Slashdot Mirror
Google Says Spam, Virus Attacks to Get More Clever
eweekhickins writes "Google's Postini team says new attacks will take the form of sneaky viruses that will blend with spam, leveraging specific current events, such as the Super Bowl or the Summer Olympic Games. Better yet, virus attacks will target executives at companies whose intellectual property is deemed valuable on the black market.
A lot of these attacks will masquerade as legitimate business agencies, such as the Internal Revenue Service, the Better Business Bureau and the SEC."
that these will be successful. So many suckers, so little time.
I prefer the "u" in honour as it seems to be missing these days.
The bastards!! I'd better warn my associates in South Africa.
Seriously, TFA comes off as a padded version of "uhm, so...they're probably going to keep finding new ways to do this...since that's what they already do". The report itself looks to hold a little more substance, but then, I guess it's hard to make news out of spam that doesn't involve a big shift in the court, because it's pretty boring by definition.
Damn, my entire security plan really depended on them suddenly getting really really stupid. If the scammers suddenly forgot how to send email, switch on a computer, or breathe air my life would be so much easier.
Slashdot Burying Stories About Slashdot Media Owned
Crims have always been good at adapting and exploiting conditions. The Mafia really got their power due to exploiting the prohibition. Cable thieves in South Africa are using rolling blackout schedules to plan their cable thefts.
As more business services are done online it makes sense to phish for more than some lame paypal accounts.
Engineering is the art of compromise.
Postini's a relatively recent Google acquisition. I'm not sure it's fair to say "Google this" and "Google that" when the agreement to acquire Postini is less than a year old. The spokesperson was probably just speaking for their own team and from their own culture.
A lot of these attacks will masquerade as legitimate business agencies, such as the Internal Revenue Service, the Better Business Bureau and the SEC.
Will these attacks masquerade as legitimate business agencies, or as agencies such the Internal Revenue Service, the Better Business Bureau, and the SEC?
I've been getting a few spams lately that are ASCII art advertising for "viagra". Fairly clever way of getting past the filters, anyway.
Hail Eris, full of mischief...
E pluribus sanguinem
This is a sales pitch, there's nothing new in that article. Google is just fishing for more business for postini...
Everybody knows that Google is so |337 that even the spammers grace them with beta copies of new spam.
I judt got a nre Kinesis keybiartf so please excusr ant egregiou typos.
Decent cryptographic technologies have been with us for a while. I wonder about someone like Verisign making an EV-like system for E-mail certificates, where people/companies/organizations can apply, and after a thorough vetting, get a certificate (preferably on a hardware cryptographic token) that that person is whom they claim to be. Of course, E-mail clients like Thunderbird, mail.app, and Outlook would have to be updated to show that a mail is authentic.
This would help against spam similar to how anti-phishing technologies in IE and Firefox protect against bad websites, but its still not perfect.
S/MIME and PGP are strong technologies to help against fraud. I just wish more companies would send out mail with it. For example, one could register a PGP public key with a shop, and when the shop would send E-mail, it would send it signed, and encrypted to that key. Even just using S/MIME's signing capability which works with virtually any E-mail client [1] would help matters greatly.
[1]: Even pine and mutt support S/MIME. A lot of cellphones support this functionality as well, such as all recent Windows Mobile devices and Blackberries.
The underlying concept of your idea is good.
However, I can see a few issues that would impact the rate of adoption and the overall utility of your approach (assuming, for the sake of simplicity, that the cryptographic aspects are implemented in a truly secure manner, the crypto itself is strong, etc. I fully realize that this is like the proveribial "frictionless surface" and the proverbial "ideal conductor" used in science books. I'm just trying to cover the big points here, OK?):
1. It will not happen until Verisign (for example) decide that there is enough of a market that they can make a decent profit.
2. It will either price small businesses out of the market (given Verisign's prices, this is likely) or it the price will be such that small businesses can afford it and then so can the spammers. Before you start claiming that is why there is a vetting process, I would suggest that hurdles low enough for small "mom-and-pop" businesses to jump will be low enough for a determined spammer.
3. Either we need a "Root CA" mechanism like other certificates (again, profit and "are you sure you can trust this") or the whole "web of trust" thing from PGP. The web of trust would be difficult in that it would make legit messages appear fake until you can determine it. Also, how would "Joe Sixpack" know the difference between a legit cert for the IRS and a faked one?
Your idea is good. Unfortunately, the current environment is not ready for it. I hope we will see the day when it will work.
I've already seen two of these.
One was an ordinary phishing attack.
The other gave a URL in a valid subdomain of irs.gov
So either
- the attack was broken (certainly possible)
- the attack was relying on DNS cache poisoning or compromised servers
I've sometimes wondered how much (if any) spam is actually just a numbers station.
Whenever I mentioned spam a few years ago all the geeks would tell me that Bayesian Filters would totally solve the problem.
What happened?
No sig today...
They found the biggest security weakness of every single company... The Pointy Haired Ones.