ABOUT EMAIL & YOUR OWN PERSONAL COMPUTER SECURITY
WHY DO YOU PROTECT YOURSELF?
BECAUSE...
the goal of an attacker is to install a Trojan on your machine that will allow them to control your machine.
Protect yourself from various forms of "malware" viruses, ad-ware, spyware etc.
They turn it into a Zombie machine - not under your controL NOW YOUR COMPUTER is under their control. Hundreds of thousands if not millions of machines are "owned" by someone other that the user sitting in front of the keyboard and monitor. These bad people control your PC, grab your passwords, and get lots of machines together to organized DDOS attacks and jump from machine to machine to machine in order to hide their tracks. Trojans are also used to mess with you. You now own a zombie machine, so they can surreptitiously turn on the Webcam of your computer in order to watch you work, or watch what you type on screen and then send you popup messages insulting you. Here are some great articles on what's needed to expunge spyware - and prevent its re-emergence.
Step-by-step removal instructions.
HOW TO EMAIL AND SURF ANNONYMOUSLY FOR YOUR OWN PROTECTION
Net-Happenings The Earliest Education Mailing List started by Internet Pioneer Gleason Sackmann in 1994
This mailing list archive contains the evolution of education related ideas and URLS' up to the present day. You can join this mailing list.
SPAM SPAM SPAM SPAM SPAM SPAM
(NEVER RESPOND to SPAM)
Burns-Wyden CAN SPAM Bill S.877 Passed 2003
Spam-maker loses bid to trademark 'spam'. The producer of the canned pork product Spam has lost a bid to claim the word as a trademark for unsolicited emails.
Fred Cohen first thought up the idea and wrote the first virus in November 1983 as a University of Southern California graduate student. During a weekly seminar on computer security, he conceived of a program that could infect other systems with copies of itself. This University of New Haven professor introduced the term "virus" to the lexicon of computers. His adviser at the time, Len Adleman--well known as a creator of public-key encryption and the "A" in a popular form of the security technology known as RSA (Rivest, Shamir & Adleman)--suggested that the programs were the digital analogy of viruses. The name stuck. Cohen used the phrase in a 1984 research paper, in which he described threats self-propagating programs pose and explored potential defenses against them. When he asked for funding from the National Science Foundation three years later to further explore countermeasures, and they said it wasn't of current interest. Two decades later, countless companies and individuals are still paying for that mistake.
Congress New Federal mostly pro-consumer anti-spam law 11/2003 source Anne P. Mitchell, Esq of isipp.com
1. Makes illegal using open proxies or relays or any other form of resource misappropriation.
2. Makes illegal any commercial message sent with false header information.
3. Requires a working manner to unsubscribe which must continue to work for at least thirty (30) days after the mail is initiated.
4. Makes illegal the sender or anyone acting on behalf of the sender sending mail to a recipient who has unsubscribed, *and* makes illegal the transfer or sale of such recipient's name to another entity. Meaning it makes illegal the old unsubscribed recipient shell game.
5. Makes illegal the providing of spam support good or services where the spam support provider has a 50% or greater interest in the spamming vendor, *or* has knowledge of the spam and receives or expects to receive an economic benefit from the spam (goodbye pink contracts. It will be interesting to see how quickly this provision is used against service providers who fail to terminate spamming customers).
6. Specifically states that the enforcing entity does not need to prove intent in order to obtain a TRO or C&D order.
7. *Vests in state agencies and state attorney generals the ability to sue spammers, in Federal court, on behalf of the state's citizens who have been spammed.* Is this the same as a private right of action? Well, no. But it *does* mean that private citizens can petition/lobby their state agencies and representatives and attorney generals to act on their behalf, and I'd suggest that rather than wringing hands and nay-saying, people should start right now pushing their state legislators to create an "Office of Spam Enforcement" specifically for this purpose.
8. Provides for attorneys fees to the state agency in any state initiated action. This is *really* important, because unbeknownst to many, a court *cannot* award attorneys fees unless there is a specific provision of the law providing for fees, and this section
can help to convince state agencies that it is a feasible proposition.
9. Provides that *internet access service providers* may also sue, on their own behalf, in Federal court.
10. *Specifically* states that the law does *not* impact an ISP's ability to determine and enforce its own policies for transmission of email. This means that nobody can sue an ISP for blocking the mail they send, trying to claim that the ISP must accept and deliver it
based on the Federal law.
NEVER RESPOND -- NEVER REPLY -- TO A SPAMMER
Report to the Federal Trade Commission
The FTC wants copies of your unwanted e-mails and e-mails that have deceptive unsubscribe links. They use the unsolicited e-mails stored in their database to pursue law enforcement actions against people who send deceptive spam e-mail.
To report any unwanted e-mails you receive, simply forward the messages to spam@uce.gov. Make sure that you include the header information in the e-mail. The FTC wants to know if you find an e-mail with an unsubscribe link that is not active, does not unsubscribe you or results in more spam. You can fill out a complaint form at www.ftc.gov/spam.
SPEWS is a list of areas on the Internet which several system administrators, ISP postmasters, and other service providers have assembled and use to deny email and in some cases, all network traffic from.This private list is now available for the general public to read and/or use for email filtering.
Spamhaus tracks the Internet's Spammers, Spam Gangs and Spam Services, provides dependable realtime anti-spam protection for Internet networks, and works with Law Enforcement to identify and pursue spammers worldwide.
SEE SECURITY TOOLS
Spam is not unsolicited commercial e-mail. Spam is correctly defined as unsolicited bulk e-mail (UBE for short). There are three reasons for this:
(1) inclusion of non-commercial spam such as religious, charity, non-profit, educational, etc.
(2) exclusion of any distinction on the basis of content. In other words, the definition of spam is deliberately content-neutral, or perhaps more clearly, content-blind.
(3) exclusion of single messages. A single message, no matter how wanted/unwanted, no matter what its content, cannot be spam: it's not bulk.
Opt-out e-mail marketing - let the spammers do all the work for you...
In a ruling of July 18, 2002, in the appeal case of Internet Service Provider Xs4all vs. Ab.fab Interactive Media, the Amsterdam Court of Justice decided that e-mail spamming is OK, as long as the spammer provides a so-called means to opt-out. In most cases however, as any experienced Internet user knows, opting out will mean more spam, not less. MORE ABOUT HOW TO OPT - OUT
The Biggest Spammers Comcast, Verizon, Hotmail, MSN, Earthlink, Yahoo, very one of those major ISPs should have personnel whose job consists of nothing but monitoring NANAE, Spam-L and other anti-spam/abuse forums 24x7 and using the information found thein. Especially because they are absolute goldmines of useful research *done by other people using their own time and money*. Enormous amounts of abuse could be stopped very quickly with a very small investment just by doing this. Comcast continues to trail only the entire country of China in terms of attempted spam delivery in the US as of 2004. They would be leaders in the fight on spam/abuse, instead of leading producers/facilitators of it.
http://groups.google.com/groups?safe=off&group=news.admin.net- abuse.email
- AOL (800)-827-3338 Technical Support (800)-771-8267 Customer Support
- YAHOO (408) 349-3300 (main number) http://help.yahoo.com/help/us/mail/
(no telephone support for free subscribers)
- HOTMAIL (877) 606-9433 (Executive escalation group)
- EARTHLINK (800) 890-6356 (customer service) (800) 890-5128 (Technical support) http://support.earthlink.net/chat/ (live chat) 7 a.m. to 2:45 a.m. ET. Mindspring.com (same as earthlink)
- MSN (877) 606-9433 (Executive escalation group)
- attbi.com (888) 262-6300 (Customer care)
- juno.com 1-800-654-5866 Human support is $1.95 per/minute (1-866-491-5866)
http://www.juno.com/support/pat/index.html
- comcast.net http://online.comcast.net/help/ (Click live support)
http://www.comcastsupport.com (if you are a member)
- cox.net http://support.cox.net/custsup/livesupport/livesupport.shtml (live chat)
Spammer vs. Microsoft 2005
Robert Soloway hates Microsoft. Or so it seems. Soloway lost a court battle to the software giant, who accused Soloway of illegal spamming. According to Brian McWilliams, investigative journalist and author of Spam Kings, Soloway is allegedly one of the world's dirty dozen of top spammers.
Reflections on the 25th Anniversary of Spam
While many only encountered spam (junk e-mail or junk newsgroup postings) in the mid 1990s, my research has found it goes back much further than that.
Listen to this audio story about spam then go see about Spews
Nigerian Email Scam
You can forward the message to the Secret Service at this email address: 419.fcd@usss.treas.gov
In addition to the link mentioned in the message below, here are some other places where you can find information:
http://www.sec.gov/answers/nigeria.htm
http://travel.state.gov/tips_nigeria.html
http://www.state.gov/www/regions/africa/naffpub.pdf
TOOLS TO FIGHT SPAM
MailWasher
Allows you to filter and delete mail at the server, before you download it and
CAUCE
The Coalition Against Unsolicited Commercial Email is an all volunteer organization, created by Netizens to advocate for a legislative solution to the problem of UCE (a/k/a "spam") and a good place to learn about how to fight Spam.
The Network Abuse Clearinghouse
Abuse at abuse.net is another helpful website where you can sign up to forward Spam to the administrative addresses of ISPs. That is, once you are registered (for free) at abuse.net, you send your spam complaint to domain@abuse.net and the Spam gets forwarded automatically to all the admin addresses. Also see "Fight Spam on the Internet"
Sam Spade Tools
Free Software Program that help in identifying the sender of email messages
Spam Cop
Free service that is also very popular for fighting Spam.
Spamlaws.com
For an up-to-date run-down of state-by-state laws dealing with spam, and Federal bills (not yet enacted) proposed to deal with spam.
links page for a list of excellent spam-busting resources on the web. 2003 California wins first antispam judgment: Although the case was filed before the sweeping new legislation outlawing spam email in California, officials state that this $2 million fine will be a model for future spam injunctions. The lawsuit charged PW Marketing owners Paul Willis and Claudia Griffin with sending out millions of emails advertising "how to" guides on spamming and long lists of e-mail addresses. The injunction forbids Willis and Griffin from sending unsolicited commercial email and owning or advertising over the Internet any business for 10 years.
Junkbusters Corp. <> About Spam <> Free Tool that will Intercept Spam
ORDB.org Open Relay Database helps in the fight against spam or UCE.
Jodie Bernstein, director of the Federal Trade Commission's Bureau of Consumer Protection
One thing that you do *not* want to do is to reply to one of those ***ADVERTISING*** aka SPAM messages. When you reply to one of those messages - the sender knows that they have reached a valid email address... Consequently, you are likely to continue receiving those garbage messages. However, one thing that you *do* want to do is save that message! You might need it later to identify the sender. The original message contains the email headers that will help to identify the sender. If you can tell who sent you the message, you can send it to their ISP asking them for assistance in stopping the sender from sending more SPAM. Many ISPs will cancel internet accounts for users when they are reported as abusers... The biggest problem in dealing with Spam is identifying the sender. Many people who send SPAM are using email services like Juno or Hotmail or other anonymous email services. Consequently, identifying Spam senders can be almost impossible at times. The email header is where you can see where the message really originated.
TIPS on dealing with SPAM
Here are some *specific* things that might help:These first tips on dealing with SPAM are from Bob Appleton you will need to MODIFY the addresses below for the ISP of the offending message
-
NEVER respond to a spammer.
-
Here are a few of the best Spam info pages:http://spam.abuse.net/
-
"Help stop Scam Spammers!" http://www.junkemail.org/scamspam/
-
Anchor Desk "Special Spam Fighting Edition" http://www4.zdnet.com/anchordesk/story/story_index_19970819.html
Unintentional Attachments
My recent experience of playing with a half-dozen or so different email programs and what they can/can't do.
RFC's (Proposed Standards) on 'Cryptographic Message Syntax'. RFC 2142, which specifies that "abuse" is the correct address for every domain to receive abuse reports -- whether those reports pertain to abuse *by* the domain (or its customers, etc.) or *of* the domain (or its customers).
This is not only specified in the RFC, but it's a well-known best practice, and has been for years.
Unfortunately, many domains have chosen to ignore this -- or to "support" it in a way that renders it effectively unusable. Those methods include:
routing its traffic to the bit-bucket routing its traffic to an autoresponder that directs senders to use a web form -- thus deliberately making it as difficult as possible for users to report abuse, c.f. "hoop-jumping". routing its traffic to an ignore-bot using spam/virus filtering methods on the address that make it impossible to report spam/virus incidents to the address forwarding complaints to those being complained about, thus handing over victims' data to - routing its traffic to untrained/incompetent staff
whose response is either that the complaint is in error or has been resolved (Hotmail and Yahoo, are particularly well-known for this) refusing to investigate any complaint not filed by their own customers - allowing the abuse mailbox to reach its quota and reject subsequent messages (Comcast prefers this approach) and so on.
Happily, There are some exceptions to this: some operations (correctly) consider every abuse complaint as a possible indicator of a security emergency, requiring immediate attention from senior personnel until resolved. Unsurprisingly, these well-run operations don't have to
field many abuse complaints, because the same diligence and professionalism that allows them to respond promptly and effectively also enables them to pro-actively address many issues *before* abuse actually occurs. But unfortunately, these are the exceptions; the rule is that for most operations, handling abuse traffic is a reluctant afterthought at best, and thus we have...what we have.
---Rsk
The OECD Anti-Spam Toolkit
OECD urges governments and industry to do more to tackle spam
19/04/2006 - Governments and industry should step up their coordination to combat the global problem of spam, according to a new set of OECD recommendations.
Spam is dangerous and costly for business and consumers. It disrupts networks, cuts productivity, spreads viruses and is increasingly used by criminals who steal passwords to access confidential information and often bank accounts. While there is no single solution, governments and the private sector should act fast on a number of fronts. The OECD calls on governments to establish clear national anti-spam policies and give enforcement authorities more power and resources. Co-ordination and co-operation between public and private
sectors are critical, the report notes.
International cooperation is also key. Spam moves between countries and investigators have to follow the flow across borders to track spammers. To address this, OECD governments have approved a Recommendation on Cross-Border Co-operation in the Enforcement of Laws against Spam, urging countries to ensure that their laws enable
enforcement authorities to share information with other countries and do so more quickly and effectively. They should also establish a single national contact point to facilitate international cooperation.
Educating people on the risks of spam and how to deal with it is also important. Governments, working with industry, should run nationwide campaigns to raise awareness. Lessons on spam and Internet security should be included in computer courses in schools and for senior citizens.
These recommendations form part of the OECD Anti-Spam Toolkit, available online at www.oecd-antispam.org. It gives policy makers a comprehensive package of concrete regulatory approaches, technical solutions, and industry initiatives to fight spam.
The Toolkit also includes a guide to best practices for Internet Service Providers and other network operators, and for email marketing. These were produced by the Business and Industry Advisory Committee (BIAC), the business advisory group to the OECD, in co- operation with the Messaging Anti-Abuse Working Group (MAAWG), an
organization of Internet Service Providers. This is the first effort by the private sector to develop a series of common best practices at the international level.
