It started at a hijacked web server in the U.S. and then jumped to a phony site in Romania. Too bad the U.S. government doesn’t have anyone in charge of this kind of stuff.

E-mail I never finished reading…

This one made me laugh:

Dear @ FIRST NAME@,

If you’re interested in learning how others are integrating new media into the marketing mix, you are invited to download a new white paper we’ve just released with extensive research on the latest trends in online marketing, blogs, podcasting, RSS, email and database marketing. You can download it …

I’ll spare this marketing company the embarrassment of naming and shaming them. But if you’re a company that uses a third-party service to send out press releases, you should make sure they’re at least minimally competent.

Spam of the week

The headline:

Eran Yuor Dreege Now

Hmmm. Either this is written in Gaelic or it’s a desperate attempt to get past spam filters by misspelling words. Sure enough, here’s the pitch inside:

According to the U.S. Census Bureau, with the following degrees, here’s how much you can expect to make in your lifetime:

High School Diploma:  $1,000,200
Bachelor’s Degree:    $2,800,200
Master’s Degree:      $2,000,400
Doctorate:            $4,300,500

I was thinking of getting me one of those master’s degrees (NO ONE is turned down!), but it would cost me $800,000. Whew, dodged a bullet there.

Spam of the day

These days, spammers salt their messages with random assortments of text – “word salads” – to help them slip past spam filters. But this message, which arrived in my Inbox this morning, takes the practice to a new level that’s almost art. An excerpt:

When the skyscraper daydreams, a blood clot over the bartender sweeps the floor. Indeed, a polar bear around the squid cooks cheese grits for a diskette near the insurance agent. A righteous prime minister hesitates, and the salad dressing goes to sleep; however, some cab driver bestows great honor upon a short order cook inside the dust bunny.

I had an interesting revelation today as I watched the pre-workout instructions on my new Stott Pilates DVD. I like cereal with strawberry flakes in it. I don’t like exercise. Specifically abstract crap about sensing how muscles I don’t even know about are sliding around on my back. I don’t enjoy it, but I use my hamster wheel – correction Orbitrak elliptical machine – often in order to stay in shape. Partly out of vanity and partly out of an evolved addiction to the way exercise improves overall well-being and generally not feeling like garbage. Probably, I’m getting old. Definitely, I’m losing patience.

Sometimes a ski lodge living with an inferiority complex goes to sleep, but the crank case always gives lectures on morality to the cab driver! Furthermore, a dirt-encrusted inferiority complex beams with joy, and a wisely greasy garbage can learns a hard lesson from some customer from a ski lodge. Any graduated cylinder can lazily pee on a short order cook for a scythe, but it takes a real fraction to make love to a tomato over the cough syrup. The hockey player earns frequent flier miles, and another fundraiser from a chain saw plays pinochle with a cheese wheel.

A few of those lines could easily have been on  Highway 61 Revisited.

No, I didn’t click the link in the message, so I have no idea what they were selling. I’m guessing it had something to do with exercise equipment.

When should you opt out?

Prof. Froomkin tells the story today of a publicist who sent unsolicited e-mail messages on behalf of a professional organization to a large group of law professors. He’s right that the act of blasting out promotional e-mail to a group of people who haven’t already established a business relationship with you takes you perilously close to being legitimately called a spammer. If you’re going to promote your organization via e-mail, there are better ways to do it.

But I did want to call attention to a statement that appeared in the post:

Trouble is, smart users know you should never click on the opt-out info, it just encourages the spammers.

As a blanket statement, I don’t agree. (And I think that Prof. Froomkin may have been exaggerating to make a point.) But opting out of some e-mail lists is not only safe, it’s also smart.

In this case in particular, everything lined up in favor of using the opt-out link. The message came from a known organization. The sender made no attempt to hide his true identity. The product was legitimate. The mailing was sent using list-server software that accepts automated unsubscribe requests. So why not unsubscribe?

In my experience, there are at least three categories of spammers:

  1. Out-and-out crooks selling snake oil using hijacked computers as servers, using a forged sender’s address. Clicking the opt-out link on one of these messages, if it exists, won’t do anything good or bad. It usually goes to a phony address.
  2. Legitimate (and occasionally overzealous) merchants with whom you already have a business relationship. When you make a purchase, many companies ask whether you want to receive promotional mailings in the future. Some leave this option on by default. If you change your mind later, why not use the company’s unsubscribe link to get off their list? In most cases, this works. In the rare cases where it doesn’t, it’s usually incompetence on the part of the list manager, and you’re not going to get more junk e-mail because you try to unsubscribe.
  3. And then there are the quasi-legitimate “marketing” companies that blast out spam by the millions on behalf of legitimate companies, often using flawed affiliate agreements. These are the companies that actively build lists and offer the illusion of opting out. In fact, clicking the opt-out link may get you off this week’s batch of mailings, but the company will change its domain name and use a different mail drop next week, and your name will appear on that list once again, regardless of whether you opt out.

If I recognize the company that’s sending e-mail to me, I have no problem clicking the opt-out link. For those that I don’t recognize, or who I suspect are scam artists, I don’t bother because it usually does no good. That’s when I try to filter the junk at the server if possible.

The “never respond to a spammer” advice may have been valid at one time, but not anymore. If you’re getting spam, your e-mail address is already out there on the Internets and there’s not much you can do to protect yourself. With one noteworthy exception: If you’re foolish enough to actually buy something from a spammer, or to click a personalized link that take you to a Web site for more information about something advertised via spam, you may indeed graduate from the ordinary junk-mail list to a more exclusive “sucker list.”

My advice? Don’t be a sucker. Don’t buy stuff from spammers.