Spammers fighting back!

[ROM-DOS]

Numerous users of Blue Security's anti-spam system now report of a new form of aggressive spam. An unknown group of spammers claim to have derived a way to extract the member email addresses of Blue Security  group's anti-spam system, called Blue Frog. Blue Frog, a small tool which once installed on the users computer, enables Blue Security to systematically flood a known spammer's website with opt-out messages; much to the headache of the spammer. Tens of thousands of users have already signed up, so can it really be true that spammers now possess this database? Or is this yet another frail attempt by spammers to intimidate the user?

Stray1 writes ""You are recieving this email because you are a member of BlueSecurity...." An email from unknown detractors has taken the Bluesecurity anti spam lists and decided to take matters into their own hands. I recieved this Email from an anonymous, and garbled host, which went on to say in not so fantastic english that I, as a Blusecurity member, would recieve this and many more (about 20 -30) spam messages a day until I left the blue security community. Blue Security, (www.bluesecurity.com)a website and community designed to lessen your Spam Email, is down for the moment. Is this what we have come to? Spam,(erm 'high volume email') companys holding your address hostage until you comply? "...We mightve had your email addresses before in our lists, but now, we are targetting YOU, because YOU are a bluesecurity user".

. . .see if you can connect to; http://www.bluesecurity.com/

Ahh, the digital superhero battle between the evil spammers and the innocent citizenry has begun!! ~ lol

[ROM-DOS]

In both advertising and social engineering,

the common goal is to convince a targeted human

to perform an action. The exact nature of the action

varies with the domain: email worm authors may try

to have the target run an executable attachment;

spyware authors may want to direct the target

to a specific web site for a drive-by download;

spammers may want to have the target visit

their web site or that of an affiliate.

A recent research paper out of the University of Calgary suggests that those problems could soon be a lot worse if spam creators adopt a few simple data-mining procedures.

John Aycock is a computer science professor who teaches classes in "Spam and Spyware" and "Computer Viruses and Malware." His newest research project, done in conjunction with Nathan Friess, imagines an evolutionary step in the use of spam zombies that could dramatically increase their effectiveness. The paper, " Spam Zombies from Outer Space", shows how effective spammers could be if they sifted the zombie computer's e-mail archives and generated messages in that particular user's style.

"There are two key reasons why spam is suspicious to anti-spam filters and human targets alike. First, it often comes from an unrecognized source. Second, it doesn't look right. The evolution of spam zombies will change this. These new zombies will mine corpora of e-mail they find on infected machines, using this data to automatically forge and send improved, convincing spam to others. In addition to the adversary, there are two other parties involved here: the victim, who owns a zombie machine, and whose saved e-mail the adversary will be mining; the target, currently on infected, that the adversary wants to click on something."

That "convincing spam" is generated by looking at factors such as vocabulary, the length of individual lines, the use of capitalization, signatures, abbreviations, misspellings, and more. The malware then generates a reply to a legitimate e-mail on the user's computer and appends its own message and payload (attachment or URL), and does so in the victim's own style and with his or her own signature. The result is much harder to distinguish from traditional spam, and would make it through most current anti-spam screening programs.

I think e-mail has to go in the direction of EASY TO USE crypto based authentication. This technology already exists (pgp) and is used heavilly by the computer security industry. It would make a lot of sense (IMHO) if EVERY e-mail from my bank was cryptographically signed using the bank's private key. Websites are encrypted and authenticated using public/private key cryptography (SSL) why can't the same thing be done for e-mail?

. . .there are a variety of e-mail programs that implement various crypto stuff already, but as far as I can tell, almost no one uses it or knows how to use it!