Pinboard (guardiantech)

Gmail for iOS users told to check their trash and spam before 14 February >> Graham Cluley

guardiantech — 2014-02-02T21:40:14+00:00

If you use the Gmail app on your iPhone or iPad, it might be sensible to check your Trash and Spam folders before Valentine’s Day.
That’s not because there might be an ecard waiting for you from a secret admirer, but due to Google accidentally deleting or marking as spam some users’ messages.

See a later link for how to do this effectively.

The decay and fall of guest blogging >> Matt Cutts

guardiantech — 2014-01-20T22:27:07+00:00

If you ignore the bad spacing and read the parts [of the received email] that I bolded, someone sent me a spam email offering money to get links that pass PageRank. That’s a clear violation of Google’s quality guidelines. Moreover, we’ve been seeing more and more reports of “guest blogging” that are really “paying for PageRank” or worse, “we’ll insert some spammy links on your blog without you realizing it.”
Ultimately, this is why we can’t have nice things in the SEO space: a trend starts out as authentic. Then more and more people pile on until only the barest trace of legitimate behavior remains. We’ve reached the point in the downward spiral where people are hawking “guest post outsourcing” and writing articles about “how to automate guest blogging.”

Though it is hlarious that someone would try an SEO-spamming tactic on Matt Cutts, who is Google's anti-spam guy.

Why Twitter can't win its war on spam >> Daily Dot

guardiantech — 2013-09-23T21:02:23+00:00

Through those sites, the developers gained entrance into "an underground market that connects Internet miscreants with parties selling a range of specialized products and services." Over the course of 10 months, the researchers did business with 27 merchants. They later calculated that these merchants were responsible for registering 10% to 20% of all accounts later flagged by Twitter as spam. Charging just pennies per account but selling thousands of profiles at once, the merchants generated between $127,000 and $459,000 collectively during the course of the study.
The sheer volume of the operation was astounding.

Spy service exposes Nigerian ‘Yahoo Boys’ >> Krebs on Security

guardiantech — 2013-09-11T20:10:15+00:00

I shared a link to the site with a grey hat hacker friend, who replied in short order with the entire username and password database of more than 3,000 paying customers.
Initially, I assumed my source had unearthed the data via an SQL injection attack or some other database weakness. As it happens, the entire list of users is recoverable from the site using little more than a web browser.
The first thing I noticed upon viewing the user list was that a majority of this service’s customers had signed up with yahoo.com emails, and appeared to have African-sounding usernames or email addresses. Also, running a simple online search for some of the user emails (dittoswiss@yahoo.com, for example) turned up complaints related to a variety of lottery, dating, reshipping and confidence scams.
The site was so poorly locked down that it also exposed the keylog records that customers kept on the service.

Somehow that's fitting.

How to stop spammers inserting events in your Google Calendar >> Labnol

guardiantech — 2013-09-05T13:38:36+00:00

Few days ago, I got an email alert at slightly odd hours saying: “Contact FedEx for delivery of your courier.” If it were an email, I would have immediately dismissed the message as spam but in this case, the reminder came through Google calendar.

It's not a particularly new spam, but it's mighty annoying if you have your email set to "add invitations to my calendar". Worse is figuring out how not to reply to it, either declining or accepting it. (The linked Google help page is no use - it's 404.)

The underground market for spam Twitter accounts >> Fast Company

guardiantech — 2013-08-14T23:08:22+00:00

The dark underbelly of Twitter audience.

Because Twitter abuse is reported after the damage has been done, the researchers from George Mason University and UC Berkeley were looking for ways to detect automatically created accounts before they're used for fraudulent purposes. Working in collaboration with Twitter, they spent 10 months buying 121,000 spam accounts from 27 underground sellers. The cost per 1,000 accounts ranged from $10 to $200.

Bitcoin mining malware spreads on Skype as price rises >> ZDNet

guardiantech — 2013-04-08T20:50:57+00:00

Criminals are using Skype to spread malware in the hope of building a botnet with enough computer power to mine Bitcoins.
Researchers at Russian security firm Kaspersky Lab discovered the Bitcoin malware campaign last week, which had been targeting would-be victims in Russia, Poland, Costa Rica, Spain, Germany, Ukraine and other countries.
Potential victims are encouraged to install a file that is included with messages like "this my favourite picture of you". If the malicious file is installed, one of its features is to turn the machine into a Bitcoin mining slave.
Does it pay better than spam? One has to assume so.

F**K CAPTCHA >> Harry Brignull

guardiantech — 2013-02-22T15:40:44+00:00

Brignull is a user experience designer and consultant:

Users were directed to the sign-up form direct from the homepage before they could interact with the product. As you can see, there was a CAPTCHA at the bottom of the form (powered by reCAPTCHA). With this design, they had a conversion rate of roughly 48%. They then removed the CAPTCHA, and it boosted the conversion rate up to 64%. In conversion rate lingo, that’s an uplift of 33.3%! They replaced the CAPTCHA with honeypot fields and timestamp analysis, which has apparently proven to be very effective at preventing spam while being completely invisible to the end user.

Black Market Pharmacies And The Big Business Of Spam : Planet Money : NPR

guardiantech — 2013-01-11T21:59:04+00:00

An apparent feud between two black market pharmacies has shed light on a shady global industry.
"Rx-Promotion and SpamIt probably are responsible for upward of 50 or 60 percent of spam that you and I got in our inboxes over the last five years," said Brian Krebs, a cyber-security reporter who chronicled the alleged feud on his website. "It's just a ridiculous amount of problems that these two guys cause for everybody."

Absolutely. Though this is surprising: the researchers did tests, making 800 orders separately:

"We've maybe only had one time where we didn't get anything," said [Stefan] Savage [of the University of California at San Diego]. They tested some of the drugs they received, and all had the proper amount of the active ingredient.
Savage says the vast majority of customers are ordering erectile dysfunction drugs. Others order painkillers or stimulants for recreational use. But up to 15% of orders come from people seeking medications to treat chronic health conditions, likely because they can't afford to purchase them through legal avenues.

In other words: might the US's health care system partly be to blame for spam?

Android botnet found on all major US carriers sends thousands of spam texts to infect users >> The Next Web

guardiantech — 2012-12-19T20:56:45+00:00

A new Android spam botnet has been discovered that uses infected phones to send thousands of SMS messages without the user’s permission. While the threat is not (yet) widespread, it has already been spotted on all major US carriers and has the potential to make a big impact at the network level if it isn’t dealt with soon.
On December 3, security firm Lookout detected the threat, which it dubbed SpamSoldier, in cooperation with one of its unnamed carrier partners. It spreads through SMS messages (it has not yet been detected on any major app stores) that advertise free versions of popular paid games like Angry Birds Space.

The text that spreads it looks pretty obviously spam. Except people fall for spam.

Hotmail & Yahoo Mail using secret domain blacklist >> Slashdot

guardiantech — 2012-12-13T18:34:57+00:00

Bennett Haselton:

"Hotmail and Yahoo Mail are apparently sharing a secret blacklist of domain names such that any mention of these domains will cause a message to be bounced back to the sender as spam. I found out about this because — surprise! — some of my new proxy site domains ended up on the blacklist. Hotmail and Yahoo are stonewalling, but here's what I've dug up so far — and why you should care."

Though he can't figure out why, one possibility is down to the age of the domains: newly registered domains that suddenly start sending thousands of emails are likely to get blocked. Seems smart. (Haselton is a longtime activist in the whole field of censorware and blocking.)

India spews more spam than ever before, report finds >> Naked Security

guardiantech — 2012-10-16T12:18:36+00:00

You can thank India for about one out of six spam messages cluttering your inbox.
SophosLabs's most recent "dirty dozen" report, which details the world's top spam-relaying countries, finds that India has topped the charts for the third quarter in a row.

Seems out of line with the population of computers in India, and probably says more about the security of those in use. The US was third with 6.5%, China 10th with 3.1%, UK 12th with 2.1%

Illegal marketing clampdown begins as spam texters set for six figure fine >> ICO Blog

guardiantech — 2012-10-01T16:07:07+00:00

Letters have gone out today to two individuals that we have found to have broken the law. Subject to final ratification, the recommendations total well over a quarter of a million pounds. Further details about each case will be revealed once we are able to formally announce our action next month; however this is an important step that shows those who blatantly break the law will be in line for a sizeable six figure penalty from the ICO.
While companies can phone you to sell you the latest product or service, the law states that individuals should not receive unsolicited texts or automated marketing calls unless they have given their permission. Marketing companies are also forbidden from phoning individuals registered with the Telephone Preference Service (TPS) unless they have given their explicit consent. While honest mistakes can occasionally be made we will look to take action against individuals and companies that continue to break the law.

Finally, the ICO discovers it has teeth.

DoItQuick: Fast Domains for Dirty Deeds >> Krebs on Security

guardiantech — 2012-07-23T05:50:25+00:00

A new service offered in the cybercriminal underground is geared toward spammers, scammers and malware purveyors interested in mass-registering dozens of dodgy domains in one go.
The service — doitquick.net — will auto-register up to 15 domains simultaneously, choosing randomly named domains unless the customer specifies otherwise.

Krebs doesn't specify whether it's done cheap, but kudos anyway for getting the AC/DC reference in there.

Chutzpam >> Talking Points Memo Editors Blog

guardiantech — 2012-07-09T16:10:24+00:00

Josh Marshal:

if you run a website there’s the dreaded scourge of ‘comment spam’. You’ve seen it. People who go into comments and post totally off-topic comments with links to this or that commercial site. “So, hey, you’re talking about health care reform and mandates, but check out the great Refi i just got at scamrefi.com!!!”
Clearly, the folks who do this for a living are shameless and awful. But this morning I learned they’re striving for even greater levels of shamelessness and actually achieving it.

Today's helping of karma with a side order of belly laughs.

Alan Alda and the Customer-Service Headache >> NYTimes.com

guardiantech — 2012-07-08T15:30:36+00:00

In which Alan Alda - yes, that Alan Alda - tries to get McAfee to stop quarantining his emails on a service he doesn't use or pay for.

PharmaLeaks: Rogue Pharmacy Economics 101 — Krebs on Security

guardiantech — 2012-06-24T21:43:19+00:00

Researchers at the University of California, San Diego, the International Computer Science Institute and George Mason University examined caches of data tracking the day-to-day finances of GlavMed, SpamIt, and Rx-Promotion, shadowy affiliate programs that over a four-year period processed more than $170m worth of orders from customers seeking cheaper, more accessible and more discreetly available drugs. The result is perhaps the most detailed analysis yet of the business case for the malicious software and spam epidemics that persist to this day.

Killer zombie comment attacks via Google News >> TidBits

guardiantech — 2012-05-25T22:27:11+00:00

After the fourth or fifth time of being hammered after an article appeared in Google News, I finally discovered a pattern I should have seen earlier. Our access logs were full of requests from many different IP addresses asking for the same page repeatedly within a few seconds. That in itself wasn’t unusual for traffic generated by Google News, but more peculiar was the user-agent identifier — that’s the bit of text a browser sends that tells a server what its maker and version are.

Lots of traffic from Google News, but not all of it driven by humans.

Spam Finds a New Target >> WSJ.com

guardiantech — 2012-01-04T22:44:51+00:00

"Spam, one of the Internet's oldest annoyances, is gearing up for a second act. Unlike traditional email spam, which usually comes from strangers, this new form—dubbed "social" spam—often appears to be from a friend. Criminals find social networks alluring because they can spread messages though a chain of trusted sources.
"Such spam puts the usefulness of social networking at risk. Facebook says less than 4% of the content shared on its site is spam and Twitter says just 1.5% of all tweets were "spammy" in 2010. But Facebook adds that the volume is growing faster than its user base. On any given day, spam hits less than 0.5% of Facebook users, or some four million people."

Spam is the E.coli of the internet.

Killing spam on Google+ >> Pras Sarkar

guardiantech — 2011-12-14T06:30:07+00:00

"The quality of conversations on Google+ is something we take very seriously, so we’re happy to announce that we've finished rolling out our new comment spam moderation system. "Now, if we identify a possibly spammy comment on your post, we'll immediately mark it for your review." If Google+ is getting spam that's actually a good sign - spammers don't bother with places where nothing is happening. But you have to review your own? Bet that people won't, for the most part.

Microsoft neutralizes Kelihos botnet, names defendant in case >> The Official Microsoft Blog

guardiantech — 2011-10-02T21:07:14+00:00

"Microsoft also alleges that Dominique Alexander Piatti, dotFREE Group SRO and the John Doe defendants committed some of the same violations made in the successful legal cases against the operators of the Waledac and Rustock botnets. Kelihos infected users’ computers with malicious software which allowed the botnet to surreptitiously control a person’s computer and use it for a variety of illegal activities, including sending out billions of spam messages, harvesting users’ personal information (such as e-mails and passwords), fraudulent stock scams and, in some instances, websites promoting the sexual exploitation of children. "Similar to Rustock, some of the spam messages also promoted potentially dangerous counterfeit or unapproved generic pharmaceuticals from unlicensed and unregulated online drug sellers." 41,000-strong botnet, could send 3.8bn spam emails per day, also hosted Mac scareware. One up for Microsoft.

Seventh Circuit awards e360 a whopping $3 in damages against Spamhaus >> Technology and Law Blog

guardiantech — 2011-09-08T21:05:52+00:00

We wrote about this some time back. The law grinds slow but... "The lawsuit between e360 and Spamhaus was a long-running, tortured affair, and it looks like it finally came to a close. With e360 being awarded a whopping $3 in damages against Spamhaus. (Here's a link to Ars Technica's recap of the oral argument, where Judge Posner blasted e360's counsel: 'This is just totally irresponsible litigation . . . .You can't just come into a court with a fly-by-night, nothing company and say 'I've lost $130 million.')"

Yes, three dollars.

Flashy cars got spam kingpin mugged >> Krebs on Security

guardiantech — 2011-08-22T21:38:27+00:00

Go on, enjoy the schadenfreude.

Twitter spam and motivation to report it >> Marco.org

guardiantech — 2011-07-18T21:14:42+00:00

"Fundamentally, I believe Twitter’s priorities here are wrong. Twitter needs a far more aggressive, automated, proactive, heuristic-based anti-spam system. And if someone has trouble legitimately tweeting a link with no text to 100 people in a row who don’t follow them at precise 1-minute intervals, that’s just the price we’ll have to pay.
"In the meantime, I’m never using the “Report Spam” feature again, because it just seems like I’m wasting my time."

Though this does assume that spam on Twitter actively annoys people. There's not a lot of evidence that it does, though, because unlike email it hasn't reached the point where it's any significant proportion of a timeline - and has any single spam account actually tweeted the same person twice?

Where Have All the Spambots Gone? >> Krebs on Security

guardiantech — 2011-07-03T17:01:58+00:00

Mostly offline as owners have been jailed or gone into hiding. Spam volumes have fallen by 90% over the past year. But there's a new rootkit around, called TDL-4, infecting millions of machines: "Getting infected with TDL-4 may not be such a raw deal if your computer is already heavily infected with other malware: According to Kaspersky, the bot will remove threats like the ZeuS Trojan and 20 other malicious bot programs from host PCs. “TDSS scans the registry, searches for specific file names, blacklists the addresses of the command and control centers of other botnets and prevents victim machines from contacting them,” wrote Kaspersky analysts Sergey Golovanov and Igor Soumenkov."

Makes it sound like a boon.

Spam volumes show massive drop - but why? >> The Register

guardiantech — 2011-06-30T20:48:18+00:00

"Spam levels have dropped massively in recent months, though researchers fear this is simply because botnet operators have switched their attention to more lucrative activities.
"Junk mail volumes - which reached 90% last summer - are down to 75% this summer, net security firm Symantec reports.
"The 15 percentage points drop in spam has led to a 60% decrease in total email volumes, helping reduce network congestion and server load in the process.
"Symantec reports that junk mail volumes that reached a high of 230bn spam messages per day in July 2010, 90% of all email traffic, are down to 39.2bn messages per day, 72.9% of all email."

Spam was 9 out of 10 - now it's only 3 out of 4! We're back to... 2001?

Why isn’t Amazon stamping out Kindlespam? >> John Naughton

guardiantech — 2011-06-27T22:00:00+00:00

"At first, I thought that Amazon’s rationale might be similar to the one Google takes on the issue of infringing or objectionable YouTube content: given that 48-hours’-worth of video is being uploaded every minute, it simply isn’t feasible to pre-scan stuff before it’s published. But Google will take it down on receipt of a complaint. That won’t get Amazon off the Kindlespam hook for two reasons: (1) Compared with video, pre-scanning of text is perfectly feasible, and computationally not that difficult; Amazon could easily do it. (2) Detection of infringing content in Kindlespam by rights holders is very difficult for the reasons outlined earlier, so while a take-down-upon-complaint policy is perfectly feasible, complaints will be much less frequent than they are on YouTube.
"So we’re left with a puzzle. Pre-scanning for crap, spam and infringing content in Kindlespam is perfectly feasible — and indeed only Amazon can do it effectively. Yet it does not do it. Why?"