Slashdot Mirror
Spam Opt-out Link Triggers Malicious Code Attack
Maestro4k writes "The Register is reporting on a new spam E-mail circulating out there. In it, clicking on the 'Click here to remove' link launches a site, that when the user scrolls the page, triggers a drag-drop javascript exploit. Scarily the E-mail actually complies with the CAN-SPAM act as it only requires spammers to put an opt-out link in their mailings. As The Reg says "It comes as little surprise that this feature is been taken advantage of in a social engineering exploit; but it does illustrate the security problems of the opt-out approach that were always apparent to security experts - and ignored by legislators." The link in questions points to www. xcelent.biz (As in The Reg story, space intentionally included) so even if you can't block the mail yet it should be easy to block access to the site with the exploit. I suspect this is just the beginning and most spam will include "features" such as this in the near future."
So now that we have a legal, malicious attack, we'll only have to wait a few -more- years for bills to be passed to have the law catch up with some watermark of digital exploitation. Super.
___ In the words of Gen. Douglas McArthur: "I'll be right back."
...to get SpamAssassin.
I'm probably at the karma cap. Mod up a funny troll instead, it lightens the mood
I realize that another spammer will take advantadge of the hole next week but if the hosters were blacklisted from DNS servers, the offending files might get removed a little faster.
Agile Artisans
CAN-SPAM may require an opt-out option in the e-mail to remain legal. However, the legislation DOESN'T protect you from the consequences of using that opt-out option.
It's legislated social engineering at its finest. Good luck out there.
IT Geeks - 1
Politicos without "tech savvy" - 0
This is the way it will always be unfortunately. Unless the whole population eventually can understand all the technical aspects of computers and the internet, or computers and the internet become so rock solid/secure AND easy to use, it will always be this way.
Un-news
Seriously.
It's not like spammers are a class of people to be trusted. I always felt the opt-out requirement was joke and prime for abuse. By opting out, you are telling the spammer that you read every email that comes your way and they add it to their list of email addresses that actually respond to spam.
So what do they do with this list? If they follow the letter of the law, they will stop spamming - but, they have a list of high quality email IDs that they can sell to other spammers.
Users should always follow these simple instructions with regards to email spam:
1. Make sure you have an incoming mail spam filter, like SpamAsassin.
2. Delete any spam that gets through.
3. If you are interested in the product, do not contact the email (spam) source, reply to the email, click on "helpful" buttons. Find reputable mainstream vendors - if it's great then Wal-Mart, Best Buy, Circuit City, etc. will stock it.
myke
Mimetics Inc. Twitter
This is dangerous stuff. Mod the parent article down (which includes a working link to the malicious address) so that people don't click on it.
it is a site worthy of a good slashdotting, if just to keep the unwary from reaching it.
It's all fun and games until someone loses the key to the handcuffs.
Don't forget the good services of SSL.
You should use https for everything so that you get a b c d
what kind of ignorant user is going to use a scrollbar an a site they don't trust?
The same kind that use a browser they can't trust.
--
What would Bill Clinton do?
If SA 3.0 is running with SUBL support, how can we add: www.xcelent.biz to the SUBL list? In that case, SA 3.0 would block this email alltogether. I think this is a killer feature of SA now, and I'm waiting to learn more about it so I can update my current 2.x version running on my home mailserver.
PCB$@#
free ipod and free gmail!
-
I just sent a link to that to the MCSE slags at work. How long till they figure out they just got owned.
I predict about 5 minutes before they call security and 10 minutes before you get to clean out your desk and go home early.Wow, you mindlessly repeated the mistaken conclusion of the article submitter.
If the link doesn't allow you to opt out, it's not an opt out link, is it?
If the law requires that I have a valid licence when driving, is it OK if I call my dog "a valid licence" and have him sit in the back seat? "Everything is in order, officer. I have 'a valid licence' back here..." Just because you call a thing something, doesn't make it that thing.
With that reward money, I could afford this life-sized chocolate God, filled with an infinite number of smarties.
-
I like a good practical joke as much as the next person. Can we just track down one of these people, drag him/her outside chop them up with bolo knives hunt down their families, rape mutiliate and murder them set fire to their houses, kill their dogs and piss all over the corpses already?
While I appreciate the sentiment (personally I'm thinking boiling oil would be appropriate for spammers) I doubt it'd help. Even with the death penalty in the US we still have far far too many murders/rapes/etc. so it doesn't seem to work as a deterrent. All we'd end up with is lots of dead spammers (good) but plenty more rushing to take their places (bad). Just look at the meth problem, last night on the news we heard that the county sheriff in one of the nearby counties ended up busting his wife's cousin for cooking meth. People just get greedy and completely overlook the possible consequences. We're not going to be able to stop these problems with laws or conventional punishments.I figure 10, 20 thousand of these losers tops and the problem will go away.
That said we need to find a way to make spam stop paying. If there's no money in it, or it gets to where it's a near certainty you'll lose all you made (and then some) from hefty fines people will move on to something else to try to make a quick buck.
asking that they revisit the CAN-SPAM act. When they click the scrollbar in the forwarded message, they'll finally understand why we didn't think the original bill was tough enough.
Why anyone would use an e-mail program that allows clicking on something is beyond me. All the comfortable features that come with clickability have their price -- which in in this case is far too high IMHO.
open (SIG, "</dev/zero"); $sig = <SIG>; close SIG;