Slashdot Mirror

Quite honestly, I have never met a 'victim' of spam in real life or on the Net, not a single time. I'm on the Net for more than 15 years now and nobody I have ever met had a genuine problem with his inbox or bandwidth because of spam. I don't deny that there occasionally are extreme cases but as far as I can see these are fairly rare.

I've seen businesses that rely on email effectively halted due to joe-jobbing/backscatter. That is as much due to misconfigured servers as spam, but it is nonetheless a real world problem that you refuse to recognise for whatever reason. joe-job spam only gets 17.4 million results in google, so I can see how you don't think it's a real issue.

Sorry, you're either trolling or more stupid than the "spam victims" you denigrated.

Here's an example of one I came across recently: http://www.dslreports.com/forum/r21704795-Browser-Redirect-to-7770-interesting

Also at the time I'm writing this, there are at least three PDF droppers listed here: http://www.techzoom.net/security-radar/latest-virus.en

Generally tracking things back to the original infection vector is fairly straight forward if it happened recently - there's usually cruft all over the system that wasn't there prior to the infection, and log file entries or application crash memory dumps correlate to the time things started getting hinkie. Often it's as easy as loading up the browser history in IEHV and seeing what the user did (google search for some topic, the 3rd URL down points to http://ssladjfkfj.fjdskjff.cn/ and if you're quick enough and the site is still up you can usually grab a copy to see exactly what the page is doing.)

Acrobat Reader that hasn't been upgraded to 8.1.3 (I'm not sure if there are patches for 7) is vulnerable. There are lots of PCs out there with an older version of Acrobat, especially since many people disabled the update notifications after getting sick of being prompted to install Photoshop Elements (or whatever else Adobe was pimping) over and over.

And then there's the fact that roughly 50% of the market browsing with Internet Explorer is still using an old version.

News report.
The Study.

The cited original study "Understanding the web browser threat" is published at: http://www.techzoom.net/insecurity-iceberg It also proposes to show a warning to the user if the browser in use is an old version and security patches have been missed, much like a "best before" date on perishable food. This would help to easily spot if one is at (unnecessary) risk when surfing the web.

According to Google data (referenced here) IE still had a marketshare of 78% in June 2008.

The study is online now http://www.techzoom.net/publications/papers.en

I've worked for companies that would shut down your website if they found out your password was too weak.

A number and then a real(ish) name is one of the worst passwords one can come up with.... and is boring at that.

Here's a nice tool for coming up with random passwords. It doesn't seem to recognize including spaces (which are usable in passwords with Linux, BSD, htaccess passwords, Windows XP, gmail, and who knows where else) within the generator. I guess we're left to our imagination at that point.