CAUCE

Phishing Landscape 2020: A Study of the Scope and Distribution of Phishing

 

Greg Aaron, Lyman Chapin, Dr. Colin Strutt and CAUCE Board Member David Piscitello, all of the Interisle Consulting Group, today announced the publication of the seminal report Phishing Landscape 2020: A Study of the Scope and Distribution of Phishing.

The report can be found at http://www.interisle.net/PhishingLandscape2020.html

The goal of the research was to capture and analyze a large set of information about phishing attacks, to better understand how much phishing is taking place and where it is taking place, and to see if the data suggests better ways to fight phishing. The group studied where phishers are getting the resources they need to perpetrate their crimes — where they obtain domain names, and what web hosting is used. This analysis helps identify where additional phishing detection and mitigation efforts are best deployed at vulnerable providers the research helped identify.

To assemble a deep and reliable set of data, the researchers collected URLs, domain names, IP addresses, and other data about phishing attacks from four widely used and respected threat data providers: the Anti-Phishing Working Group (APWG), OpenPhish, PhishTank, and The Spamhaus Project. (The authors wish to express their appreciation of the cooperation extended to them by these providers).

Over a three-month collection period, they learned about more than 100,000 newly discovered phishing sites.

These are the major findings and conclusions are based on the data collected:

1. Most phishing is concentrated at small numbers of domain registrars, domain registries, and hosting providers.
2. Phishers themselves register more than half of the domain names on which phishing occurs.
3. Domain name registrars and registry operators can prevent and mitigate large amounts of phishing by finding and suspending maliciously registered domains.
4. Registries, registrars, and hosting providers should focus on both mitigation and prevention.
5. The problem of phishing is bigger than is reported, and the exact size of the problem is unknown.
6. Sixty-five percent of maliciously registered domain names are used for phishing within five days of registration.
7. New top-level domains introduced since 2014 account for 9% of all registered domain names, but 18% of the domain names used for phishing.
8. About 9% of phishing occurs at a small set of providers that offer subdomain services.

Characterizing Robocalls through Audio and Metadata Analysis

CAUCE mainly focuses on abusive messaging, but our board has a wide and diverse background in anti-abuse efforts.

 

Recently we came across this presentation on abusive robocalls dealing with an increase in Robocalling, trends in abusive calls, who is calling and who is being targeted. This study took place in 2019 and lasted most of the year. 

Authors:
Sathvik Prasad, Elijah Bouma-Sims, Athishay Kiran Mylappan, and Bradley Reaves, North Carolina State University

Source: https://www.usenix.org/conference/usenixsecurity20/presentation/prasad

RIP Don Blumenthal

It is with a heavy heart that we note the passing of dear friend, colleague and member of the CAUCE board board of directors, Don Blumenthal on September 28, 2019 in Ann Arbor, Michigan. He was 67.

Don was an anti-spammer for as long a there was an anti-spam community: he helped design, deploy and maintain the famous ‘Spam Fridge’, the repository of junk email maintained by the Federal Trade Commission (FTC). He contributed the wisdom he gleaned from that experience to the design process of Canada’s Spam Freezer.

 

 

Don Blumenthal later worked at the Public Interest Registry (PIR.org) maintaining anti-abuse work for the .ORG TLD

Don was a welcome, active participant to the Anti-Phishing Working Group (APWG.org), at the meetings held by the Messaging Anti-Abuse Working Group (M3AAWG.org), the Internet Corporation for Assigned Names and Numbers (icaan.org) and, of course, he was a long-time board member of the Coalition Against Unsolicited Commercial Email (CAUCE.org).

His interests also lay outside the realm of anti-abuse work, Don was a football scout for the Oakland Raiders.

Don Blumenthal worked tireless to make the Internet a better place, had a considerable degree of success doing so, and he will be sorely missed by us all. Simply put, he was a tremendously nice guy.

Rest in peace, Don.

Protecting yourself from Vishing

Many people are very trusting when they receive phone calls claiming to be from their bank, credit card company, or ISP.  However, scam phone calls are becoming more and more common every day. From the IT Support phone calls about a computer virus, or a call from your local cable company that is providing a new customer deal that is too good to be true (but are secretly trying to steal your account credentials) we are all encountering these more and more often.

As a consumer, you need to protect yourself and challenge anyone calling you so they are forced to validate who they are before you give them any information.

This is the summarized transcript from a call I had just this morning with "a representative" claiming to be from American Express* but being unwilling to validate that they were actually calling from the credit card company.

Caller: Hello, This is [Female name I missed] from American Express, is this "My Name"?

Me: Yes

C: I'm calling about an offer we sent you in the mail, did you get it?

M: What was the offer concerning?

C: If you could just validate some information I could explain the offer...

M: Sure - Can you please validate you're Amex first, then I'll validate who I am...

C: Sir, I need to validate who you are before we continue...

M: Before we continue I need you to validate you're actually Amex.

C: I don't understand what you're asking? I'm just calling to talk about an offer we sent you.

M: Great, tell me about this offer.

C: Sir, I just need to validate you're who you say you are.

M: Great, please validate that you are Amex first.

C: Sir, Please validate your DOB.

M: You called me, and I said hello and yes that's who you've reached. Please validate you're Amex.

Repeat the last 7 lines a few times and then I got tired of the conversation, said goodbye and hang up the phone.

As a consumer frequently targeted by Phone scams, it's time to start taking a stand against these phone calls and force companies to validate who they are before giving away you personal information. Companies will need to adapt to a smarter, more suspicious consumer that is looking to protect their identity.

* Maybe it actually was Amex, but they failed to validate this to me and the call ended. 

 

CRTC Do Not Call List (Canada)

FTC Do Not Call List (United States)

 

LOUDMOUTHS WANTED FOR ICANN WHOIS Replacement Work

TL;DR? It’s worth reading, BUT, if not - ICANN has yet another group looking at WHOIS, and there is ahuge push to redact it to nothing. I spend easily half my day in WHOIS data fighting online crime, losing it would not make my job harder, it will make it impossible. 

PLEASE JOIN THE ICANN GROUP and help us fight back against people who are fighting in favour of crime. 

M3AAWG has submitted at least three comments in this regard, but that’s not how ICANN works, they consider numbers of submissions to be more important than who is making a statement. M3 with hundreds of member companies, counts for one vote.

Do it now; it is time for the security community to stand up strong to this nonsense. Thanks.

 

https://community.icann.org/display/gTLDRDS/Next-Generation+gTLD+Registration+Directory+Services+to+Replace+Whois

 

Thanks,

 

Neil Schwartzman

Executive Director

Coalition Against Unsolicited Commercial Email

 

Rant shared with permission:

Subject: 

ICANN WHOIS Replacement Work

Date: March 24, 2017 at 4:05:52 PM GMT-4

 

We have been trolling them with facts for a month now. I learned a lot about that group in that time. Here’s a blood pressure boosting wall-of-text rundown:

 

The group is a bunch of registrars and “right to be forgotten” privacy people. They want to kill DomainTools and all similar services. 

 

The "privacy" advocates want domain ownership to be anonymous without a court order. They have no concern about privacy violation caused by criminals. They don’t care that anonymous free speech is already available or that the domain system they are trying to create will be tremendously dangerous for dissidents and so forth to trust. They want to create privacy by forcing us to delete data we have collected from public sources. They are extremist fanatics with ideas unburdened by knowledge. People on this mailing list have done far more to protect privacy than these so called advocates.

 

And for the registrars, it appears they are intent on saving money as they don’t want to deal with the complaints or maintenance of whois. They seem uninterested in the fact that their small savings will cause huge losses for someone else. Some are dismissive of law enforcement, and some have spoken hostile words about Spamhaus, where the only other mouths I have heard such words from belonged to spammers. The arrogance from some of them is palpable.

 

I am not exaggerating. The list archives are public, and you should decide for yourself.

_______________________________________________________

 

I don’t want this to be an entirely negative reactionary issue. There are opportunities. If enough people *who actually use WHOIS and own domains* participate, we can make WHOIS better. 

• Have you ever been irritated with a bad domain that enjoys the benefits of WHOIS privacy? 
• Have you ever been irritated that a registrar makes you visit their website and answer a CAPTCHA to see the WHOIS record, only to find out their website is broken?
• Have you ever been irritated with a registrar that gives your search warrants the middle finger and discloses no whois?
• Have you ever been irritated with registrars that minimize their exposure on DomainTools(and other WHOIS archivers) so they can appeal to abusers?

 

If we don’t participate, the risk is that bad policy hurts the Internet while increasing the profit of a minority. It has happened before. Here are some past ICANN policy issues:

• the .ZIP TLD, apparently no one involved saw a potential problem, but they certainly saw profits
• An explosion in general of TLDs that increased profits for registrars, with few controls on price abuse to the benefit of registries and the expense of everyone else.
• Companies spending hundreds of thousands of dollars to get a TLD, and domains on new TLDs- to prevent anyone else from using their name.

 

Make no mistake, killing our visibility will reduce the money they spend on abuse complaints and subpoenas. It is insane that this minuscule industry dictates policy that increases risk for the global financial system.

 

_______________________________________________________

 

In case you didn’t see this, here is a list of quotes said in earnest by people who ICANN is taking policy input from. Feel free to cross reference them with the public archives, and you will see that they absolutely believe this, and that they dominate the conversation:

 

“Shit Registrars Say"

 

On defenders losing access to WHOIS:
"Buhu my work will get harder"

--

On law enforcement stating that access is crucial:
"Good thing that police are law "enforcement" not legislators. They can ask for anything they like, it is not like it has legal binding status. It is a wish list, nothing more..." 

--

Stepping on toes:
"Harvesting and storage of whois data to be re-wrapped and sold is illegal and many registrars state this on the terms and conditions.
[...]
storage of whois data is illegal unless it was for a lawful purpose and the only one I can think of is transfers. 
[...]
This will step on some registrars toes as well as [Brand Protection professional]'s toes who have a business model around the supply of whois data for commercial gain (namely charging for it)."

--

On the legality of Domaintools and WHOIS archives:
"Who says we need a Whois Archive? The GDRP have explicitly a section about the right to be forgotten, that will say all records deleted!

The way f.ex Domaintools operate today are not in the terms of a lot of whois providers conditions and in some cases illegal" 

--

On what you can do with WHOIS data you query:
"Depends on the terms you accept when you make the whois inquiry. You may be violating the terms of the registrar or registry providing the whois service. "

----------------------------

 

Feel free to share my observations with others(TLP:GREEN) because we should spread awareness. This is regulatory capture at significant expense to us but we can stop it. Participate, vote, and we can make ICANN great again.

 

You can join the ICANN working group via this page. There is no barrier to entry, no cost, and no minimum requirement beyond filling out a statement of interest. 

 

https://community.icann.org/display/gTLDRDS/Next-Generation+gTLD+Registration+Directory+Services+to+Replace+Whois

 

We’ve played bad cop/worse cop enough. Yall to show up and say something. Right now our community's concerns receive mockery and disrespect. You need more than one voice there. You need a multitude. These people need to become a minority.

"Spam King" Sanford Wallace finally goes to jail

Sanford Wallace has been sending spam for over 20 years. Despite losing innumerable lawsuits, he's managed to stay out of jail until now. His luck finally ran out, in a case where he was convicted of contempt of court and hacking many Facebook users.

Laura at Word to the Wise wrote about how Spamford's mail got her into spam fighting in the 1990s.

Article at The Register

The Case of Spamford Wallace: Guilty at Last!

My anti-spam community friends were all abuzz today with the news that Spamford Wallace had pleaded guilty in a Las Vegas court to "compromising approximately 500,000 Facebook accounts" in order to deliver "more than 27 million spam messages."

What might amaze the General Reader is that this is the SAME Spamford Wallace case that began with an indictment on July 6, 2011.

 

According to the Indictment, Wallace created an account on November 4, 2008 under the name "David Frederix" and then tested posting spam messages to his 'real' wall "Sanford MasterWeb Wallace" experimenting with which posts would best evade Facebook's filters.

 He then made a script that would automate the process of logging in to a Facebook account, obtaining a list of all of the Friends of that account, and then posting his advertising message to each of those friends' walls.  Spamford then created a domain registrar account at Moniker Online and another at Dynadot (using the name Laura Frederix) and between the two created 2,500 domain names that would be used in these spamming attacks against Facebook users.

 On November 5 and 6, 2008, Sanford sent approximately 125,000 spam messages to Facebook users using this method.  On December 28, 2008, another run was made, posting nearly 300,000 spam messages, by logging in through 143 different IP addresses that were used as proxies to disguise his origins.  On February 17, 2009, another 125,000 messages were posted.

 At this point, a civil injunction was served on Sanford Wallace in the case of Facebook Inc v. Sanford Wallace (Northern District of California No 09-00798 JF) where Judge Jeremy Fogel ordered Sanford Wallace to no longer access Facebook's computer network.  (Orders issued on March 2, 2009 and March 24, 2009).  Sanford logged in on April 17, 2009, in violation of this order, while flying on a Virgin Airlines flight  from Las Vegas to New York.

 In 2011, Sanford was back on Facebook, using a profile called "David Sinful-Saturdays Fredericks"

 Counts 1,3, 7 - Fraud and Related Activity in Connection with Electronic Mail, carry a possibility of 3 years imprisonment.

 2, 6, and 9 - Intentional Damage to a Protected Computer, carries a maximum sentence of 10 years imprisonment.

 4, 5 and 8 - Fraud and Related Activity in Connection with Electronic Mail, carries a 3 year imprisonment possibility, and a possible $250,000 fine.

 Counts 10 and 11  - Criminal Contempt, have unspecified potential penalties.

 What's Happened Since?

Lots and lots of lawyering. . . behold the process of a Fair and Speedy Trial!!!!

• 04AUG2011 - the indictment was unsealed
• 04AUG2011 - notice of related cases was received.  These included:

1. the case of Facebook v. Sanford Wallace, Adam Arzoomanian, Scott Shaw, and John Does 1 through 25, for Violation of the CAN-SPAM ACT, violation of the Computer Fraud and Abuse Act, Violation of the California Business Code Section 229489 AKA the California Anti-Phishing Act, and Violation of California Penal Code section 502, the California Comprehensive Data Access and Fraud Act.  That case describes:  "At least one of the Defendants, Sanford (aka "Spamford") Wallace, is a notorious Internet scam artist who has been involved in various illegal spamming and malware activities since the mid 90s.  Indeed, Mr. Wallace has both Federal Trade Commission and civil judgements against him for these activities that total in excell of $235 million."  Myspace, Inc. v. Wallace; FTC v. Seismic Entertainment Prod., Inc; CompuServe v. CyberPromotions, Inc (Ohio, 1997)
2. This case resulted in a Default Judgement in favor of Facebook signed by Judge Jeremy Fogel on 29OCT2009. 

• 22AUG2011 - bail hearing
• 28SEP2011 - case reassigned to a new Judge (Judge D. Lowell Jensen)
• 30SEP2011 - Order to Waive Appearance proposed )amd gramted_
• 03OCT2011 - Status hearing held
• 04OCT2011 - case reassigned to Judge Edward J. Davila
• 31OCT2011 - Pretrial services form 8 submitted.
• 28NOV2011 - Status hearing held
• 09JAN2012 - "Fair and Speedy Trial Act" exemption requested due to AUSA Attorney being engaged in another trial, and for additional time for the defendant's need for effective preparation of counsel. "The ends of justice served by granting the requested continuance outweight the best interest of the public and the defendant in a speedy trial." - extension granted until 09APR2012.
• 02APR2012 - extended to 07MAY2012 by mutual consent.
• and again to 06AUG2012, and again to 01OCT2012, and again to 19NOV2012
• Status hearings held 14JAN2013, 11MAR2013
• 11MAR2013 - hearing grants a modification to pretrial release conditions to allow Spamford to travel to Albuquerque, New Mexico for work.
•  More delays 31MAY2013, 08AUG2013, 20SEP2013, in each case ordering that time be "excluded" from consideration in the Fair and Speedy Trial Act to allow for effective preparation for the case.
• 02NOV2013 - Sanford's attorney (K.C. Maxwell) files a sealed document asking to be relieved from the case 09DEC2013.
• Extension granted to 03FEB2014
• 17MAR2014 set as the date to hear the Motion to Withdraw as Counsel.
• Continued to 31MAR2014, when Wallace assigns his new counsel, William W. Burns, Esquire.
• 25JUN2014 new counsel asks for more time to prepare
• 18JUL2014 William Burns petitions the court to withdraw as counsel
• 21JUL2014 Burns Relieved
• 21JUL2014 a Financial affidavit is delivered to the court pertaining to Spamford Wallace
• 01AUG2014 - "The individual named above as defendant, having testified under oaht or having otherwise satisfied this court that he or she (1) is financially unable to employ counsel and (2) does not wish to waive counsel, and because the interests of justice so require, the Court finds that the defendant is indigent, therefore, IT IS ORDERED that the attorney whose name, address and telephone number are listed below is appointed to represent the above defendant." (Wm. Michael Whelan, Jr. / 95 South Market St, Ste 300 / San Jose, CA 95113 / (650) 319-5554 cell)
• 19AUG2014 - time extended to allow Whelan to prepare
• 22SEP2014 Status conference held, Jury Trial date set for 05MAY2015 through 22MAY2015.
• 29SEP2014 Whelan petitions the court that drug testing no longer be required since Sanford has never tested positive. (Granted 15OCT2014)
• 02MAR2015, status hearing extends case until an 08JUN2015 status hearing
• 12JUN2015 - new financial affidavit entered under seal
• 30JUN2015 - a change of plea hearing is requested for 27JUL2015
• 24AUG2015 - Sanford Wallace pleas guilty to a single count - Count 3.  Sentencing scheduled for 07DEC2015 at 1:30 PM

 Guilty of Count Three

So, if we go back to the indictment, what does this mean that Sanford has plead guilty to?

 

---

 COUNT THREE: (18 U.S.C.  §§1037(a)(1) and (b)(2)(A) - Fraud and Related Activity in Connection with Electronic Mail.

 22. The factual allegations contained in Paragraphs One through Eleven above are realleged and incorporated herein as if set forth in full.

 23.  On or about December 28, 2008, in the Northern of California and elsewhere, the defendant, SANFORD WALLACE, knowingly accessed a protected computer without authorization, and intentionally initiated the transmission of multiple commercial electronic mail messages from or through such computer, in and affecting interstate and foreign commerce, to wit: the defendant accessed Facebook's computer network in order to initate the transmission of program that resulted in nearly 300,000 spam messages being sent to Facebook users.

 What were 1 through 11?  The only really important paragraph is number 5:

 5. From approximately November 2008 through March 2009, WALLACE developed and executed a scheme to send spam messages to Facebook users that compromised approximately 500,000 legitimate Facebook accounts, and resulted in over 27 million spam messages being sent through Facebook's servers.)

 

---

Post by Gary Warner, originally appeared on his Cybercrime & Doing Time Blog

CAUCE intervenes in a case about fraudulent spam

California case law currently allows spammers to send email with deceptive "From" and "Subject" lines, so long as the body of the message provides the true identity of the advertiser. For example, pornographic advertisers could send email with misleading headers to 12 year old children just because there is a truthful name following the offensive images in the body of the email.

Several friends of the court including CAUCE have filed a brief in the case of DeWitt v. Devry University, Inc. While CAUCE and the other friends have no direct financial interest in the case, they have an interest in email as a tool that is more than simply an advertising vehicle for commercial entities that seek to shift the cost of advertising to recipients.

The appellate court in the DeWitt case will have to decide whether the plaintiff email recipient proved his case against the senders of unsolicited commercial email. The amicus curiae take the position that,
while the defendants were ultimately entitled to summary judgment, the state of the law requires clarification.

CAUCE, and others, including several private electronic mail service providers, argue that the appellate court for the California State First District should reject the holding in Rosolowski v. Guthy-Renker, which held that unsolicited commercial email does not violate California statutory law if the body of the email provides contact information not provided in the headers.

Full copy of amicus brief

R.I.P. Gretchen Miller

I’m sorry to have to report that Gretchen, whom would know from Megapath, Time-Warner Cable, Road Runner, and AOL anti-abuse passed away earlier this week.

The world is short a died-in-the-wool antispammer, and a kind and gentle person.

Funeral arrangements are still TBA, the service will be at http://www.peterpaulpotomac.org 10620 River Road, Potomac, MD  20854

Opt-in At Gunpoint Isn’t Opt-in

There are loads of good reasons why you might want to require an address, and confirm it, when someone is signing up for your WIFI service.

However, one of them is NEVER ‘so we can send you unwanted spam’. Like this one :

 

 

I encountered this silly approach to ’growing a marketing list’ at the Westin Market Street in San Francisco recently, and since I figured the sign-up might be tied to my room, and disallow repeat attempts, I gave them a real address. As it turned out, I could have entered [email protected] since they didn’t actually confirm the address …

So what has the Westin accomplished? They are forcing people to give the a ton of bad addresses, most of which will bounce, the rest of which will complain about any mail being send to them as spam, and rightly so.

What a dumb policy. I told the conference organizers about this, so they could take it up with management. We’ll see what happens next year, same time, same place.