Network Security Blog

I use Gmail as my central email repository and usually the spam filters they use are pretty good.  But lately they’ve been a little overly aggressive, so I have to comb through to make sure no legitimate email is being caught accidentally.  There’s not a lot that’s misidentified, but there’s enough to make it worth the few minutes a day it takes to double-check the spam folder.

I’ve been amazed at some of the subject lines I see, as well as what I see in the preview of the email.  There’s no way I’m going to click on any of them to find out what else is in the spam, because it’s just not worth the risk.  But I do have to say that my favorite subject line so far is “Thanks for contributing to our financial success”.  It’s honest and straight forward even if it is just an attempt to rip off people around the globe.

On a side note, I used to clean out my spam folder every couple of days, but in March I started letting them accumulate and get deleted automatically when they’ve aged 30 days.  It’s been interesting watching the number of spams spike and drop.  At one point I had gathered nearly 9000 spams in a 30 day period, which works out to an average of 300 spams a day.   Personally, that means about 60% of my email is spam, a far lower percentage of spam than most people see.  I guess being subscribed to ten or so mailing lists had to have some benefit.

Mine is just a single data point, compared to the millions some anti-spam vendors get to see.  But I like having a personal high water mark to compare to what the vendors are reporting. I’m not a spam expert, so it’s interesting to see new spam subjects that companies like  F-secure report.  Anyone else out there keep track of the spam they receive for fun?

Technorati Tags: security, spam, McKeay

This makes sense in a twisted way:  scammers are using charities to test stolen credit cards. As the post points out, they’re using charities because most banks aren’t going to flag a donation, since it’s something most people only do on special occasions and it’s hard to create a behavioral monitoring program that could catch this as being an unusual activity with any accuracy.

The trip to Sacramento was a great success for the family and me.  I was a little worried that bringing the family to one of Robert Scoble’s photowalks might not be kosher, but I needn’t have worried.  Thomas Hawk had his kids there and there was a trio of cute little redheads running around with my boys.  Plus a train museum is really a great place to let kids run around.  There were a lot of interesting people and I got to meet a reader/listener who is a blogger in his own right, Garrett Gee.  I’m still trying to get my head around the fact that people will occasionally recognize my voice from the podcast.

As the title of this entry indicates, I didn’t get very many good pictures.  I started off using the flash, but decided there was enough ambient light that I could switch off the flash and use an ISO of 1600.  I barely know what that means, so I didn’t know that it would make most of my pictures incredibly grainy.  At least I knew enough to make sure I was stablized before taking a picture.  You can take a look at the few pictures I thought were decent, a couple of which my wife took with our other digital camera.  By the way, not having to share a resource like a camera is one of my secrets to a happy marriage.

I found one thing while preparing the photos that is directly security related:  Flickr is another system that is being attacked by phishers and other malcontents.  They have an alert that’s part of the home page which leads to a short but clear statement explaining what’s happening, along with a number of links to explain the security issues for their customers.  It appears that the target is to install trojans on users systems, not the photo’s themselves.  It’s dated the 19th, so this may be a new occurance, but I doubt it.

I’m planning on attending the next photowalk if possible.  I learned not to use an ISO of 1600, at the very least. 

Technorati Tags: security, mckeay, Robert Scoble, Thomas Hawk, photowalk

According to the SFGate, the intrusion that AT&T reported earlier this week was not aimed at stealing credit card information, it was aimed at providing the raw data to allow the crackers to perform targetted phishing attacks on a massive scale.  By seeding an email with information gathered from AT&T’s database, the phishers can add a level authenticity that makes even some of the most suspicious people on the Internet accept an email as authentic.

This is just one more reason to never respond directly to any request from a merchant or bank that comes to you in the form of an email.  As always, if you think an email alert is real, open a browser window and manually type in your bank’s URL, never click on the link in the email. 

Technorati Tags: security, McKeay, AT&T, phishing

I haven’t had a lot of time to blog lately, but here’s a good link to some ideas on how to keep your inbox spam-free.  I’ve been reading a lot of good stuff on Darknet.org latlely, this is just one of the latest stories.

Technorati Tags: security, spam

What an evil, sneaky, underhanded way to social engineer a business!  I like it!  This company took twenty USB thumb drives, seeded them liberally with malware and pictures, and left them on the ground outside the credit union they were targeting.   People fell for it, and quite frankly I can’t say I blame them.  If I found a thumb drive laying around in the parking lot, I’d probably plug it into a system to see who it belonged to myself.  Or at least I would have before I read this article. 

This was done as part of a penatration test, with the full approval of the company that was attacked.  But is it really safe for anyone to assume that the any media you find laying around was lost, not placed there on purpose?  This really would be a good way to target almost any company you might want to mention.  It’s so much safer to always assume a malicious intent and take the proper precautions than it is to assume innocence.  This is why I always get so angry when businesses talk about stolen laptops and the thieves not knowing what they have.  You have to assume malicious intent and prove that none exists, not the other way around.

Technorati Tags: security, USB drive, social engineering

I’ve noticed a number of these strange emails floating through my mailbox and into my spam folder.  F-secure says it may be a botherder testing his tools, but it’s kind of a strange way to do it.  I’ve also been receiving a few spams with a subject of ‘test bat’, so maybe it’s not so strange after all.

And, of course, I found a little more information on this right after I posted.  Figures

Technorati Tags: security, spam

Comments I made on my ComputerWorld blog were quoted today in an article on SearchSecurity about the Black Frog/Okopipi project.  After talking to one or two members of the project, I think I oversimplified the challenges Okopipi will be facing, but I’m still dubious abou the project.  It’s something that’s going to have to be handled with great care, and I’m not sure an open source project is the way to go.  Every unsubscribe link is going to have to be verified by a real person, not just a program, and I still see several ways spammers could turn this project to evil.  I don’t think this is reason enough not to at least try, but I don’t believe I’ll be participating in a distributed, P2P anti-spam solution any time soon.

Technorati Tags: security, Okopipi, spam

It looks like the spammers have won the battle against Blue Security.  The company is closing down their service, having realized that their solution to spam isn’t going to do much more than create an ever-escalating war with the spammers.  I didn’t think an active, attack-back technology like Blue Security ever had much of a chance of being effective, but I’m still a little saddened to see them have to shut down the service.  On the other hand, give it a year or two and I’m sure some other company will try almost exactly the same thing. 

Technorati Tags: security, spam, Blue Security

Mikko at F-Secure had a good idea for fighting phishing.  A significant amount of phishing sites aren’t hosting the images they use, they’re directing the browser to download the real image from bank they’re imitating.  So what if the banks added some relatively simple code to instruct the web server to send a alternative image if they received a significant number of referals to the original image?  Using Mikko’s idea, the bank’s alternative image would include a stamp that would make it clear that the refering site was illegitimate and give the consumer a phone number to call.  The idea could be circumvented by smart phishers, but it would add one more hoop they’d have to jump through.  Even if it only stops the lazy phishers, that’s a couple more percentages of the total scams that wouldn’t work. 

Technorati Tags: security, phishing