Security Predictions of 2004 326
scubacuda writes "Computer World's security predictions for 2004: R.a..n,d,o.,m p,u,,n,c.t,,u_a.t.1..0.n evading spam filters, Internet access filtering, better desktop management, enterprise personal firewall deployment, tools that securely scrub metadata, corporate policies against USB flash drives, Wi-Fi break-ins, Bluetooth abuses, cell phone hacking, centralized control over IM, public utility breakin publicized, government defense against cybercriminals, organized cybercrime, and a shorter time to exploitation."
Random Punctuation in spam (Score:5, Interesting)
randomness and other things (Score:5, Interesting)
At any rate, I doubt such punctuation will be a problem. I've already seen a good deal of it get killed with bayesian filters anyway.
The other things though - very interesting. It's not like we can't predict these things ourselves, though - it's only a mattre of time before they happen, what with the increasingly dense levels of tech in our society.
Being the thrill-seeking geek that I am, the prospect alone of bluetooth hacking (wartoothing?
I can see there being a definate increase in the need for serious, intelligent, and knowledgeable computer security staff; they'll likely start supplanting what's left of IT staff, as well as replacing some of the positions that were dumped in the last several years. After IS? Who knows. Maybe we'll be batteries by then, or maybe fighting the machines.
Don't put your email address online (Score:5, Interesting)
Don't put your email address online, period. Other solutions like filters only address part of the problem, because you still have to pay for the bandwidth and there's the problem of false positives. I wrote a little Javascript Turing email obfuscator [ernet.in], which prevents renders your email address invisible to bots, even those that can execute javascript.
An ounce of prevention...
Re:Nearly impossible? (Score:5, Interesting)
Why? Because it knows which combination of words, used together make it more likely the mails are for me, eg spammers only have my email address, they do not know my name... therefore any emails containing either my first name or surname (or better still, both together, will make PopFile flag the message up as "high probability non-spam mail". Of course it looks for other clues.
Anyway, if spammers do find a way to circumvent my filters (and at the moment I'm filtering spam with 99.62% accuracy) then my filtering software will be updated and will check for stupid punctuation tricks.
Re:Nearly impossible? (Score:1, Interesting)
Why not filter out spam by anything with > 3 periods, and/or commas?
Quick and simple work around, right?
Comment removed (Score:5, Interesting)
What I encountered yesterday (Score:5, Interesting)
From: Noah Poe
Date: Sun, 04 Jan 2004 15:58:49 -0600
To: a.konrad@aon.at
Subject: canberra happen
aides bone emmanuel rumania persistent josephine pencil majesty bottom
anarch molecular cafe hepburn done ellipsoid monoceros chokeberry pungent decontrolled
orphanage keel cessna lippincott drugstore onion inclement empire
This is just sick.
Dumb question - spell check the incoming mail? (Score:5, Interesting)
It'd also have the added bonus of keeping idiots who can't spell worth crap out of your inbox. And since it would work off a dictionary (preferably the same one as your outgoing spell checker, if equipped), you could always add whatever names, phrases, and abbreviations you wanted, while still keeping the "0MG L1EK MAK UR P3N0R 9 INCHZ LONGR!!" crap out of your inbox.
Surely we have the ability to create something like this. So where is it?
Re:Don't put your email address online (Score:2, Interesting)
I never said anything about not fighting spammers. Please do fight them. But at the same time, also protect yourself. What you're saying is more like: "I'll go out at night alone and unarmed and I'll fight if I'm attacked." I'm just saying take a gun with you.
Not putting your email online doesn't mean not giving it out at all. It just means don't put it in nice cleartext which spambots can harvest. Obfuscate it so that humans can still gets it while bots can't.
On random punctuation (Score:5, Interesting)
One of the requirements (coming from "concerned parents", of course) was to filter out swearing in the chat rooms. So if someone typed in, say, "you're a shit", what would actually appear for everyone else would be "you're a $!%^" or something similar.
Eventually, of course, we got into an arms race with the kids, who would write "sh1t", "s.h.i.t", "sh*t" and so on.
However, I came up with a program which generated a regexp which matched pretty much all the variations, and - to date - none of the kids have worked out a way around it.
This is how it worked.
(Actually, I can send anyone the original regexp generator code if they're interested - just mail me).
The basic concept was to use a table of "equivalences", for, eg. "a" => [ "@", "4", "A", ....], "f" => [ "ph", .... ]
For each swear word we generate a regexp with (r1|r2|r3|...) for each letter in the bad word, where r1, r2, r3, ... are the list of
equivalences for that letter.
That produces a list of swear word - matching regexps which we then combined into a super mega regexp which would match any of the 50 or so banned words.
One interesting thing is that you can end up with a regexp which is too big for GNU regexp to handle ... But there are ways to get round
that and you can code it up as a flex parser
too which doesn't have any limits as far as I
can tell.
The actual code is slightly more complex and does a few more things than above (eg. it works for "s.h.1.t" too, or even "s---h--1----------t". And it has a concept of "obliterator characters", so "sh*t" can be banned also.
If anyone's interested I can send the code.
Rich.
Re:What I encountered yesterday (Score:2, Interesting)
And really, even if you use a Bayesian filter, how many emails contain the words "majesty" "ellipsoid" and "lippincott"? Is it really a problem to have these associated with spam? As long as you need a few of them to trigger the filter I don't see how this is going to cause false positives. In effect, the spammers are tagging their junk for us. Handy
Lourens
I wondered what those were... (Score:2, Interesting)
neglecter appease luis seagram bratwurst bluet
burgundian seamstress adair embolden frontal
rhodonite bitwise neither clara mercy footstool delivery
or how about....
Subject: dewdrop
perspicuous dinosaur fluency depart colombia oaken balfour odometer
because propel bead cowry nihilism
melanesia down mccluskey cryostat elena alphameric
----
I wondered what these emails were, but trying to poison spam filters seems correct. I figured spammers were doing it, but I thought the reason was just to spite us all. I'm sure people are doing this to email addresses and selling lists of "prepared email addresses" with compromised spam filters for extra message penetration panel sandman eyeglass conclusion inhibition globular irrigate -- er, sorry... yes, yes I have been checking my mail lately, why do you ask?
Re:What I encountered yesterday (Score:4, Interesting)
As for spammers training your filter to accept spam, I think the spammers would have to be really sophisticated to pull that off. They would have to guess which words show up in your legitimate email but not in your spam. For my work email, for example, that would probably be things like technical jargon, coworkers' names, product names - stuff the spammers won't be able to guess (and that will vary from one person to the next). So even if spammers add random dictionary words to their spams, there will still be individual words that are far more common in legitimate email than they are in spam, and the spammers' plot will fail.
defeating random punctuation (Score:5, Interesting)
I'm not as good as him but I'm sure this can be done quite easily in perl with regexes.
Re:Spam Spam Defeatable Spam (Score:4, Interesting)
In my experience, it is. I can't remember the last time I got a false positive or negative, and I haven't even bothered training the bayesian filter.
Maybe I just get targetted by clueless spammers, but spam is not a major problem for me.
Spammers make money becuase most people don't run spam filters, and some people are clueless enough to do what the spammer wants.
While the spam might be increasing, I don't see it until I go and look in my spamtrap Maildir, and I don't expect that to change any time soon.
Comment removed (Score:5, Interesting)
Re:Dumb question - spell check the incoming mail? (Score:3, Interesting)
To: Employee@work.com
Priority: Extremely Urgent
Michael,
The TPS report for 3Q03 NPT TLAs is late. Please attach HEL and HPQ-4 to GNAA and send (w/TPS) to VP of Ops by EOD.
Thx, Ackbar
My Prediction: the first OS X virus/worm appears (Score:2, Interesting)
New email protocol? (Score:2, Interesting)
Email, right now, is not very restrictive. Up the standard, and you'll have many more constraints within which to work.
People have been calling for a p2p solution to email for a while, which presents its own challenges, but does suggest that those in the know are open to change.
Just a thought...
Even worse than random punctuation: Random HTML (Score:3, Interesting)
The following is an example:
<Aegf>Bigger</gorR>><feakj> feet today!<alefa>
I have to admit, its rather effective in tricking many spam filters. Most spam filters can't tell the difference between real and fake HTML. Additionally, most HTML rendering engines automatically skip the false HTML, and still show the spam message.
Sunny Dubey
Re:Nearly impossible? (Score:2, Interesting)
Re:Nearly impossible? (Score:2, Interesting)
Nonsense, if you [need to] keep changing your filter, the spammers need to keep changing their tricks, too. At worst, this situation is a stalemate. When you get to the point where you no longer try to avoid the spam, then the spammers have won.
In an unrestricted e-mail world, this will simply remain as a little competive ecosystem. Plenty of lesser spammers will be caught by your existing filters, just like your body rejects the old germs you've already been exposed to. Sometimes, new germs come along and trigger a fresh immune reaction, and you need a little time to adjust, but at least you don't have to actively fend off every existing bug all the time. And your experience with a new germ can be input for a vaccine that will protect others in advance. Your (or somebody else's) experience with new spam tricks has the same potential communal benefit. The spam filters are improved, the updates are broadcast, and you might never notice the uptick in the ongoing state of spam warfare.
Re:Nearly impossible? (Score:3, Interesting)
Re:Forget the flash drives... think USB HARD DRIVE (Score:2, Interesting)
Clogging up the spammers (Score:5, Interesting)
Anyone in the 240 and 416 area codes that feels like clogging up someone's fax machine with tubgirl and goatse?
Here's the meat of this junk (I removed several hundred asterisks):
--quote begins--
DON'T YOU WANT TO KNOW!
PURCHASE OUR Email Addresses Directory ONLY
IF YOU WANT TO PURCHASE OUR Email Addresses Directory with
525 MILLION in 5-disk set.
Complete package 5-disk set only $99.00!!
DO NOT REPLY TO THIS EMAIL ADDRESS. TO ORDER, READ BELOW:
Fill out the Form below and fax it back to
1-240-371-0672 OR 416-467-8986