It seems to have been going on for several weeks, but in the recent few days it’s apparently been getting much worse. Our CudaMail service has seen an increase in that type of spam recently as well. We’ve put some filters in place fortunately, but there has definitely been an increase.

A lot of it was the “SEO Google first page rankings” type.

US-CERT Current Activity

IRS Stimulus Package Phishing Scam

Original release date: February 6, 2009 at 10:03 am Last revised: February 6, 2009 at 10:03 am

US-CERT is aware of public reports indicating that phishing scams are circulating via fraudulent U.S. Internal Revenue Service emails offering users stimulus package payments. These emails include text that attempts to convince users to follow a link to a website or to complete an attached document. The website and document request that the user provide personal information.

US-CERT encourages users to do the following to help mitigate the risks:

* Do not follow unsolicited web links received in email messages.
* Refer to the Recognizing and Avoiding Email Scams (pdf) document
for more information on avoiding email scams.
* Refer to the Avoiding Social Engineering and Phishing Attacks
(pdf) document for more information on social engineering attacks.

Relevant Url(s):

====

This entry is available at: http://www.us-cert.gov/current/index.html#irs_stimulus_package_phishing_scam

This is in contrast to the 2.2 Million dollar USD fine assessed against Atkinson by the FTC in 2005.

The Spamhaus article points out that Australia has very strict anti-spam laws
(http://scaleplus.law.gov.au/html/ems/0/2003/0/2003092501.htm) and the maximum fines for a ‘body corporate with a prior record’ could be as high as 1.1 million (AUS) or $220,000 (AUS) for ‘a individual with prior record’, just for sending the spam messages.

If you add in the maximum fines for not including accurate sender information ($550,000 corporate / $110,000 personal) for not having a functional unsubscribe facility ($550,000 corporate / $110,000 personal) and supplying, acquiring and using address-harvesting software or harvested-address lists ($550,000 corporate / $110,000 personal) these fines could have been much higher for Lance.

Sydney Morning Herald.
http://www.smh.com.au/news/technology/security/kiwis-nail-big-time-spammer/2008/12/22/1229794316883.html

Herbal King
http://www.spamhaus.org/rokso/evidence.lasso?rokso_id=ROK7802

While this is great that Lance has been fined if we take a step back and look at the bigger picture we have to ask. If fines worked why didn’t Lance and the whole Herbal King group stop spamming in 2005?

While the laws applied in this particular case are very strict they have not stopped the flow of spam. It looks like one solution may be to add confinement in addition to the monetary fines for repeat spammers with additional time for repeat offences similar to how other criminals are treated.

While the botnets are very automated and will continue for a while after the masters are incarcerated eventually with no new commands the botnets will go dark.

But what do I know? Your thoughts on this issue?

- Shaun

This is a great idea to ensure that the services is not being overrun by bots but it does open up the possibility that this site has been setup to gather valid e-mail addresses for the express purpose of spamming you in the future because they can then sell your e-mail address to an ‘affiliate’ who then send you the ‘latest thing’ you may or may not be interested in.

One thing you can do is use a service like McAfee SiteAdvisor “http://www.siteadvisor.com/

This free service installs as a browser plug-in that adds a little icon to your search results. McAfee has signed up on lots of sites and then keeps track of how much spam each site sends. You have to be careful though as the icon does not show up if someone sends you a link in e-mail or you find it on another site. You have to do a specific search for that site to get McAfee’s results and recommendations.

If you’re an e-mail administrator you can setup aliases for your account that are site specific and use them when you sign up so that if that unique address is spammed you can block it and know which site it was that sold your e-mail address. What if you’re like most people and are not the mail server administrator?

What can a regular Joe do?

While we have already talked about using multiple e-mail accounts to keep things separate there is another way: Use a disposable or temporary e-mail address.

Here are some services that allow you to create a temporary forwarding e-mail address and some even let you set how long you want the address to exist, 1 hour to 1 year is possible.

• http://spambox.us
• http://www.dodgeit.com
• http://www.mailinator.com
• http://tempinbox.com
• http://www.spammotel.com

This is not an endorsement of any particular service – just some examples.

Keep a list of a few handy because some sites know about this idea and may not let you sign up if you use an e-mail address from one of these temporary e-mail services.

That said how do you know that these forwarding sites are also not setup for the express purpose of harvesting your real email address? You do have to provide your real e-mail address to these services so they can send you anything sent to your temporary e-mail address. Some sites don’t require a e-mail address to forward to but instead you use a webmail interface. This is ok as long as you don’t want to continue getting e-mail from this company as you have to remember to log into the webmail interface on a regular basis.

You can also use a single GMail account and filter emails. For example, memyselfandI@gmail.com Then add a +[site] after the account and create a label. Those emails will sorted by that site label.

• memyselfandI +Site1@gmail.com
• memyselfandI +Site2@gmail.com

You get the idea.

That said, you may not want to use a disposable address for anything important like a product registration or a mailing list that you want to subscribe to because the company may want to e-mail you about an important product recall and if your temporary e-mail address has expired by that time they may not be able to send you this important information.

For mailing lists you want to use a permanent e-mail address as the mailing list admin will get an email every single time somebody posts in it and it bounces off of your expired temporary address. You may want to use the segregated e-mail idea in that case.

These idea’s won’t reduce your spam to zero but will help in the battle.

Shaun