Security Predictions of 2004 326
scubacuda writes "Computer World's security predictions for 2004: R.a..n,d,o.,m p,u,,n,c.t,,u_a.t.1..0.n evading spam filters, Internet access filtering, better desktop management, enterprise personal firewall deployment, tools that securely scrub metadata, corporate policies against USB flash drives, Wi-Fi break-ins, Bluetooth abuses, cell phone hacking, centralized control over IM, public utility breakin publicized, government defense against cybercriminals, organized cybercrime, and a shorter time to exploitation."
Nearly impossible? (Score:4, Insightful)
Can't the spam filters just remove it all? They don't really need the punctuation to check for Viagra advertisements anyway.
Re:Nearly impossible? (Score:3, Funny)
\w[();\[\]:]\w
Re:Nearly impossible? (Score:3, Insightful)
If the spelling and grammar of the email were to be checked and weighted as part of the filtering process you'd get around a lot of the deliberate misspelling of words.
Re:Nearly impossible? (Score:3, Informative)
gives you a list of the misspelled word. You could fiddle with the capitalization rules for things like DNS, DHCP, TCP/IP etc. to lower your false positives.
We could wrap that into spamd and generate a weighted score. Problems would be speed of course as ispell would have to start up each time to check an email (is there a daemon mode for ispell or aspell?)
Anyway, I ran it on a bunch of aforementioned spam and it gives convincing results.
Of course, slashdotters would pr
Re:Nearly impossible? (Score:5, Interesting)
Why? Because it knows which combination of words, used together make it more likely the mails are for me, eg spammers only have my email address, they do not know my name... therefore any emails containing either my first name or surname (or better still, both together, will make PopFile flag the message up as "high probability non-spam mail". Of course it looks for other clues.
Anyway, if spammers do find a way to circumvent my filters (and at the moment I'm filtering spam with 99.62% accuracy) then my filtering software will be updated and will check for stupid punctuation tricks.
Re:Nearly impossible? (Score:2)
Training Bayesian filters to classify those spams with normal words increases possibility of false-positives (normal email treated as spam), which is more annoying than spam itself.
Re:Nearly impossible? (Score:3, Insightful)
- count runs of punctuation as tokens
- run a normal pass, then
- de-html-tag the text
- map "w,.o..r!#d_=s" into "words" (de-punctuate)
- run a second pass
- use individual words *and* pairs of adjacent words in the statistics database
Then we'll get even better filtering, and foil about 90% of the current techniques.Of course, then the spammers will start poking around for new techniques... But these are really easy to fix.
Re:Nearly impossible? (Score:3, Informative)
Re:Nearly impossible? (Score:2, Informative)
My solution to the punctuation and l33t-speak type spams is simply to run the incoming message through a spell checker.
Whilst lots of people make typos and use words not in my dictionary it does become obvious when the spelt-wrong/spelt-correctly ratio is high that it's likely spam.
Re:Nearly impossible? (Score:2)
At this point the spam would turn from something that's useful for at least one party (the seller/spammer) to something that's just junk floating around on the internet.
Re:Nearly impossible? (Score:3, Insightful)
Ewan
Re:Nearly impossible? (Score:2, Interesting)
Re:Nearly impossible? (Score:4, Funny)
Re:Nearly impossible? (Score:5, Insightful)
What seems slightly more workable is to ignore punctuation in the subject when checking for 'spam' words. This would fit more in line with the extremely naive filtering available to Outlook users.
Going simply by punctuation density could cause a lot of false positives based on acronyms and ellipses.
Re:Nearly impossible? (Score:4, Insightful)
It doesn't matter to the spammers if the user's filter can be trivially modified to filter out the spam. If they can get past the currently used filters, that's enough. If they keep doing this constantly, it will mean that users will have to constantly upgrade their spam filters. Many people will get tired after a while and just give up :(
Re:Nearly impossible? (Score:5, Insightful)
If you are stating that Outlook client pass/fail filters are bad because (among other flaws) they need constant updating, then you are preaching to the choir. Until Exchange gets a good scoring filter, it makes sense to at least improve the flawed tools that are available to most corporate users.
Re:Nearly impossible? (Score:3, Insightful)
I think that's about the only way my company would ever start spam-filtering in earnest: If Microsoft created an "official" (probably easily circumvented) server-side spam filter. It might still be a fight, even then.
Our "uber"-engineers and PHBs fear these server-side tools... They're afraid we'll get a false positive on the CEO's mailbox that will end up with the com
Re:Nearly impossible? (Score:3, Interesting)
Random Punctuation in spam (Score:5, Interesting)
Wow. They must have crystal balls. (Score:4, Funny)
More Of The Same!
Astounding.
Remind you of something [slashdot.org]?.
Re:Wow. They must have crystal balls. (Score:4, Funny)
Look at the bright side.
For the first time, slashdot has done a "predictions for 2004" story that doesn't have the word "SCO".
Re: Wow. They must have crystal balls. (Score:3, Funny)
> OK... so they predict... More Of The Same!
Naturally, 'cause it would take brass balls to predict something different!
randomness and other things (Score:5, Interesting)
At any rate, I doubt such punctuation will be a problem. I've already seen a good deal of it get killed with bayesian filters anyway.
The other things though - very interesting. It's not like we can't predict these things ourselves, though - it's only a mattre of time before they happen, what with the increasingly dense levels of tech in our society.
Being the thrill-seeking geek that I am, the prospect alone of bluetooth hacking (wartoothing?
I can see there being a definate increase in the need for serious, intelligent, and knowledgeable computer security staff; they'll likely start supplanting what's left of IT staff, as well as replacing some of the positions that were dumped in the last several years. After IS? Who knows. Maybe we'll be batteries by then, or maybe fighting the machines.
Spam Spam Defeatable Spam (Score:5, Insightful)
It doesn't take very much CPU to s/\W//g
Yeah! Block all email containing only graphics!
Base64 isn't hard to decode... or to just bin.
I've never seen an email with an IP address based URI that wasn't spam. Trash em
Not this user, or this user's spam filter [mirror.ac.uk]. Spams using these techniques get the highest spam scores and when 5 is worthy of trashing, 35 is worthy of laughing at (at least until I get so much spam I'll put it in /dev/null rather then ~/mail/spam)
Re:Spam Spam Defeatable Spam (Score:2)
Yes, but it takes rather more to convert | to i, @ to a, and all the other possible replacements. It's not impossible, but removing punctuation is only part of the battle.
Your whole post makes it sound like it's easy. If it were easy, we would stop a lot more spam. As it happens, it's difficult. Spammers are always going to keep ahead of the curve if they can, and as long as they're making money, they will continue to increase volume and keep on banging server CPU
Re:Spam Spam Defeatable Spam (Score:4, Interesting)
In my experience, it is. I can't remember the last time I got a false positive or negative, and I haven't even bothered training the bayesian filter.
Maybe I just get targetted by clueless spammers, but spam is not a major problem for me.
Spammers make money becuase most people don't run spam filters, and some people are clueless enough to do what the spammer wants.
While the spam might be increasing, I don't see it until I go and look in my spamtrap Maildir, and I don't expect that to change any time soon.
Re:Spam Spam Defeatable Spam (Score:2)
A dozen or so a day - and yes, I know this isn't as much as many people, but a little spam a day over time is still a lot of spam, and the filters are working well.
Re:Spam Spam Defeatable Spam (Score:5, Informative)
I get 30-120 spam a day. (old account).
Checking with my spamassassin filter, I see that it's bayesian filter is happy with 1,868,996 pieces of spam, and 386 pieces of ham (the good stuff, stuff I want to keep).
I get maybe 1 spam thru to my normal inbox a month. Which I happily feed to the sa-learn tool (spamassassin's bayesian learning tool).
I don't need any wacky products installed in my email client (which I change often).
I access my email via imap over ssl.
I use mozilla mail mostly, but have used mutt, outlook, pine, outlook express, kmail, and a large amount of others (that I've forgotten about now), all with spamassassin running happily on the mail server churning thru all incoming email.
our mail server handles 4000-10,000 pieces of email a day for all our accounts, and spamassassin barely registers as a 'blip' on our cpu usage radar.
It's really sweet.
Oh yeah, I've had only 1 false positive, and it was due to a wise-ass friend that decided to send a piece of conversational email disguised as spam from a new email address.
Re:Spam Spam Defeatable Spam (Score:4, Insightful)
To a Bayesian filter such "cleverness" is even more damning than just stating plain-out what you want to say.
Probably my legitimate mail *seldom* talks about "viagra" or "refinancing", but the rarity of those words in my mail is nothing agains the unlikeliness that I'd write "v1@gr@" or "r3f|n@nc|ng".
In other words, such clever tricks migth work. Once.
Re:Spam Spam Defeatable Spam (Score:3)
Beyond 50 people, however and I would think that what is spam/ham would start to rapidly diverge. Accounting folks have different e-mail then the customer service reps who get different e-mail from the programmers.
Plus, doing it at a workgroup / small organiz
Re:Spam Spam Defeatable Spam (Score:5, Insightful)
tr/\W//d is faster if that's perl
Re:Spam Spam Defeatable Spam (Score:5, Informative)
- Message text disguised using base64 encoding
- Uses a numeric IP address in URL
- Uses a dotted-decimal IP address in URL
- HTML has over 9 kilopixels of images
- HTML: images with 0-200 bytes of words
- HTML has a low ratio of text to image area
- The score from a bayesian filter, which would probably quickly increase for messages with tons of punctuation and still leave legit mail since you normally don't use tons of punctuation.
Spam operators might get more creative, but I still think spam removal tools are several steps ahead.
Don't put your email address online (Score:5, Interesting)
Don't put your email address online, period. Other solutions like filters only address part of the problem, because you still have to pay for the bandwidth and there's the problem of false positives. I wrote a little Javascript Turing email obfuscator [ernet.in], which prevents renders your email address invisible to bots, even those that can execute javascript.
An ounce of prevention...
Re:Don't put your email address online (Score:5, Insightful)
That's like saying "Don't go out after 9pm or you deserve to get beaten/raped".
Sorry, but my instincts are to fight the spamming bastards rather than give in to them.
Re:Don't put your email address online (Score:2, Interesting)
I never said anything about not fighting spammers. Please do fight them. But at the same time, also protect yourself. What you're saying is more like: "I'll go out at night alone and unarmed and I'll fight if I'm attacked." I'm just saying take a gun with you.
Not putting your email online doesn't mean not giving it out at all. It just means don't put it in nice cleartext which spambots can harvest. Obfuscate it so that humans can still gets it while bots can't.
Re:Don't put your email address online (Score:2)
Re:Don't put your email address online (Score:2)
Google for "blog spam". There are bots going around looking for Submit links in the most popular blogs and spamming them. Its probably only a matter of time before they extend that to the whole of the web.
Re:Don't put your email address online (Score:5, Insightful)
It comes down to a choice:
I don't want to put barriers in people's ways when they wish to contact me (OK, sometimes I do - 'No I will not fix your computer! I don't even know you!' - but generally I don't). Making people use a JavaScript enabled web browser AND answer a question is a barrier, and I don't want it.
Re:Don't put your email address online (Score:2)
You may want to consider two things though:
Don't use your email online (Score:5, Funny)
Don't use your email address, period. Other solutions like filters only address part of the problem, I wrote a little Javascript Turing email blocker , which prevents you using email!
No more email means no more spam, spam harvesters use viruses that collect email adresses from the computers of people that know you.
People that don't know how to use bcc spread your adress all over the net. So dont give out your email adress at all. Just send lonely test messages to yourself. mmm, a dictionary attack could still find you..... Stop checking your email!!!
Problem solved.
An ounce of prevention...
Re:Don't use your email online (Score:2)
I was talking about making your email address invisible to bots, not humans.
Wait.. maybe you're a bot? Yes, that would explain everything.
easy-to-defeat (Score:2)
Re:easy-to-defeat (Score:2)
What usually happens in a dictionary attack is you try a whole dictionary and get several thousand hits. That doesn't work here.
Re:easy-to-defeat (Score:2)
1- aim a large provider (sympatico.ca, uol.com.br, aol.com, and so on)
2- do a dictionary atack and log every address that responds "250".
3- build a spam list
4- sell it on CD
5-
6- profit
if it looks too professional and organized for a spammer i have bad news: they ARE getting professional and organized. even low-live scums like spammer can pull this out. mafia does. why can't spammers ?
well, (Score:2)
Re:Don't put your email address online (Score:4, Funny)
I wrote a little Javascript Turing email obfuscator, which prevents renders your email address invisible to bots, even those that can execute javascript.
That only works for people who think that sending you e-mail is such an enormous honor that they're willing to jump through flaming hoops backwards to accomplish it. The first spammer that's desperate enough to "decrypt" your e-mail address will add it to an address list and that's the end of that chapter.
Ever notice how entities that erect all sorts of extraneous barriers to communicating with them tend to get your blood boiling? I call it the "you must fax us this form in triplicate with a notarized form and a copy of your driver's license during office hours in Burma on the third tuesday of April during a leap year that doesn't have the number six in it"-syndrome.
Re:Don't put your email address online (Score:2)
Doesn't help you with a brute force or dictionary attack. Those are popular these days.
Re:Don't put your email address online (Score:2)
Anyway, not every client has JavaScript enabled. That's why I wrote something server-side: SpamJavelin [adyx.co.uk] - it puts trace digits into your virtually-hosted {anything_you_like_before_the_at_sign@mypatch.myis p.co.uk} e-mail address to indicate where and when it was picked up. You then know the IP address used by whoever found your email address {and the time o
Re:Don't put your email address online (Score:2)
You might have entered an empty string as one of the values?
Your javelin idea sounds pretty good, but what happens when spammers eventually get a thousand addresses from your domain, so your bandwidth multiplies thousandfold? (though you block all of it). If you're using a free online email service rather than your own server you're fine I guess :)
Desktop management (Score:3, Funny)
Re:Desktop management (Score:3, Insightful)
This is understandable. There is a lot to read.
But in the end it will be possible to protect the systems against the user (somewhat) and still be able to manage them, even defragment.
So keep on studying!
Re:Desktop management (Score:2)
This is understandable. There is a lot to read.
But in the end it will be possible to protect the systems against the user (somewhat) and still be able to manage them, even defragment.
So keep on studying!
And I thought the main selling point of Windows was that it was easy enough that any baboon could install/user/administer it. If that is not actually true, wouldn't it make more sense to just install Linu
Re:Desktop management (Score:2)
Usually, when folks claim the contrary they then come up with issues like those in the parent article.
I.e. they think it is simple, but that is only because they have not yet discovered the complexity. Kind of like considering a Mars rover simple because it is just a bouncing ball that unfolds and releases a radio controlled car that drives around.
Comment removed (Score:5, Interesting)
Comment removed (Score:5, Interesting)
Re:Forget the flash drives... think USB HARD DRIVE (Score:2)
Thankfully I havent lost any of my USB drives, I usually securely wipe them every few weeks JIC.
512 MB is very damaging, what corporations are scared of, are the copying of sensitive documents. Documents such as network diagrams, disaster recovery plans, security plans etc etc are usually no larger than 10 megs, but could deliver a damaging blow to business confidentality concerns.
I'm see
Re:Forget the flash drives... think USB HARD DRIVE (Score:5, Insightful)
heh (Score:2)
Why on earth did they expand "GIF" the
What I encountered yesterday (Score:5, Interesting)
From: Noah Poe
Date: Sun, 04 Jan 2004 15:58:49 -0600
To: a.konrad@aon.at
Subject: canberra happen
aides bone emmanuel rumania persistent josephine pencil majesty bottom
anarch molecular cafe hepburn done ellipsoid monoceros chokeberry pungent decontrolled
orphanage keel cessna lippincott drugstore onion inclement empire
This is just sick.
Re:What I encountered yesterday (Score:2, Interesting)
And really, even if you use a Bayesian filter, how many emails contain the words "majesty" "ellipsoid" and "lippincott"? Is it really a problem to have these associated with spam? As long as you need a few of them to trig
Re: What I encountered yesterday (Score:2, Funny)
> And really, even if you use a Bayesian filter, how many emails contain the words "majesty" "ellipsoid" and "lippincott"?
Why, just yesterday I got one that said "Her Majesty wants you to polish the ellipsoid on her Lippincott, and then bring it around front."
I wondered what those were... (Score:2, Interesting)
neglecter appease luis seagram bratwurst bluet
burgundian seamstress adair embolden frontal
rhodonite bitwise neither clara mercy footstool delivery
or how about....
Subject: dewdrop
perspicuous dinosaur fluency depart colombia oaken balfour odometer
because propel bead cowry nihilism
melanesia down mccluskey cryostat elena alphameric
----
I wondered what these emails were, but trying to poison spam filters seems correct. I figured spammers were doing it, but I thought the reason was j
Re:What I encountered yesterday (Score:4, Interesting)
As for spammers training your filter to accept spam, I think the spammers would have to be really sophisticated to pull that off. They would have to guess which words show up in your legitimate email but not in your spam. For my work email, for example, that would probably be things like technical jargon, coworkers' names, product names - stuff the spammers won't be able to guess (and that will vary from one person to the next). So even if spammers add random dictionary words to their spams, there will still be individual words that are far more common in legitimate email than they are in spam, and the spammers' plot will fail.
Re:What I encountered yesterday (Score:4, Informative)
HTML (Score:3, Funny)
Dumb question - spell check the incoming mail? (Score:5, Interesting)
It'd also have the added bonus of keeping idiots who can't spell worth crap out of your inbox. And since it would work off a dictionary (preferably the same one as your outgoing spell checker, if equipped), you could always add whatever names, phrases, and abbreviations you wanted, while still keeping the "0MG L1EK MAK UR P3N0R 9 INCHZ LONGR!!" crap out of your inbox.
Surely we have the ability to create something like this. So where is it?
Re:Dumb question - spell check the incoming mail? (Score:3, Interesting)
To: Employee@work.com
Priority: Extremely Urgent
Michael,
The TPS report for 3Q03 NPT TLAs is late. Please attach HEL and HPQ-4 to GNAA and send (w/TPS) to VP of Ops by EOD.
Thx, Ackbar
On random punctuation (Score:5, Interesting)
One of the requirements (coming from "concerned parents", of course) was to filter out swearing in the chat rooms. So if someone typed in, say, "you're a shit", what would actually appear for everyone else would be "you're a $!%^" or something similar.
Eventually, of course, we got into an arms race with the kids, who would write "sh1t", "s.h.i.t", "sh*t" and so on.
However, I came up with a program which generated a regexp which matched pretty much all the variations, and - to date - none of the kids have worked out a way around it.
This is how it worked.
(Actually, I can send anyone the original regexp generator code if they're interested - just mail me).
The basic concept was to use a table of "equivalences", for, eg. "a" => [ "@", "4", "A", ....], "f" => [ "ph", .... ]
For each swear word we generate a regexp with (r1|r2|r3|...) for each letter in the bad word, where r1, r2, r3, ... are the list of
equivalences for that letter.
That produces a list of swear word - matching regexps which we then combined into a super mega regexp which would match any of the 50 or so banned words.
One interesting thing is that you can end up with a regexp which is too big for GNU regexp to handle ... But there are ways to get round
that and you can code it up as a flex parser
too which doesn't have any limits as far as I
can tell.
The actual code is slightly more complex and does a few more things than above (eg. it works for "s.h.1.t" too, or even "s---h--1----------t". And it has a concept of "obliterator characters", so "sh*t" can be banned also.
If anyone's interested I can send the code.
Rich.
Re:On random punctuation (Score:3, Funny)
Filters like that ruin normal text.
Re:On random punctuation (Score:5, Funny)
Whale oil beef hooked (Score:3, Funny)
Re:On random punctuation (Score:2, Insightful)
What if some tries things like 'fcuk' or the like? Does it work also? Think of that english research done lately where it says it doesn't make much difference in which order the letters are, as long as the beginning and ending letter are correct. More about that here [cam.ac.uk].
Re:On random punctuation (Score:2)
(That's a famous trademark in the UK, though :-)
It does work on things like fu(k though.
Rich.
Re:On random punctuation (Score:3, Funny)
Re:On random punctuation (Score:3, Informative)
It handles this case correctly. There is actually some extra code I added to handle cases like this (specifically the word "scrape").
Basically the regexp is modified so it only matches at either the beginning or the end of a word, using word boundary matching. Not completely ideal, but good enough.
Rich.
Re:On random punctuation (Score:2)
Clever algorithm, but...
Someone paid you to make sure kids couldn't see swear words they already know well enough to type in??? Have we gotten this ridiculous in our attempts to "Protect The Children(tm)"?
Re:On random punctuation (Score:2)
However, I was doing my job and getting paid for it ...
If it helps to make a small dent in the quantity of v1@gra spam, then so much the better though.
Rich.
Random punctuation (Score:4, Informative)
bayesian filters aren't fooled so easily (Score:5, Informative)
Re:bayesian filters aren't fooled so easily (Score:2)
(there is a short message about losing weight, some link to a site, and then a long text that is not at all related to the spam)
I suppose this is being done to fool the Bayesian filters.
Corporate IM (Score:4, Insightful)
I expect the new IM worms to be the next major disaster to these tech companies, just like Slammer was for their unmanaged MS SQL installations.
It surprised me that noone listened to my suggestions on setting up an internal server. OK, not every luser knows IRC, but surely there are many IMs that can be set up to use an internal server and block everything else at the firewall. We tried the Lotus Notes clone of AOLs AIM and it sucked (as everything Notes), apart from using encrypted line data.
I remember trying to get hold of a senior developer I was working with using plain old talk in a terminal and he didn't know it... He got the notification in his shell and called me instead. Sort of explains the renaissance of these dummy IM clients.
defeating random punctuation (Score:5, Interesting)
I'm not as good as him but I'm sure this can be done quite easily in perl with regexes.
Re:defeating random punctuation (Score:3, Insightful)
Short, broken, or oddly punctuated sentences, such as this, may wrongly trip the rule.
There are 1,000,000s of examples, of which this is 1.
Still, it's ugly English, so should perhaps be condemned as such and consigned to the spam-bin anyway.
More serious is how to define a sentence - if it's a phrase terminated with a period, then random punctuation is likely to generate many short sentences, and a sufficiently dedicated spammer ought to be able to bias the 'random' punctuation to defeat a conserva
Re: defeating random punctuation (Score:5, Funny)
> My boss (hardcore BSD hacker and anti-spam activist) added a simple rule to our spam filters: more than 5 consonants in a row in the From: field and it's tagged as spam.
Hope he's not expecting any important messages from anyone born in Eastern Europe...
My predictions... (Score:3, Funny)
Anti-Obfuscation script (Score:4, Informative)
- cnb
My Prediction: the first OS X virus/worm appears (Score:2, Interesting)
Its not mindshare, its UNIX box with no admin (Score:2)
New email protocol? (Score:2, Interesting)
Email, right now, is not very restrictive. Up the standard, and you'll have many more constraints within which to work.
People have been calling for a p2p solution to email for a while, which presents its own challenges, but does suggest that those in the know are open to change.
Just a thought...
Other comments: Duh! (Score:3)
Personal firewalls; yes more people will use them. In some cases, they will be important, though the rules of if it isn't running it can't be exploited and less is more are much more effective on an intranet. Firewalls add management issues that can be avoided with careful use of tools like Nessus to audit your network. That said, limited and careful of local firewalls is a good idea if you've already taken the proper steps and the user has an identifiable need.
Even worse than random punctuation: Random HTML (Score:3, Interesting)
The following is an example:
<Aegf>Bigger</gorR>><feakj> feet today!<alefa>
I have to admit, its rather effective in tricking many spam filters. Most spam filters can't tell the difference between real and fake HTML. Additionally, most HTML rendering engines automatically skip the false HTML, and still show the spam message.
Sunny Dubey
w.r.t. filtering (Score:2, Funny)
email filters (Score:2, Funny)
blocking all spam is like saying the RIAA can stop you from burning a cd. its just not going to happen
Security headlines we need (Score:3, Insightful)
Three major spammers began their sentences today at the U.S. Federal Penitentiary at Allenwood, Pennsylvania. Their Romania-based operation had created several well-known viruses to assist in sending spam by breaking into the computers of others. Each was initially charged with 12,346,000 violations of the Computer Fraud and Abuse Act. The leader was also charged with operating an ongoing criminal enterprise. FBI and Homeland Security investigators located the spammers, and the U.S. Department of State arranged for their extradition to the US for trial. All pled guilty to reduced charges after being convinced that they could be put away for life. The leader will serve 25 years, and his assistants will serve 15 years each.
Over the last several years, NSA has quietly been enhancing NSA Secure Linux, and has now released a secure Linux distribution for general use by U.S. Government sites. In this system, information coming in from the Internet is automatically held at a low level of trust, and cannot corrupt other information on the machine. A compatible secure browser, mail server, web server, and DNS server are provided. Free, open source copies of this code are available.
New York State Attorney General Elliot Spitzer announces a $12.6 billion verdict against Microsoft in the "Blaster VIII" case. The court held that Microsoft violated New York's "reckless endangerment" law by distributing web browsers which automatically opened content that might contain viruses, resulting in the distribution of the "Blaster VIII" worm to over 200 million computers worldwide.
Dell today announced the recall of 1.2 million computers for a security flaw. Fear of a liability lawsuit prompted the move.
They forgot a few... (Score:3, Funny)
better predictions (Score:3, Funny)
Ironically, my own prediction isn't much different:
In 2004, lots of interesting things will happen in security, and none of the things that would matter will change. Instead, a lot of time, money and effort will be thrown at the wrong non-solutions.
i.e. more of 2003, or 2002, or 2001,
dictionary words in bare mime part (Score:3, Informative)
conduit horse house press lingo technical gelatin overlord brown uniform
In the muli-media portion you'll see spam like never before.
How to stop these? You can't train a bayes database with dictionary words as it would eventually defang the whole method. Your only option I suppose would be to compare the contents of the multi-media portion with the 7-bit ASCII portion and see if they match. Problem here is to make the comparison fuzzy enough to allow for multi-byte characters and stuff like that.
The words thing about this type of spam is that at best your bayes database is circumvented, but at worst it is trained to see good words as bad or bad words as good and is rendered useless.
With SpamAssassin it is easy to set when to auto-train your bayes backend and when not to. I have my required_hits option set to '4.0' so I would use the following settings;
use_bayes 1
auto_learn 1
auto_learn_threshold_spam 7
auto_learn_threshold_nonspam -5.5
With this I am reasonably confident that I am not training my bayes database with good words as bad unless it really is found to be spam impirically, and inverse unless I am sure it's a good e-mail, typically by means of AWL or whitelist_from.
If anybody has solved this, I would be very grateful to hear what you did and how you did it.
Clogging up the spammers (Score:5, Interesting)
Anyone in the 240 and 416 area codes that feels like clogging up someone's fax machine with tubgirl and goatse?
Here's the meat of this junk (I removed several hundred asterisks):
--quote begins--
DON'T YOU WANT TO KNOW!
PURCHASE OUR Email Addresses Directory ONLY
IF YOU WANT TO PURCHASE OUR Email Addresses Directory with
525 MILLION in 5-disk set.
Complete package 5-disk set only $99.00!!
DO NOT REPLY TO THIS EMAIL ADDRESS. TO ORDER, READ BELOW:
Fill out the Form below and fax it back to
1-240-371-0672 OR 416-467-8986
Re:Spam IS a security issue (Score:4, Insightful)
Re:Spam ISN'T a security issue (Score:2)
DDoS is a security issue -- spam or no spam. The number and bulk of messages sent to the mail servers I deal with are legitimate and the excess of spam is manageable though annoying so it does not rise to the level of a DoS though if you want to push it it is theft.