CAUCE

The Criminals Behind WannaCry

359,000 computers infected, dozens of nations affected world-wide! A worm exploiting a Windows OS vulnerability that looks to the network for more computers to infect! This is the most pernicious, evil, dangerous attack, ever.

The Big One Wired pronounced.

"An unprecedented attack", said the head of Europol.

Queue the gnashing of teeth and hand-wringing!

Wait, what? WannaCry isn’t unprecedented! Why would any professional in the field think so? I’m talking about Code Red, and it happened in July, 2001.

Since then dozens, perhaps hundreds of Best Common Practice documents (several of which I’ve personally worked on) have been tireless written, published, and evangelized, apparently to no good effect. Hundreds of thousands, perhaps millions of viruses and worms have come and gone.

Our words ‘update your systems, software, and anti-virus software’ and ‘back up your computer’, ignored. The object lesson taught by Code Red, from almost sixteen years ago, forgotten.

Criminal charges should be considered: Anyone who administers a system that touches critical infrastructure, and whose computers under their care were made to Cry, if people suffered, or died, as is very much the possibility for the NHS patients in the UK, should be charged with negligence. Whatever ransom was paid should be taken from any termination funds they receive, and six weeks pay deducted, since they clearly were not doing their job for at least that long.

Harsh? Not really. The facts speak for themselves. A patch was available at least six weeks prior (and yesterday, was even made available by Microsoft for ‘unsupported’ platforms such as Windows XP), as was the case with Code Red.

One representative from a medical association said guilelessly, in one of the many articles I’ve read since Friday ‘we are very slow to update our computers’. This from someone with a medical degree. Yeah, thanks for the confirmation, pal.

The worm has been stopped from spreading. For now. iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com was registered by a security researcher, and sinkholed.

Sorry, forget it. I went for a coffee while writing this, and predictably WannaCry V2 has since been spotted in the wild, without the kill-switch domain left dangling.

What have we learned from all of this, all of this for a lousy $26,000?

If someone gets arrested and charged, and by someone, I mean systems administrators, ‘CSOs’ and anyone else in line to protect systems who abjectly failed this time, a lot. WannaCry infections to critical infrastructure are an inexcusable professional lapse. Or, we could just do all of this again, next time, and people may die.

Afterthought: My organization, CAUCE.org recently turned 20 years old. When it started, we didn’t believe things could get this bad, but it wasn’t too soon after that it became apparent. I issued dire warnings about botnets in 2001 to the DHS, I made public pronouncements to these ends in 2005 (greeted by rolled eyes from an RCMP staff sergeant). I may have been a little too prescient for my own good at the time, but can anyone really say, in this day and age, that lives are at stake, and we are counting on those responsible for data safety to at least do the bare minimum? I await your comments, below.

Follow-up-up To Loudmouths Wanted: Sorry, not sorry

In March, I posted a call to action to those of us in the community who have the inclination to fight against a movement to redact information critical to anti-abuse research. Today i felt compelled to react to some of the discussions on the ICANN discussion list dedicated to the issue of WHOIS reform: 

Sorry, not sorry: I work every working hour of the day to protect literally hundreds of millions of users from privacy violating spam, phish, malware, and support scams. 

 

Should access to WHOIS data be redacted in any way beyond what it is at present, my work will be made impossible. I spend 90% of my day in WHOIS data, the other 10% sculpting the data in a manner to provide reason and proof to hosting provider and registrars to take action against real-life criminals on their networks.

 

I also prepare cases for law enforcement to act upon. Contrary to popular belief in some quarters, LE cannot possibly begin to know about the stuff I (and my many, many colleagues) see, until we tell them.  That’s how it works. Any of the big botnet and crime ring take-downs and arrests you’ve ever seen have involved a public-private collaboration between individuals, researchers such ads myself, and law enforcement.

 

So, I’d like to issue congratulations to all those who want to redact. You will, without a single iota of uncertainty, will expose many more people to real – not potential or hypothetical –  privacy issues of a far more serious nature than you could possibly imagine, all in the badly mangled, misguided, and muddleheaded notion of what privacy actually is in the real world. ‘Cut off your nose to spite your face’ has never been more apt.

 

I hope you tell your Mom, family and your friends what you are trying to do here, while I spend my time trying to protect them from real evil: Revenge porn. Identity Theft. Plain old theft. Stalking. Photographic representation of the rape of children. Trolling, leading to the destruction of people’s lives. Emptied bank accounts.

 

Tell them you don’t want me to be able to do my job, and that you are trying to make it impossible, because you think access to the data that has been public and without challenge under the world’s privacy laws for twenty years is better off limited to the point of uselessness, sacrificed on some misshapen altar of privacy. 

 

If I sound angry at what you are attempting to do, then I’ve hit my mark. i am furious. The security sector is furious. We are terrified that you may have any degree of success in this regard, because you apparently don’t know, or don’t care what the actual results will be. Placating with ‘gated access’ means there will be some among my peers and colleagues, far more talented and effective than I, who simply cannot gain access, and the resulting mess will be on your head, and at risk of overstating my case, the blood on your hands.

 

So again, congratulations. Mother’s Day is coming up. Be sure to make mention of this in the card you send. Now, if you’ll excuse me, I’ll go back to diving in the data lake of WHOIS, trying to keep spam and far worse evil off’ve your network.

 

K bye tnx.

Neil Schwartzman

Executive Director

Coalition Against Unsolicited Commercial Email

http://cauce.org

Twitter : @cauce

 

LOUDMOUTHS WANTED FOR ICANN WHOIS Replacement Work

TL;DR? It’s worth reading, BUT, if not - ICANN has yet another group looking at WHOIS, and there is ahuge push to redact it to nothing. I spend easily half my day in WHOIS data fighting online crime, losing it would not make my job harder, it will make it impossible. 

PLEASE JOIN THE ICANN GROUP and help us fight back against people who are fighting in favour of crime. 

M3AAWG has submitted at least three comments in this regard, but that’s not how ICANN works, they consider numbers of submissions to be more important than who is making a statement. M3 with hundreds of member companies, counts for one vote.

Do it now; it is time for the security community to stand up strong to this nonsense. Thanks.

 

https://community.icann.org/display/gTLDRDS/Next-Generation+gTLD+Registration+Directory+Services+to+Replace+Whois

 

Thanks,

 

Neil Schwartzman

Executive Director

Coalition Against Unsolicited Commercial Email

 

Rant shared with permission:

Subject: 

ICANN WHOIS Replacement Work

Date: March 24, 2017 at 4:05:52 PM GMT-4

 

We have been trolling them with facts for a month now. I learned a lot about that group in that time. Here’s a blood pressure boosting wall-of-text rundown:

 

The group is a bunch of registrars and “right to be forgotten” privacy people. They want to kill DomainTools and all similar services. 

 

The "privacy" advocates want domain ownership to be anonymous without a court order. They have no concern about privacy violation caused by criminals. They don’t care that anonymous free speech is already available or that the domain system they are trying to create will be tremendously dangerous for dissidents and so forth to trust. They want to create privacy by forcing us to delete data we have collected from public sources. They are extremist fanatics with ideas unburdened by knowledge. People on this mailing list have done far more to protect privacy than these so called advocates.

 

And for the registrars, it appears they are intent on saving money as they don’t want to deal with the complaints or maintenance of whois. They seem uninterested in the fact that their small savings will cause huge losses for someone else. Some are dismissive of law enforcement, and some have spoken hostile words about Spamhaus, where the only other mouths I have heard such words from belonged to spammers. The arrogance from some of them is palpable.

 

I am not exaggerating. The list archives are public, and you should decide for yourself.

_______________________________________________________

 

I don’t want this to be an entirely negative reactionary issue. There are opportunities. If enough people *who actually use WHOIS and own domains* participate, we can make WHOIS better. 

• Have you ever been irritated with a bad domain that enjoys the benefits of WHOIS privacy? 
• Have you ever been irritated that a registrar makes you visit their website and answer a CAPTCHA to see the WHOIS record, only to find out their website is broken?
• Have you ever been irritated with a registrar that gives your search warrants the middle finger and discloses no whois?
• Have you ever been irritated with registrars that minimize their exposure on DomainTools(and other WHOIS archivers) so they can appeal to abusers?

 

If we don’t participate, the risk is that bad policy hurts the Internet while increasing the profit of a minority. It has happened before. Here are some past ICANN policy issues:

• the .ZIP TLD, apparently no one involved saw a potential problem, but they certainly saw profits
• An explosion in general of TLDs that increased profits for registrars, with few controls on price abuse to the benefit of registries and the expense of everyone else.
• Companies spending hundreds of thousands of dollars to get a TLD, and domains on new TLDs- to prevent anyone else from using their name.

 

Make no mistake, killing our visibility will reduce the money they spend on abuse complaints and subpoenas. It is insane that this minuscule industry dictates policy that increases risk for the global financial system.

 

_______________________________________________________

 

In case you didn’t see this, here is a list of quotes said in earnest by people who ICANN is taking policy input from. Feel free to cross reference them with the public archives, and you will see that they absolutely believe this, and that they dominate the conversation:

 

“Shit Registrars Say"

 

On defenders losing access to WHOIS:
"Buhu my work will get harder"

--

On law enforcement stating that access is crucial:
"Good thing that police are law "enforcement" not legislators. They can ask for anything they like, it is not like it has legal binding status. It is a wish list, nothing more..." 

--

Stepping on toes:
"Harvesting and storage of whois data to be re-wrapped and sold is illegal and many registrars state this on the terms and conditions.
[...]
storage of whois data is illegal unless it was for a lawful purpose and the only one I can think of is transfers. 
[...]
This will step on some registrars toes as well as [Brand Protection professional]'s toes who have a business model around the supply of whois data for commercial gain (namely charging for it)."

--

On the legality of Domaintools and WHOIS archives:
"Who says we need a Whois Archive? The GDRP have explicitly a section about the right to be forgotten, that will say all records deleted!

The way f.ex Domaintools operate today are not in the terms of a lot of whois providers conditions and in some cases illegal" 

--

On what you can do with WHOIS data you query:
"Depends on the terms you accept when you make the whois inquiry. You may be violating the terms of the registrar or registry providing the whois service. "

----------------------------

 

Feel free to share my observations with others(TLP:GREEN) because we should spread awareness. This is regulatory capture at significant expense to us but we can stop it. Participate, vote, and we can make ICANN great again.

 

You can join the ICANN working group via this page. There is no barrier to entry, no cost, and no minimum requirement beyond filling out a statement of interest. 

 

https://community.icann.org/display/gTLDRDS/Next-Generation+gTLD+Registration+Directory+Services+to+Replace+Whois

 

We’ve played bad cop/worse cop enough. Yall to show up and say something. Right now our community's concerns receive mockery and disrespect. You need more than one voice there. You need a multitude. These people need to become a minority.

Evangelizing Best Practices – Taking Operation Safetynet on the Road

The passing of J.D. Falk, five years hence

J.D., if nothing else, was all about the best practices, and standards. Today marks five years since he ambled off this mortal coil, leaving a hole in the hearts of friends and family, some published documents that bear his name, others his imprimatur, and a lasting impression upon we, his colleagues in the anti-abuse community. In other words, he made the difference we all aspire to.

[Author’s note: As I write this (October 23), the second massive denial of service attacks in two weeks, threatening to take down significant sections of the Internet has just ended. Could full implementation of Operation Safety net have prevented this? While technology on both sides, attackers and victims is constantly evolving, I am forced to say yes, OSN could readily have helped. – ns]

The M3AAWG/UCEnet (nee London Action Plan/CAUCE omnibus best practices document, entitled Operation Safety Net – Best Practices to Address Online, Mobile, and Telephony Threats has been a boon to government, industry, and end-users, and, to be honest, to me personally.

Cutting through the complicated techno-jargon too often bandied around in our industry, which serves to befuddle the audiences we must influence are we to affect the foundational changes needed to secure the net infrastructure, the 76-page report written by security experts from around the world was originally requested by the Organization for Economic Co-operation and Development in 2012, then updated in 2015.

As the lead author and shepherd André Leduc noted recently, "Translating our technical and engineering way of talking into plain language was probably the most important part of this work. We wanted to create a report that a security officer or an engineer could give to colleagues and management to help them understand cyber-attacks and why their organizations might be targeted. We also wanted to make it easy for government policy makers in both the developed and developing countries, where they may not have much technical experience, to take action."

André Leduc recently won the 2016 J.D. Falk Award, deservedly, for his work on this remarkable project.

I was on the small team along with former M3 Co-chair Alex Bobotek, and my long-time cohort CAUCE President John Levine who presented the first iteration to the OECD Consumer Safety Working Group in Paris.

After that, the real work began. While everyone at M3 knew about the document, that was kind of like preaching to the converted, and we needed to get the document out into the rest of the world, who were (and still are) blissfully unaware of the steps we all must take to batten down the hatches.

To make the best practice information more accessible, the report, originally published in English, has been translated into French and Spanish, as well as localized in summary form in Japanese and Thai. That’s where I come in.

One of the most delightful things I get to do these days is speak and train in various parts of the world, and OSN has been a foundational part of my materials since it was first published. I had the opportunity to facilitate inclusion of the document into the IGF’s Antispam Toolkit (although OSN deals with issues far more broadband than ‘mere’ spam) at the meeting in Joao Pessoa, Brazil. As well, through the help of the M3Anti-Abuse Foundation I presented the work to the African ISP association in Tunis, Tunisia, well as to a group of law enforcement officials in Thailand.

Working with M3AAWG organization Team Cymru, CAUCE sent me to present in Santiago Chile, again to law enforcement, and with partner organization World Hosting Days I put our work in from of hundreds of new and established hosting companies and registrars, in Singapore, and Bangalore, India.

This month I travel to Japan, to lay out the ground work to protectorates of critical infrastructure – Japanese (atomic) power companies want to know more, and better, how to protect themselves from simple vandalism, or, what could be far, far worse, to the point of being catastrophic.

As my colleague, friend, and CAUCE board member Kelly Molloy quipped ‘this is why spam matters’. Spam is a conveyance. Operation Safetynet, the solution

I just reviewed my memorial blogging at the time of J.D.’s death, I ended with this: "Simply put, honour his legacy by continuing it".

I’m so very glad to say so many are doing exactly that.

Canada's Anti Spam Law : Spam isn't Just Nigerian Princes & Body-part Adjustment

Long-time Anti-spammer & Publisher of MainSleaze Catherine Jefferson Discusses CASL and its Impact on Mainstream Marketers

In early December 2013 the Canadian government announced that the 2010 Canada's Anti-Spam Law (CASL) will go into effect on July 1, 2014. Although this law covers considerably more ground than just unsolicited bulk email (spam), it is very good news for those who fight spam, and especially good news for those of us who fight spam by otherwise legitimate companies. The reason? CASL requires (with some limited exceptions) that recipients of bulk email give explicit consent to receive the email before it is sent. In other words, CASL requires opt-in. Unlike the U.S. CAN-SPAM law and many other laws in many other countries, CASL actually forbids most spam.

CASL also has teeth. Violations of the CASL opt-in requirement can draw fines as high as $10 million Canadian per infringing email. By all appearances, the Canadian government agencies responsible for enforcement of CASL are prepared to enforce the law vigorously.

CASL applies to “criminal spammers” — the sorts of spammers that use botnets and compromised servers to advertise quack medications, controlled substances, fake luxury goods, or solicit help to move large sums of money out of Africa in return for an up-front fee. I do not expect CASL to be of much assistance reining in criminal spam, however, because I do not expect criminal spam gangs to obey CASL or pay CASL fines. Such spam gangs are often located in countries that offer them safe havens from law enforcement, and the identities of the people that run them are unknown. Other methods than CASL or anti-spam laws (such as blocklists, spam filters, and Interpol) are needed to fight that type of spam.

CASL also applies to what I call mainsleaze spammers — legitimate companies and organizations that use their own IPs or legitimate email service providers (ESPs) to offer legitimate goods and services. Legitimate companies sometimes break the law, but they do not often ignore it entirely. If prosecuted or sued, they and their attorneys normally appear in court to defend themselves. Legitimate companies also send a great deal of solicited bulk email mixed in with the spam, so IP or domain blocks and spam filters cause significant and sometimes-unavoidable false positives. Properly-written and properly-enforced anti-spam laws can target only the spam and be used to punish those who send spam without blocking email that people asked to receive.

A number of people with legal backgrounds have posted blogs detailing the provisions of CASL. I know spam better than I know the law, so I took a look at how this law might apply to a number of actual spams that I have received if either the sender or I were Canadian. Below I discuss four cases where one or more spams was sent either to my spamtraps or to a personal email address of mine. Each of the spams that I discuss was sent by a legitimate U.S.-based or multinational corporation via either their own IPs or a legitimate email service provider (ESP). 

• Telecommunications Giant: Selling Internet & TV Service: In October 2011, a U.S. telecommunications company spammed an email address at a domain of mine that has never had a legitimate email address, advertising its all-in-one TV and Internet package. This email violated CASL. If the company sends a similar email to a Canadian citizen after July 1, 2014 and the citizen reports it, they face a stiff fine.

• Social Networking Site: Sent Invitations to Non-Members. In early 2012 a large social networking site sent repeated invitations, and reminders, to an email address of mine that did not belong to that social network. After some pressure, the site added an opt-out mechanism, but to this day most social networking sites continue to send invitations to non-members. These emails violate CASL. If the company that spammed me continues to send invitations to Canadian citizen non-members after July 1, 2014 and one reports it, they face a stiff fine.

• Large Software Company: Selling its Newest Product. In late 2011 a major software company spammed a pristine spamtrap with an advertisement for the new release of its flagship product. The email violated CASL. If the company sends an email to a Canadian citizen after July 01, 2014 they face a stiff fine.

• Gourmet Food Company: “Opting-in” customers who previously opted out. I occasionally shop online at an internationally-known gourmet food company. When I first bought from them, I opted out of all offers after the first arrived in my inbox. Since then, I’ve shopped there four times. *Each* time I was opted back in and started to receive offers again, despite repeated opt-outs. As best I can tell, this practice violates CASL. If after July 01, 2014 the company continues to re-opt-in Canadian customers who opted out each time they place an order, they face a stiff fine, in addition to loosing customers. (I’ve found somewhere else to buy goodies.)

You would think that companies that obey the laws would also be open to appeals to ethics and simple good manners, but I have found that this assumption is incorrect entirely too often. The companies whose spam I discuss above generally respect the law. Nonetheless, all three of them also demonstrated a fundamental disrespect for the right of individuals to choose whether to receive that company’s email advertisements or not. Unlike many people, I know how to determine who sent me an email. I know who to complain to, and how to complain effectively. I also have a forum where I can complain and be heard: the Mainsleaze Spam Blog. That did not prevent two of these companies from spamming me repeatedly.

These spams illustrate the often-frustrating fact that the threat of loosing customers or potential customers is not enough to prevent some companies from spamming. Marketers assume that if they target their advertisements properly, most people that they target will want to receive their offers whether they asked for those offers or not. Many marketers are convinced (rightly or wrongly) that, if they spam, they will sell more goods and services than they will if they do not spam. VPs of marketing and CMOs who think this way often carry the day with company presidents and CEOs, who must answer to their boards of directors when profits or the company’s stock price drop.

Many ESPs have strong antispam policies. Some of these ESPs enforce those policies effectively and consistently. At the end of the day, though, all ESPs depend upon the companies that mail through them to keep them in business. So, when companies are under pressure to spam, their ESPs are under pressure to help them spam or at least to look the other way.

Fortunately good laws can bring their own financial pressures to bear. Legitimate companies do not like to pay substantial fines any more than individuals do. As the saying goes, $10 million here, $10 million there, and pretty soon you’re talking about real money. If companies and ESPs believe that they are likely to be prosecuted and face fines that top out at $10,000,000 Canadian dollars per email, most will stop spamming, even those who are otherwise willing to spam.

CASL also allows non-Canadians to complain about spam that they receive from a Canadian company, although it defers to the spam laws in the recipient’s country. Canadian investigators and prosecutors are expected to act on these complaints, extending the reach of CASL outside of Canada’s borders. As an American who deals with spam, I am most grateful to Canada for helping provide me a level of protection against being spammed by companies that my own government doesn’t, under CAN-SPAM.

CASL isn’t perfect. It has built-in grace periods for many opt-in requirements (see FAQ => About the Law => Regardless of the date set for coming into force, will there be a phase-in period for compliance…), periods that exempt mailers from the full rigor of those requirements for as long as three years in some cases. Given that the law was passed in 2010, I have to wonder whether mailers really need this much time to bring their practices into compliance with CASL. It shows too much respect for the much poorer antispam laws in other countries. It also exempts some political and non-profit organizations that I believe it should cover. As with all laws, its effectiveness also depends on how well it is enforced.

However, Canada’s Anti-Spam Law is far and away the best national anti-spam law that I’ve read yet. Kudos to the many legislators, legislative assistants, consulting attorneys, and (not least) antispam activists who made it happen.

Catherine Jefferson wrote the first spam-filtering software package, SpamBouncer in 1996.

33 Years of Spam? No, Not Really.

On May 3rd, 1978, a Digital Equipment Corporation (DEC) marketing representative named Gary Thuerk and a DEC engineer named Carl Gartley sent what many believe to be the first email spam. (The message was dated May 1st, but sent on May 3rd.) It advertised two events in California promoting the new DECsystem-20, the first DEC computer capable of connecting easily to the ARPAnet, predecessor to the internet. The message was addressed (by hand) to every ARPAnet user on the West Coast of the United States that they could find, but ran into an unexpected limit: the mail program would only accept 320 addresses. The rest of the addresses bled into the body of the message, and some recipients forwarded it on.

(Brad Templeton's mostly-outdated Essays on Junk E-mail includes a detailed history of the incident and reactions to it, based in part on a direct conversation with Thuerk himself.)

Scattered around the Internet today (and every May) you'll find various articles heralding the 33rd anniversary of spam, counting the years from Gary's message. They'll remark that spam has been with us a long time, maybe quote a few anti-spam vendor statistics, and say spam isn't going anywhere. But that's just bad research.

The ARPAnet and later the NSFnet were strictly non-commercial, both by contract and by social compact. Anyone who violated that got a stern talking-to, and could lose their access and get fired or expelled. So while there was indeed an occasional misstep, an occasional commercial message, they were very rare.

This changed in the mid-1990s, as the internet first became available to the general public. Commercial use was still hesitant, but increasing rapidly. Some of the early commercial users were entrepreneurs who are now considered geniuses; others were hucksters who are now in jail, or dead.

A common "get rich quick on the internet" scam was to sell books and kits for getting rich quickly on the internet. Often they were simply lists of ISPs by area code, some instructions paraphrased from The Internet for Dummies, and a few templates you could use to create your own web site. But there were also lists of email addresses and email blasting software — the unfortunate and unwelcome beginnings of both the email marketing industry and the ongoing malware epidemic.

Commercial use increased, and we have the internet we do today. Spam increased even faster. But that doesn't mean spam can't be controlled, and reduced. Every month there's another botnet taken down, another major bust by law enforcement — those used to happen maybe once a year, if we were lucky. There has never before in the history of the internet been so much focus on spam, malware, and other so-called "cybercrime" from so many different agencies, mostly (finally!) collaborating with each other. The internet won't return to the old, pre-commercial days, but it will get better.

And while it's true that the first bulk unsolicited commercial email was sent in 1978, there are stories of non-commercial mass messaging going back much further — such as the MIT user who transmitted, in 1971, the words "There is no way to peace. Peace is the way." Perhaps we should consider that the first Tweet?

Yes, People Still Care About Email Spam

Just over a month ago, we posted an article entitled "Do People Still Care About Email Spam Anymore?". Part of the reason why people might not care anymore, according to this article, is that email has become passé. With so many other new ways to communicate, why even bother with email?

Not only did a few readers take the time to post some compelling counter-arguments to our article, even muckraking marketing columnist Ken Magill has weighed in on the debate. Citing a few recent studies — including a finding by the Pew Internet & American Life Project that email is still the No. 1 online activity across all age groups of internet users — Magill goes so far as to advocate a pretty hefty dose of harassment for the next person who states in public that email is dead.

According to The Radicati Group, there are currently 1.4 billion email users. A study by Nielsen found that 25 minutes out of every hour spent on a mobile device is on email. And so on.

There are reasons why email is still so popular. It is easy to use, it is (relatively) private, and it is accepted across generations and for personal and business purposes alike. You don't need a special 'app' to use it, and neither do you have to enlist with an online "community" (yes, there are still people out there who don't want to be a part of Facebook!). While most of us in the online business world are keen to broadcast our thoughts to the world via Facebook, Twitter, and whatever, there are still many people who just want to have a good old fashioned one-on-one email conversation.

And so it's pretty clear: email still matters. And, because email matters, spammers still take advantage of it. And for that reason, people still care about old-fashioned email spam. They have to.

As one commenter noted, spam is still widely used by scam artists to get their dirty hands into our private lives, and, ultimately, our bank accounts. People are still getting ripped off by spammers - whether it be through malware, phishing, fake pharmaceuticals, or whatever — and, undoubtedly, these people still care.

Another comment pointed out that, even for those of us who think that spam isn't a problem because filters manage to keep most spam from our inboxes, the cure is occasionally worse than the disease. Regardless of how good spam filtering has become, false positives will always be a problem. For anyone who has ever lost out on an important business opportunity (or maybe even a hot date) because their email didn't make it to the intended recipient, they care about spam. If it weren't for spam, we wouldn't need spam filters, and we wouldn't have to worry about legitimate emails getting hijacked on their way to the inbox.

Parents are concerned about sexually explicit messages popping up (no pun intended) in their kids' inboxes. Legitimate marketers are concerned about having to compete with spammers for space in their customers' inboxes, and the ever-present risk that their messages might be labelled as spam too. And the Nigerian government is concerned about former diplomats and members of the royal family using spam to collude with total strangers to steal millions of dollars from the government's coffers (ok, just kidding).

When people stop using email, then spammers will stop sending spam through email. Then people will stop caring about email spam. Let me know when that happens.

Some readers may wonder why an organization that advocates against spam would even ask this question. We really just wanted to see what people would say. CAUCE still thinks email is important, and spam a very real problem. And apparently at least a few really smart people agree. Let's declare this debate closed - at least for the time being.

(This article was written by a different CAUCE supporter who wishes to remain anonymous.)

Do People Still Care About Email Spam Anymore?

This may seem like a strange question for an anti-spam organization to ask.

CAUCE obviously still cares about email spam, and always will, but does anyone else?

If you talked to your friends or relatives over the holidays and asked them about the amount of spam they get in their inboxes, most of them may tell you that they rarely see it (even basic spam filtering on free email accounts has gotten pretty good).

When you talk to some younger people about email spam, be prepared for them to laugh.

They'll tell you that when they need to communicate, they'll usually use some sort of instant messaging, or maybe send text messasges from their Blackberry or their iPhone. Email just isn't relevant to them any more. ("Sheesh! What will you ask about next? Faxes? Telegrams? Papyrus? Stone tablets? Get with the modern era! Who cares about stupid email?")

For all those sort of users, email is about as relevant as horse-drawn buggies. Email is archaic. They don't care about email, much less email spam.

Other users may tell you that they do care about unsolicited email, but if you probe a little, you'll find that they really only care about certain types of "spam." Everyone hates spam that might infect their computer with a virus or other malware, and many may find it creepy to get personalized phishing messages, but we empirically know that most spam doesn't contain malware or phishing-related content.

In fact, we even find ourselves wondering about email spammers themselves.

Do any smart spammers still care about email spamming? When's the last time you saw anything even relatively creative when it came to spam? I remember being impressed the first time I saw randomized image spam, and fast flux web hosting, but since then I haven't seen a whole lot in the way of spam-related developments that are very technically impressive. (I think this may be evidence that the smart spammers have already moved on to greener and more lucrative cyber crime fields.)

Image by Getty Images via @daylife

Sending email spam has acquired an increasingly last-decade (or last-century!) sort of feeling, sort of like being a person from the Eastern Bloc still proudly driving a rattle trap Trabant. The world's moved on, even if a few Communist-era fossils haven't.

True, there are some back-of-the-pack guys who are still sending cliché spam for illegal pharmaceuticals and quick-to-break knock-off watches or untrustworthy casinos.

I'm sure it's partially a matter of intertia. If sending email spam using someone else's seldom-updated and easily detected spamware is all you really know how to do, well, I suppose that's what you're going to keep doing, even if it doesn't pay nearly as well as it used to. You're trapped in a dead end job, just like a soon-to-be unemployed factory worker who never got retrained for the the modern era.

In fact, it must be sort of depressing to be a professional email spammer. As a professional email  spammer, you really only have two career tracks: mediocrity or infamy.

If you work really hard and end up being one of the rare persons who excels at email spamming, your success virtually guarantees that you'll be the focus of undesirable attention from law enforcement. They can't go after everyone, so they understandably like to use what resources they do have to target the rare "spam king" -- someone like you.

And then there's all the waiting. Law enforcement may not work fast, but boy oh boy, some of those guys are pretty dang dogged once they get on your trail. It may take them years and years to get all the paperwork lined up, but these are very patient guys. They will eventually get all the evidence they need, and then they will reach out and arrest you, sometimes just when you're getting ready to retire somewhere nice and warm.

As a spammer, you do have options. You could intentionally try to "stay small scale" and thus stay off law enforcement's radar, but if you do, is small scale email spamming even really worth it?

See what I mean when I ask, "Do people really even care about email spam anymore?"

 

(This article was contributed by a long-time CAUCE supporter who wishes to remain anonymous.)

Kidnapping, Theft and Rape Are Not "Cyber" Crimes

Kidnap. Rape. There are no lesser words that can be used to describe what happened to the daughter of an anti-spam investigator in Russia.

His daughter was recently released, according to Joseph Menn’s recent article on Boing Boing, after having been kidnapped from her home five years ago, fed drugs, and made to service men, as a warning to ward off further investigations.

The criminals behind these vicious acts were also responsible for large spamming organization associated with Russian Mob activity.

Note that we say "also."

When someone is mugged, harassed, kidnapped or raped on a sidewalk, we don't call it "sidewalk crime" and call for new laws to regulate sidewalks. It is crime, and those who commit crimes are subject to the full force of the law.

For too long, people have referred to spam in dismissive terms: just hit delete, some say, or let the filters take care of it. Others — most of us, in fact — refer to phishing, which is the first step in theft of real money from real people and institutions, as "cyber crime." It's time for that to stop.

Some of these crimes involve technology. So what? Criminals have used technology before.

Some of these crimes cross borders. So what? Crimes have crossed borders before.

Spam isn't illegal everywhere yet. So what? Spam 2.0 (spam, malware & spyware) is the leading edge of far worse activities, often things that have been illegal as long as we've had laws.

It is high time that governments and law enforcement stop thinking of computer crime as that perpetrated by teenagers in their parent’s basement. It is the Russian Mob and other organized criminals that are doing this.

While we are at it, we should mention ‘cyber-warfare’, something too often conflated with cyber-crime. Cyber-crime is not "cyber-warfare.” There may be state or terrorist agencies copying the tactics and methods of these criminals, but that does not mean that the criminals must be left alone until new cyber-warfare agencies have been created and funded.

As Purdue computer science professor ‘Spaf’ Spafford was recently quoted as saying in a note-worthy piece ‘Cyberwar Vs. Cybercrime’ on the GovInfo Security blog

"Why aren't we seeing the investment and prioritization being made in law enforcement, first? Why is all the publicity, funding and prioritization being given to the military - with efforts such as the build-up of the military cyber command - when so much of the clear and present threat is from the criminal element and not from other nation-states?"

Just so, Prof. Spafford!

As we have said repeatedly on this site, these are criminal gangs who have found an incredible loophole in the justice systems of the world: they can rob banks and people, with little chance of getting caught, let alone going to jail. This is not because they're doing things that aren't illegal; they've just found a new way to hide.

David Black, manager of the RCMP's cyber infrastructure protection section recently said to CAUCE Executive Director Neil Schwartzman “we don’t do spam”. OK, but why not? Spam is no longer, and hasn’t been for some time, about simply sending unwanted emails. Spam is now a delivery mechanism for malware, which in turn threatens infrastructure, and facilitates theft. We have seen precious few cases filed using existing Federal computer intrusions laws in Canada, and none, to our knowledge have been filed under the renovated anti-phishing law, S-4, passed in September 2009.

Governments and law enforcement agencies need to begin to treat online theft with the same seriousness as they do other physical crimes. It is time to bring this up to the diplomatic level, or seriously consider refusing packets from places that treat the Internet, and innocent victims, as their personal ATM.

CAUCE is made up of people who care about email qua email. We understand it, we love it. It is still the ‘killer app’. Furthermore, we understand why some folks in law enforcement or the judiciary might ask, "When there are people stealing millions or hurting people in the commission of violent crimes, why are you wasting our time with 'just' a spam case?” Here's why:

1. Most spam is sent by organized criminal gangs, just like other organized crime.
2. Those gangs intentionally operate trans-nationally, in an effort to frustrate investigation and prosecution.
3. Money laundering of the proceeds from spam is routine, and that money directly fuels official corruption and other social ills.
4. Some spammers are actually selling something. Their favorite product? Counterfeit pharmaceuticals. In many cases these may be scheduled controlled substances, sold in bulk, and available to minors; in other cases, critical medicines needed to properly treat cancer and other serious illnesses may be counterfeit placebos, with potentially tragic results.
5. Spammers operate by compromising tens or hundreds of thousands of end-user PCs, violating those users' privacy and sometimes steal sensitive personally identifiable information such as individuals’ and even corporate access to financial services at the same time they're using their systems to spam. Computer ‘phishing’ is no less a crime than bank robbery, home invasion, and mugging.

Cyber criminals consider cyber crime to be a virtually riskless offense; they're unlikely to be identified; if identified, they're unlikely to be investigated; if investigated, they're unlikely to be charged and prosecuted; if prosecuted, they're unlikely to be convicted; if convicted, they're unlikely to do jail time.

The courts need to make it clear that that's wrong in all respects. If you commit cyber crimes, you will be identified, investigated, charged, prosecuted, convicted and sentenced to serious time and we will seize your assets.

This will not happen so long as crime, which involves the Internet, is dismissed as "cybercrime" and either scoffed at, or used to justify ever-increasing cyberwarfare budgets

This isn't just email. This isn't a war. This isn't "cyber.” This is crime. It is time to call a cop, and expect a response.

 

by CAUCE Executives J.D. Falk & Neil Schwartzman

Who Are Domain Names For?

Last week, the Libyan government seized and disabled Violet Blue's "sex-positive" vb.ly URL shortener. I've discussed URL shorteners before, but what does Libya have to do with it?

Actually, that part's pretty simple. The .LY domain belongs to Libya, so their laws apply -- even if the registrant or their web site isn't physically in Libya. The company which manages registrations in .LY decided to permit registrations by companies or people outside of Libya, but they still own it.

Originally there were only a handful of "global" or "generic" top-level domains, known as gTLDs, available to anyone in any country: .COM, .NET, .ORG, and .EDU. .GOV and .MIL were effectively only for the United States. .INT, reserved for organizations created by international treaty, is rarely seen.

Each country has their own ccTLD, based on the ISO two-letter country codes. Some are fairly obvious to English speakers: .US for the United States, .CA for Canada, .UK for the United Kingdom, .AU for Australia. Some seem a bit more obscure, due to differences in language or conflicts with other names: .TD for Chad, .RS for Serbia, or .ZA for South Africa.

Each ccTLD authority sets their own rules for who is allowed to register one of their names. Island nations Tongo (.TO) and Tuvalu (.TV) have reportedly made some pretty good money by permitting non-local registrations. After splitting from Yugoslavia (.YU) and Serbia, Montenegro opened .ME in hopes of attracting English speakers -- and sold over 320,000 domains between 2008 and 2010. Colombia's .CO, which attracts typos of .COM, sold half a million in two months -- mostly to registrants in the United States.

But none of this addresses the real question: what do actual users care about?

In March the most popular search term on Google, Yahoo!, and Bing was "facebook". Other top searches across all three, according to Experian Hitwise, included youtube, myspace, craigslist, ebay, and gmail. Perhaps ironically, "google" was the second most popular search on Microsoft's Bing.

Does it matter whether Facebook is facebook.com, fb.me, facebook.ca, facebook.co.za, et cetera? Well, unfortunately, it kind of does. If a bad guy registered facebook.ql (which is just an example, there's no .QL ccTLD), then they could put up a site that mimics the real Facebook, and send phishing email which might have a better chance of fooling users than the usual nonsense domains. And, of course, there are the usual trademark issues. So, Facebook has had to register in all of these.

To put it another way: big brands are effectively required to register their trademark in every gTLD and ccTLD they can, because most users are completely unaware of gTLDs and ccTLDs. If the TLDs effectively separated different types of organizations, as was originally imagined, then this wouldn't be necessary.

There's also another type of user to consider. Violet Blue chose to register vb.ly because she wanted something short and easy to remember, and was following the trend set by bit.ly, jl.ly, et cetera. Unlike .ME or .TV the value wasn't that vb.ly has any particular meaning, but rather that it's short and appeared to be easy. URL shorteners are for the people who don't type "facebook" into google, and do want to share links to specific things. Of course, if web designers considered the length of URLs when designing their sites, this wouldn't be as much of an issue.

ICANN, the quasi-non-governmental organization which oversees these top-level domains, has introduced quite a few other gTLDs in recent years. Many of these are restricted in some fashion, which helps to reduce the land rush; for example, .MUSEUM is only for museums, though of course most museums already have domains under .ORG, .EDU, .GOV, or an appropriate ccTLD.

Only two of the newer gTLDs are unrestricted: .INFO, and (for most purposes), .BIZ. When was the last time you saw a company put their primary site in .BIZ or .INFO, rather than having it be a redirect to their site in .COM? Oh hey, it was Return Path -- and we switched a few years ago to returnpath.net, because most of our neighbors in .BIZ were spammers or phishers. .INFO has the same spam problem; some spam filtering software sees the mere presence of .BIZ or .INFO as increasing the likelihood that a message is spam.

Ignoring these concerns, ICANN has decided to open up the namespace further and permit pretty much anyone with $185,000 and a bunch of nameservers to register their own gTLD -- likely before next March. It's unclear if anyone actually wants this except the potential new gTLD registries, who stand to earn a lot of money over trademark concerns. For example, the .CO registry initially offered a "Specially Protected Marks" program, permitting companies to register their trademarks ahead of the general populace. .CO claims "100% Participation by Leading Brands", and any new unrestricted gTLDs can surely expect the same.

Even if a company creates a new gTLD for their own use, such as .IBM, they'll still need to keep ibm.com, lotus.com, et cetera -- everything they have now, plus the same trademarks in every other gTLD.

Once all that dust has settled, and the registries and ICANN have made their money, we'll still be left with an ever-greater threat of phishing or other brand hijacking. Most end users will still expect to find their friends by typing "facebook" into google, while a smaller number will still want shorter URLs.

If domain names are for end users -- if, indeed, the internet is for end users -- then why do we need more TLDs?

(This article was originally published on The Received: Blog, and has been reproduced here with permission from from Return Path.)