Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
Security Businesses Google The Internet IT

Google Says Spam, Virus Attacks to Get More Clever 108

Posted by CmdrTaco from the also-good-feels-good dept.
eweekhickins writes "Google's Postini team says new attacks will take the form of sneaky viruses that will blend with spam, leveraging specific current events, such as the Super Bowl or the Summer Olympic Games. Better yet, virus attacks will target executives at companies whose intellectual property is deemed valuable on the black market. A lot of these attacks will masquerade as legitimate business agencies, such as the Internal Revenue Service, the Better Business Bureau and the SEC."
This discussion has been archived. No new comments can be posted.

Google Says Spam, Virus Attacks to Get More Clever More

Google Says Spam, Virus Attacks to Get More Clever

Comments Filter:

  • And you know (Score:5, Insightful)

    by WindBourne ( 631190 ) on Monday March 10, 2008 @11:40AM (#22703018) Journal
    that these will be successful. So many suckers, so little time.

    • Re:And you know (Score:5, Insightful)

      by Brian Gordon ( 987471 ) on Monday March 10, 2008 @11:46AM (#22703166)
      I'm thinking the suckers are the ones paying these guys to wildly speculate about things everyone suspects..

    • Re: (Score:2, Insightful)

      by KublaiKhan ( 522918 )
      Absolutely. The IRS ones, especially, are bound to be extremely successful this year, as everyone knows about the little bonus coming sometime in May, so a little phishing trip to "confirm your details" on an official-looking website will likely take in a few hundred folks...

      • Re: (Score:3, Funny)

        by Brian Gordon ( 987471 )
        A few hundred? You are aware that there are at least ten thousand people connected to the internet..
      • My mother has already been targeted this way, although via phone.

      • phishing attacks against irs.gov (Score:4, Interesting)

        by swm ( 171547 ) <swmcd@world.std.com> on Monday March 10, 2008 @12:45PM (#22704384) Homepage
        I've already seen two of these.
        One was an ordinary phishing attack.
        The other gave a URL in a valid subdomain of irs.gov
        So either
        - the attack was broken (certainly possible)
        - the attack was relying on DNS cache poisoning or compromised servers
        • It's also possible that it just looked like a text link to IRS.gov. I've seen a fair bit of spam these days that looks like it has a text link to a proper eBay domain name, but the text of the link is not the same as the URL that is actually linked. In other words, it just LOOKS like a proper link, but really sends you off to some offshore webhost.

          Thunderbird is pretty good about noticing those types of problems -- if the linked domain doesn't match it'll give a warning message.
      • 1. Run virus 2. Virus changes DNS settings to poisoned server 3. Virus deletes itself 4. Profit! The more I think about it, the more potent this attack is - no antivirus will help you. Yikes.

    • Re: (Score:2)

      by ArcherB ( 796902 ) *

      And you know...
      that these will be successful. So many suckers, so little time./quote.

      Not with me. I us Linux and get my meds from my doctor (or local dealer, depending on the "med").

      • Re: (Score:2)

        by ArcherB ( 796902 ) *
        PIMF! Must be on the meds again!

        And you know...
        that these will be successful. So many suckers, so little time.
        Not with me. I use Linux and get my meds from my doctor (or local dealer, depending on the "med").

        (that looks better)

        • Re: (Score:1, Funny)

          by Anonymous Coward
          seriously... slashdot should provide us with some way to "preview" our comments before submitting.

          j/k
    • how at the end it asks you to click a link to download the full report. (ITS A TRAP!!)
    • I dunno, I think everyone should go home and disregard this story.

      -quietly takes notes on the techniques Google outlines...- mmm, SEC, eh? Excellent plan...
  • It's also recently been reported that users are becoming more idiotic.

  • SSDD (Score:4, Interesting)

    by SnoopJeDi ( 859765 ) <snoopjedi@@@gmail...com> on Monday March 10, 2008 @11:46AM (#22703150)

    These attacks will masquerade as legitimate business agencies


    The bastards!! I'd better warn my associates in South Africa.

    Seriously, TFA comes off as a padded version of "uhm, so...they're probably going to keep finding new ways to do this...since that's what they already do". The report itself looks to hold a little more substance, but then, I guess it's hard to make news out of spam that doesn't involve a big shift in the court, because it's pretty boring by definition.

    • Re: (Score:1)

      by jay-za ( 893059 ) *

      The bastards!! I'd better warn my associates in South Africa.
      I think you mean Nigeria. In South Africa the worst they will do is rape you, then murder you, then steal everything you have. They haven't moved on to the serious stuff like masquerading as legitimate business agencies yet.

  • You don't say? (Score:5, Funny)

    by Rob T Firefly ( 844560 ) on Monday March 10, 2008 @11:48AM (#22703182) Homepage Journal
    Damn, my entire security plan really depended on them suddenly getting really really stupid. If the scammers suddenly forgot how to send email, switch on a computer, or breathe air my life would be so much easier.

    • What happened to "Bayesian Filters"... (Score:4, Interesting)

      by Joce640k ( 829181 ) on Monday March 10, 2008 @03:14PM (#22707172) Homepage
      Whenever I mentioned spam a few years ago all the geeks would tell me that Bayesian Filters would totally solve the problem.

      What happened?

      • Re: (Score:3, Informative)

        by Plutonite ( 999141 )
        The geeks discovered that Bayesian filters do a reasonable learning job, but like all simple things in AI, fail the Turing test? To be fair, detecting SPAM is objectively less difficult than deciding on "humanness" because of the nature of email. While it is a very hard problem, Google and many other mail servers have recently become very proficient at spam blocking, but not perfect.

        In conclusion: whenever you hear the word "totally solve" being associated with anything involving uncertain/probabilistic rea
      • Those who use personal Bayesian filters typically don't have a visual spam problem anymore. Those who use a shared statistical system which depends on the data from several people still have some problems due to inherent inconsistencies between people's opinions of what is spam. Those who don't use proper Bayesian filters tend to see the fact that they themselves receive gibberish as proof that Bayesian filters generally have failed...

  • Crims get more entrepreneurial (Score:5, Informative)

    by EmbeddedJanitor ( 597831 ) on Monday March 10, 2008 @11:48AM (#22703202)
    Who's suprised that the crims get more clever about the way they craft their attacks? As it gets harder to fool people with fake Viagra ads and bank phishing and other lower hanging fruit, it makes sense to start putting more effort into targeting the bigger prizes. More effort sure, but better prizes too.

    Crims have always been good at adapting and exploiting conditions. The Mafia really got their power due to exploiting the prohibition. Cable thieves in South Africa are using rolling blackout schedules to plan their cable thefts.

    As more business services are done online it makes sense to phish for more than some lame paypal accounts.

    • Re: (Score:3, Insightful)

      by LurkerXXX ( 667952 )
      No one should be surprised at all. Everything in that /. topic that google says is going to happen has already happened. Those exploits have already been tried. This is not news. This is not a prediction. This is a newsflash that the sky is likely to be blue tomorrow.

    • /. emails. (Score:3, Funny)

      by antdude ( 79039 )
      Soon we will have /. phishing e-mails like "Cmdr. Malda wants to know your password so he can test something with your account!"
  • Should we expect reports of the sky being blue, unless it's cloudy? Water wet, rocks hard, that sort of thing?

    IT systems are increasingly complex, security is still an after-thought on products (instead of a core design consideration), and there's also the simple economies of scale; what was tens of thousands of targets, became millions of targets, and is now probably billions. A simple crack that works on 0.001% of the systems will still be cost-effective for whatever the net result is, most likely.

    And?

    • Water wet, rocks hard, that sort of thing?

      To my pedantic mind, these are poor examples. Water is not wet, instead objects immersed in water become wet. And as for rocks being hard, it depends on the rock. Talc for example is a very soft rock, scratchable by glass, a knife or even a fingernail. See Moh's work [wikipedia.org] (he figured all this out a while ago.)

  • Postini's a relatively recent Google acquisition. I'm not sure it's fair to say "Google this" and "Google that" when the agreement to acquire Postini is less than a year old. The spokesperson was probably just speaking for their own team and from their own culture.
    • Google's name and logo is on the report linked to in TFA, so I'd assume it IS fair to say that.

      Plus, I imagine a year is an eternity at Google.

  • Well, which is it? (Score:5, Funny)

    by mcmonkey ( 96054 ) on Monday March 10, 2008 @11:51AM (#22703260) Homepage

    A lot of these attacks will masquerade as legitimate business agencies, such as the Internal Revenue Service, the Better Business Bureau and the SEC.

    Will these attacks masquerade as legitimate business agencies, or as agencies such the Internal Revenue Service, the Better Business Bureau, and the SEC?

  • ASCII art (Score:5, Interesting)

    by Nimey ( 114278 ) on Monday March 10, 2008 @11:51AM (#22703276) Homepage Journal
    I've been getting a few spams lately that are ASCII art advertising for "viagra". Fairly clever way of getting past the filters, anyway.
    • That sounds really disturbing.

      • Re: (Score:2)

        by Nimey ( 114278 )
        Not a picture as such. It's more like the output of banner(1), but the characters are smaller and smoother.
    • I got that one also. Thought it was clever enough that I took a screenshot of it before marking it as Spam. (I obscured the URL, though, in case I post it online.)

    • Re: (Score:1)

      by ohtani ( 154270 )
      I just got this the other day too in my Yahoo! mail box. This should be interesting in seeing how spam filters detect this.

      It's quite doable, but the question is if it can determine if the text is indeed ascii art.
  • Hmmmmm... [slashdot.org] I wonder why that [pcmag.com] may be?

  • Wait, isn't this already the case? (Score:3, Informative)

    by grasshoppa ( 657393 ) on Monday March 10, 2008 @11:54AM (#22703316) Homepage
    We already see this behavior. Phishing anybody? How many of us get "BRITTAANNYIES OUT LATE NIGHT PARTYING" emails?

  • How? (Score:2)

    by Phroggy ( 441 )
    How can Postini/Google possibly know what strategies spammers intend to pursue? It seems unlikely that the spammers would volunteer this sort of information ahead of time.

  • YAWN (Score:4, Insightful)

    by samos69 ( 977266 ) on Monday March 10, 2008 @11:54AM (#22703334)
    This is a sales pitch, there's nothing new in that article. Google is just fishing for more business for postini...

    • This is a sales pitch, there's nothing new in that article. Google is just fishing for more business for postini...

      You mean TFA is just a sophisticated form of spam :-)

      Rich.

    • Re: (Score:2)

      by Ilgaz ( 86384 ) *
      I reported 10 "blogspot" abusing spams which are not cheap Viagra but rather actual Microsoft, Adobe piracy advertising scams just last week. Of course, Blogspot (owned by Google) got only 3 of the URLs since they had the genius (!) idea of telling spamcop.net not to send them URL spamming reports. You know the only companies does not want spam reports? The ones who wouldn't care to do anything about them or the CNN/Fox etc. hosting providers which the stories are often abused by scammers. Also ones who are

  • Human Intelligence (Score:3)

    by Mox-Dragon ( 87528 ) on Monday March 10, 2008 @12:00PM (#22703430)
    It seems odd that spammers will need to start using more complicated techniques, as it doesn't seem like people are getting any smarter.
  • Well that seems the way to go. I must admit a general low opinion on most executive types; one of my favorite examples of why I have a low opinion would be the dressing down a fellow IT staffer got from the CEO. The CEO was upset that when he dialed numbers from his phone's address-book while out of state he was getting wrong numbers and or invalid number recordings. After being told that he needed to dial the area code, the CEO erupted loud enough that I could hear it through the handset "Why do I need t
  • Email spam gets smarter, yet email servers remain stupid.

    The sheer amount of bounced spam that I get makes me want to surrender my email account and move to a mountaintop in Nepal and herd goats.

  • ... All people living today will be older or dead tomorrow!!!

    (translation for sarcasm impaired - "duuh!!")

    -Em

  • Nice demo. The link for this article leads to an ad page which won't close if you have AdBlock installed.

  • Like a firehose.... (Score:3, Informative)

    by PGillingwater ( 72739 ) on Monday March 10, 2008 @12:16PM (#22703688) Homepage
    I use Gmail for one of my email accounts, and have used this address (without obfuscation) on the Internet for eight years or so. Therefore, I get a lot of spam. Recently, I've noticed more and more getting through Google's spam filters lately.... but what really amazes me is the volume.

    Here's a simple example: most Gmail users know they have a Spam folder, into which Gmail transfers any messages which appear "spammy." This works pretty well, and I keep around 30 days worth in there, as I used to occasionally look through for false positives (which happened sometimes.)

    The problem now is just that there is too much spam to do this. Let's compare: here is the count of spam in ONE Gmail account, for the past 30 days -- can anyone match it?

    Spam (84194)

    I figure that's a rate of 2,800 per day, or 116 per hour. Nearly two spam messages, every minute, 24x7.... and most of it consists of duplicates. Why are the spammers doing this? Unless they are paid per message they send, I don't see it improving their chances of getting a message past filters.

    • ... and most of it consists of duplicates. Why are the spammers doing this? Unless they are paid per message they send, I don't see it improving their chances of getting a message past filters.

      It's likely that you are on the spammers list more than once, though a smarter spammer would check for that sort of thing, so quite possibly you are in a number of different lists that the same spammer is using.

    • I figure that's a rate of 2,800 per day, or 116 per hour. Nearly two spam messages, every minute, 24x7.... and most of it consists of duplicates. Why are the spammers doing this? Unless they are paid per message they send, I don't see it improving their chances of getting a message past filters.

      The spam is being sent by a botnet of indeterminate size, and not always in direct communication back to their "masters". Sending emails, even duplicates, costs nothing and is better than having to know the siz

    • Re: (Score:1)

      by pjp6259 ( 142654 )
      I use yahoo mail, and usually have a ton of spam in my bulk mail folder, so I went to check and see how it compared to your number. Lo and behold, my email only says Spam (52). What the hell happened? Anyone else notice a huge decrease in the spam reaching their yahoo box. It makes me think the spam is somehow being stopped upstream from my mailbox, and it makes me wonder if I'm missing anything important.
  • Only if we stop using the phrase, or using an "anti-phrase"(see link below), will people wake up to the fraud brought upon the rest of humanity by these IP abusers. http://www.techdirt.com/articles/20080306/003240458.shtml [techdirt.com]

  • Time for PGP/SMIME to go mainstream? (Score:4, Interesting)

    by mlts ( 1038732 ) * on Monday March 10, 2008 @12:18PM (#22703734)
    Decent cryptographic technologies have been with us for a while. I wonder about someone like Verisign making an EV-like system for E-mail certificates, where people/companies/organizations can apply, and after a thorough vetting, get a certificate (preferably on a hardware cryptographic token) that that person is whom they claim to be. Of course, E-mail clients like Thunderbird, mail.app, and Outlook would have to be updated to show that a mail is authentic.

    This would help against spam similar to how anti-phishing technologies in IE and Firefox protect against bad websites, but its still not perfect.

    S/MIME and PGP are strong technologies to help against fraud. I just wish more companies would send out mail with it. For example, one could register a PGP public key with a shop, and when the shop would send E-mail, it would send it signed, and encrypted to that key. Even just using S/MIME's signing capability which works with virtually any E-mail client [1] would help matters greatly.

    [1]: Even pine and mutt support S/MIME. A lot of cellphones support this functionality as well, such as all recent Windows Mobile devices and Blackberries.

    • Good idea, however... (Score:5, Insightful)

      by querist ( 97166 ) on Monday March 10, 2008 @12:34PM (#22704098) Homepage
      The underlying concept of your idea is good.

      However, I can see a few issues that would impact the rate of adoption and the overall utility of your approach (assuming, for the sake of simplicity, that the cryptographic aspects are implemented in a truly secure manner, the crypto itself is strong, etc. I fully realize that this is like the proveribial "frictionless surface" and the proverbial "ideal conductor" used in science books. I'm just trying to cover the big points here, OK?):

      1. It will not happen until Verisign (for example) decide that there is enough of a market that they can make a decent profit.

      2. It will either price small businesses out of the market (given Verisign's prices, this is likely) or it the price will be such that small businesses can afford it and then so can the spammers. Before you start claiming that is why there is a vetting process, I would suggest that hurdles low enough for small "mom-and-pop" businesses to jump will be low enough for a determined spammer.

      3. Either we need a "Root CA" mechanism like other certificates (again, profit and "are you sure you can trust this") or the whole "web of trust" thing from PGP. The web of trust would be difficult in that it would make legit messages appear fake until you can determine it. Also, how would "Joe Sixpack" know the difference between a legit cert for the IRS and a faked one?

      Your idea is good. Unfortunately, the current environment is not ready for it. I hope we will see the day when it will work.

  • will?? (Score:2)

    by martin ( 1336 )
    total sales pitch here, this has been happening for several years where the malware writers use news headlines to trick people into opening email and links...

    nothing to see here, please move on.
  • I hope it gets so bad that we are just flooded and 99% of the users are infected. millions of dollars lost.. death and destruction everywhere.

    Perhaps then something might get done.
  • I'm not interested in the Super Bowl, nor am I an executive :)
    Hopefully the spammers will develop better bots which target only those.
  • any one notice the sudden surge of viruses on emule? Practically all searches return bogus results which really is malware, or virus infected executables.
  • This seems like the same old, same old to me. So what makes this clever is that they are hiding the spam and phishing in topical ways? I'm sorry, but I don't see this as being more effective or likely to gain them any more suckers. Spam is spam, it doesn't matter if they dress it up in a 'current' way it won't fool anybody that wasn't fooled before.

    "According to this email, I can buy Viagra and support the Obama campaign!"
  • Their Gmail service has a hard time stopping spam as it is....
  • At what point did Captain Obvious start working at Google?

  • Like the numbers stations (Score:4, Interesting)

    by GlobalEcho ( 26240 ) on Monday March 10, 2008 @12:47PM (#22704444)
    I've sometimes wondered how much (if any) spam is actually just a numbers station [wikipedia.org].
  • no way.. seriously? and I thought they would get less creative!!

  • A lot of these attacks will masquerade as legitimate business agencies, such as the Internal Revenue Service, the Better Business Bureau...

    I think the only correct response is, Huh?

  • We already get SPAM that says it is from the Department of Justice. It acts like of you don't click the link then you cannot find out about a lawsuit that was brought against you and therefore you can't mount a defense. Pretty clever but I saw right past it.
  • I strongly object to the fact that virus evolutionist theories are taught on this forum. Actually, all the viruses were created by God 6000 years ago, and no evolution can happen. You have no proof. Your fallacious theories should not be taught in public schools.
  • Well then, if google says it's true, then I better go out now and buy that Google Postini Subscription so they can protect me from all the evil in the email world.

  • Google Says Spam, Virus Attacks to Get More Clever
    If eWeek's editors were as clever as this new spam, would they have used the correct comparative form cleverer instead?
    • If eWeek's editors were as clever as this new spam, would they have used the correct comparative form cleverer instead?

      That would be more better.

      Err ... betterer. ;-)

  • This is an old trick used by the spammers. The same thing happened last year with the Super Bowl, the same with the IRS phishing e-mails (some of them e-mailed late after the filing season, some even before the filing season).

    You're telling me Google (Postini?) took more than a year to discover this, some of these social engineering attacks (especially the malware e-mails focussed on special events) have been around since 2006 as far as I can recall (refer to the links below).

    Special Event Malware Spam [cybertopcops.com]

  • I have currently for 40domains about 200mails a day (what is normal for working clients)
    But I need to block 12000mails a day on spam

    That is a rate of more then 98% a day of spam

    when will thay learn that i just drop those mails
    • I recently 'fixed' a mail server that had that problem only an order of a magnitude more severe. The users were noticing mail started taking longer and longer to arrive to there box. After deliveries started taking 6+ hours to a local (on the same server) they finally called me. A misconfiguration was causing the server to accept mail to non-existent accounts, then they were being rejected and bounced back to the sender. Of course since the majority of the mail was coming from cable/dsl style addresses it w
      • I don't drop/block anything on incomming sendmaildeamon, Then the mailscanner (with allot of plugins) checks the mail en drop it + log to quarantine + log into mysql For this moment there is no really long delay (mostly whit in 1min) The quarantine is cleanup on 7day's (I have accountants as clients and they don't like missed mails so release is possible) One's I also dit the rDNS drop but allot of customers are sending from adsl with no reverse The rblchecks are done in mailscanner (maybe to late you sh
  • Spam doesn't really result in sales, some are not even readable. So what could the real purpose for spam be?

    So who would benefit from the effects of Spam?

    Those wanting to reduce our performance as a nation.

    Those wanting to occupy or divert the attention of the people from real issues.

    Those wanting to create a reason to regulate and control the Internet.

    Those who sell anit-spam anti-virus software

    Those wanting to disrupt (clog up) the free flow of valuable information on the Internet.

    Any

  • The sun will, in fact, rise tommorrow. And, An adjustment to the title of this thread to "Google Says Spam, Virus Attacks to Get More Cleverer"

  • By the Power of Grayskull NO..... (Score:4, Funny)

    by EdIII ( 1114411 ) * on Monday March 10, 2008 @05:06PM (#22708832)

    Better yet, virus attacks will target executives at companies whose intellectual property is deemed valuable on the black market.


    They found the biggest security weakness of every single company... The Pointy Haired Ones.
     

  • A lot of these attacks will masquerade as legitimate business agencies, such as the Internal Revenue Service, the Better Business Bureau and the SEC

    Yes, and nobody is going to guess what is happening despite the fact that you and everyone you know suddenly receives at least 10 emails from the 'Inland Revenue' a day. You'd have to be really, seriously stupid to fall for that - it seems ironic that anybody would want to steal intellectual property from people that retarded. Aren't you supposed to at least have an intellect in order to acquire intellectual property?

  • It's not the viruses that are magically getting more clever, it's the virus and spam authors.

    It's not as trivial a distinction as it seems. The article's comments are obvious when you look at it that way -- it's already well-known that organized crime and other crooks-who-know-what-they're-doing are getting involved. We've seen increasing numbers of very well-written, highly targeted attacks. It's not just Nigerian business deals any more.

    This distinction goes to the core of how you fight spam and assort

Slashdot Top Deals

The 11 is for people with the pride of a 10 and the pocketbook of an 8. -- R.B. Greenberg [referring to PDPs?]

Close