Slashdot Mirror
Spam Hits Its Highest Level Since 2010 (networkworld.com)
Long-time Slashdot reader coondoggie quotes Network World: Spam is back in a big way -- levels that have not been seen since 2010 in fact. That's according to a blog post from Cisco Talos that stated the main culprit of the increase is largely the handiwork of the Necurs botnet... "Many of the host IPs sending Necurs' spam have been infected for more than two years.
"To help keep the full scope of the botnet hidden, Necurs will only send spam from a subset of its minions... This greatly complicates the job of security personnel who respond to spam attacks, because while they may believe the offending host was subsequently found and cleaned up, the reality is that the miscreants behind Necurs are just biding their time, and suddenly the spam starts all over again."
Before this year, the SpamCop Block List was under 200,000 IP addresses, but surged to over 450,000 addresses by the end of August. Interestingly, Proofpoint reported that between June and July, Donald Trump's name appeared in 169 times more spam emails than Hillary Clinton's.
"To help keep the full scope of the botnet hidden, Necurs will only send spam from a subset of its minions... This greatly complicates the job of security personnel who respond to spam attacks, because while they may believe the offending host was subsequently found and cleaned up, the reality is that the miscreants behind Necurs are just biding their time, and suddenly the spam starts all over again."
Before this year, the SpamCop Block List was under 200,000 IP addresses, but surged to over 450,000 addresses by the end of August. Interestingly, Proofpoint reported that between June and July, Donald Trump's name appeared in 169 times more spam emails than Hillary Clinton's.
Given that it takes such a low takeup rate to make spam profitable, perhaps there is a slightly larger chance that a Trump supporter would click through and they are upping their profits that way.
Can't say I'm at all surprised by that. I've been getting a steady stream of what appear to be genuine emails from the Trump campaign (all the links are to legit Trump and GOP domains, plus a few MSM ones) asking for donations for a few weeks now. There's a whole bunch of problems with that, other than it being UBE - I'm a British citizen so I don't think Trump can legally accept my donation anyway; several of the domains involved are within the .uk ccTLD; and the addresses concerned are all (and always have been) spam traps. And yes, I have been forwarding them all to the FEC.
Seriously, Donald, if you're going to let your campaign team buy email lists from who-knows-where and spam the shit out of them, they could at least do some basic list washing first - it's starting to look like Hillary isn't the only one with an incompetent email admin team...
UNIX? They're not even circumcised! Savages!
Possible causes:
Spammers think Trump supporters more likely to fall for scam?
Trump actually spamming?
Clinton spamming and using Trump name in spam to alienate possible voters?
The real "Libtards" are the Libertarians!
Where can I buy one of those fun "jump to conclusions" home games? This summary boils down to "people society thought were smart, and talked like they were smart, actually weren't smart". Hire new security professionals that don't jump to conclusions so quickly. That sounds like step number one.
The real question is what percentage of those offending hosts had ISPs that (a) were notified of malicious traffic emminating from their networks, and (b) notified the subscriber/owner-of-the-host-in-question. I'm guessing the percentage is real fucking low. That is the real problem. The right solution further involves the ISP requring that the subscriber explain to them how they fixed the problem in order to justify re-activating their access. Do the math, do the work, put in the elbow grease. There are no magic short cuts.
I don't believe there's an increase. My ten plus mailboxes get a total of 10 spams per week. Same or less than they got in the last century. Of the 10 spams, roughly 2 are from an annoying friend, 2 are from Trump affiliates, 2 have Chinese looking script, 3 are from small businesses. Most are the result of legitimate attempts to communicate but a typo in the address got me involved.
If I owned an internet security business, I suppose I'd want people panicking about spam or viruses. Could this be FUD?
...omphaloskepsis often...
The graph of subject lines caught my eye while looking at the Talos report. In my own experience, the recent floods of mail with subjects like "Budget report," "Tax invoice," "Scanned document," etc. all arrive with some Windows ransomware variant attached. Not sure I'd really call these spam in the traditional sense. They're unsolicited, of course, but they aren't commercial in nature.
That aside, I do see an upward trend in UCE. The biggest offenders for me lately are of the boner pill variety, PurpleRhino and Vydox specifically. I'm seeing dozens of these a day to one particular address.
Thanks to the War on Drugs, it's easier to buy meth than it is to buy cold medicine!
Spam filtering on my email is working normally and I'm getting the normal amount of both false-negative (spam that gets through) and false-positive filtering (travel confirmations and bank notices that fall into my spam folder). Now it's the landline that has been spammed out to the extent that we leave it unplugged most of the time. And yes, this year most of it is political.
Nomorobo.com can save your landline, but it only works for certain carriers.
It's illegal to send spam. You can sue spammers for the spam they send, considering they are sending evidence of the crime. The law says you can win about $1000 dollars per spam, but usually spammers will settle for a 1/4 of that. I'm not a lawyer, but I do know one that made me as much as I made in a year as a software engineer and all I had to do was give him the password to an old email account.
and over that same amount of time we've seen the same increase in VPS's, VM's and personal desktops, thus more targets for bot nets.
not surprised...
Spam Will Be 'Solved' In 2 Years -- Bill Gates, 2004
If only he'd put a number on a maximum number of emails sent per spammer. 640,000 SPAMs should be enough for anyone!
Apparently due to the need for cheap domain names, spammers are running their outbound mail configured with cheap TLDs. I suppose they are doing this so that they can have an actual domain name that resolves properly because it's too easy to block an invalid domain name?
Whatever the reason, if you run your own inbound MTA, a lot of spam can be blocked by simply setting it to discard any mail from these sleazy TLDs, before even reaching the point of doing blackhole list lookup. The worst ones these days are .top and .stream, because apparently you can get a domain for $0.88/mo. Sure, spam still comes in from pwned computers, but a surprising amount comes in from IPs with properly resolving A records, and a surprising amount of that spam comes from TLDs that no sane person would be sending mail from.
So I guess some good did come out of ICANN getting greedy with selling all those new TLDs after all.
#naabhaprzrag, #sverubfr-000, #agi-fcbafberq, negvpyr[pynff*=' negvpyr-ary-'] { qvfcynl: abar !vzcbegnag; }
This new high intersects with the explosive increase in "sign up for our newsletter" bullshit you find on virtually any site these days.
It's not spam if it's political, it's just politics. Politics is in itself, pure bullshit, concealed with ...whatever it takes. In this case, emails.
Politics; n. : A religion whereby man is god.
When these people are caught they should just torture them to death, preferably on live PPV.
Do we need to rehash the reasons why? You might not have any sympathy for the suckers, or you might not care about attacks on corporate reputations and customers. You might not have any children for the spammers to target, but in that case I think I should extend my sympathies. You don't care about false positives that lose your actual email and you think your time spent with false negatives is too small to matter (and don't care about the multiplication of that time by the millions). You're still getting victimized by the general inefficiency the spammers impose on everyone. Or perhaps worst of all, the basic spammers create noise that helps mask the serious threats of the serious scammers, such as spear-phishermen and identity thieves.
It seems like all of the big email providers have adopted the motto of "Live and Let Spam." Obviously didn't work for Yahoo, did it? Whatever Microsoft paid for the Hotmail brand must have been written off for similar reasons. The google is the saddest case of all, but perhaps that was just the generalized result of dropping "Don't be evil" in favor of "All your attention are belong to us." Anyway, at this point I monitor all three and Gmail clearly has the worst filters, both for false positives and false negatives and for feebleness of their countermeasures. Proof? In the preferences of the spammers themselves, blessing Gmail with the most spam of all.
Doesn't have to be that way. The rational spammers do have economic models that could be attacked. Dropboxes can be nuked and external email services that provide the dropboxes can be pressured. Link shorteners can be subverted against the spammers. Lots of other countermeasures are possible, but the google don't care (and Yahoo can't afford to care and who cares about Outlook).
*sigh* Just venting again, but I really wish someone provided a really good email system, one with tools that would let me help fight the spammers. Why not convert some of the universal hatred of spammers into positive sentiments towards an email system that scares the spammers?
Freedom = (Meaningful - Coerced) Choice != (Speech | Beer^2), and sad sock puppets' bad mods avail them naught.
There was no need to attempt to put a political spin on at the end. It was an interesting story without it.
It's a shame the Cisco blog is linked second, because it's a great (yet short) read.
Since the end of last month one of my very low volume email accounts has been on the receiving end of a new spam campaign trying to give me malware. The emails I've received exactly match the emails in Cisco's graph So it's neat to see what's behind it - in this case the Necurs botnet running at full tilt.
Considering this account was receiving virtually zero spam before, it's definitely a major uptick in spam.
I've used and submitted to SpamCop.net for years. But for the past few years it's been pretty useless. Block rates are very low and false positives in what is blocked are pretty high.
Is SpamCop.net dead, or has Cisco turned it into an input only channel, hiding the useful/useable RBL data behind a paywall? Certainly the public list bl.spamcop.net seems to be useless.
I was just about to post that we need Brian Krebs back, and I saw that Krebs' website is back!
For those of you who do not remember, Brian's journalism was responsible for nuking more than half the spam on the internet in 2008.
http://www.washingtonpost.com/...
I have been seeing less spam than ever, not more. Even my GMAIL account is barely getting 3 spam emails a week and I haven't gotten a single spam message on my Office365 account at work. Kudos to the blocklists keeping that crap from even reaching me.
SpamCop is not dead. It is still up and running and the free blocklist is a great part of your anti-spam arsenal. Compare RCVD_IN_BL_SPAMCOP_NET to the other free options using SpamAssassin rule vetting stats and you'll see it's among the top performers. ("S/O" is a measure of relative precision, "SPAM%" is recall.)
Unlike the other DNSBLs, SpamCop also reports spam back to the networks that sent it (with filters to deal with spammer-friendly and negligent network operators, either of which might ignore or even pass on the heads-up to spammers rather than disciplining them).
In particular, SpamCop did well against this Necurs attack but it does not fare as well against hailstorm/snowshoe spam attacks (which IP reputation doesn't help combat). IP-based DNSBLs aren't anywhere near as effective today as they were ten years ago, but they're still quite worthwhile. That said, you're right in that the best ones cost money.
I feel happy, oh so happy. I don't want to go on the cart.
Use my userscript to add story images to Slashdot. There's no going back.