Slashdot Mirror
How Exploit Kits Have Changed Spammers' M.O.
An anonymous reader writes "Spammers used to depend on email recipients to tie the noose around their own necks by inputing their personal and financial information in credible spoofs of legitimate websites, but with the advent of exploit kits, that technique is slowly getting sidelined. Prompted by the rise in numbers of spam runs leading to pages hosting exploit kits, Trend Micro researchers have recently been investigating a number of high-volume spam runs using the Blackhole exploit kit. According to them, the phishing messages of today have far less urgency and the message is implicit: 'Your statement is available online'; or 'Incoming payment received'; or 'Password reset notification.'" One thing that's long worried me is that the bulk of spammers and malware writers may hire copywriters with a better grasp of English than most of the ones I see now. "I send you this file in order to have your advice" was funny, because it stuck out.
"One thing that's long worried me is that the bulk of spammers and malware writers may hire copywriters with a better grasp of English than most of the ones I see now"
At least in the '419-style' scams, research from Microsoft implies that the bad English is, at least in part, deliberate. It's obvious enough to 'smart' people that they won't bother responding (and therefore tying up the spammer's time trying to extricate their funds/credentials/whatever). However, less-savvy people might not realize it's a scam and therefore follow the links. As a result the hit rate of people who do respond is likely to be higher, resulting in a better yield for the scammer.
Build it, and they will come^Hplain.
The only thing I use bookmarks for now is to make sure I don't fat-finger the URL to one of my financial sites and enter my credentials into an imposter's site. Whenever I get an e-mail that I have a new statement or that I need to reset my password, I use the bookmark rather than clicking the link in the body of the e-mail.
God, I am so tired of people who don't give a fuck about anyone but themselves. This goes for more than just the spammers. I would have thought that in the 21st century, with all of the technology and information available, that people would be a bit more willing to think about what's not just good for them, but also what helps out society and world as a whole. I remember how Usenet was once a thriving and intelligent community - and because of folks like this, it is now a shadow of itself. Way to go! Yeah, I blame capitalism, ignorance and greed - short-term gains for long-term losses. Anything to make a buck. Welcome to the future where the banksters and spammers and morally bankrupt politicians and 'corporate persons' rule the day and 'apologize' when they're caught. It's time for the human race to grow the hell up and think of more than just profit. Yeah, I'm ranting - for now. Thanks for reading. ;-)
Make spamming an offense with dire consequences. I've seen people suggest it for pedophilia. That won't work. Pedophiles aren't operating on a reward basis, but a compulsion.
The same is not true for spammers, who see the rewards as far exceeding the costs.
We need to change that. We need to make it possible to execute a spammer and their entire family on the streets and the person who does it gets to keep all of their stuff.
Of course this solution will have some consequences as false-accusations of spamming will inevitably be misused, but we can fix that too, we just need to punish the exploiters there.
And then punish those exploiters.
Oh shit, I guess it won't work.
But still, it gives me great emotional satisfaction to imagine executing the scumbags behind the actual spamming. (Not the low-level peons who are probably the ones going to be thrown to the wolves anyway).
Then again, I feel the same about political campaign calls and their advertisements.
I once read that when Ray Tomlinson (the imventor of email) was asked about spam, he said he has an ironclad rule. "If I don't recognize the sender I immediatly delete it." I've been following his advice with good results for more than a decade now.
Sircam? That's a pretty funny definition of "now".
I wonder why spammers send so many identical spams over and over. My bank (or whatever) only sends one message per month to annoy me about my account. When I see 20-30 identical (or clearly permutations of the same thing), I know it is spam and delete it. Even if the spam is well written, the huge number of them tips off even a dull person. I think spammers would have more succes if they limited the number of spams so it is not obvious that a message is bogus.