Attention comment spammers

You can buy a sponsored link on Reddit for as little as $20. Or you could buy some paid search at your friendly neighborhood search engine. Or you could advertise on Twitter. There are many legitimate things you could do to drive traffic to your site. Unlike comment spam, these techniques would actually work.

Brilliant marketing

ComputerWorld has a story about KnujOn's report on the top ten spam-friendly domain registrars. This is normal public relations, do research, issue a report and alert the press. Just solid, basic PR, good but not brilliant.

I discovered the brilliant part when I went to the KnujOn's website. They are asking visitors to send them their spam. This gives them a list of prospects for their premium services along with the raw data for future research on spam. Well done KnujOn. File this under the Department of I wish I had thought of this myself.

How not to use FaceBook

Aaron Brazell

The spam is a nifty little trick where you publish an event, group or picture of a product, service or event. Pretty typical Facebook activity, really.

Spamming PR people then use Facebook’s “tag” feature, something that is more in context for photos where you can tag someone that is in the photo and they receive a notification that they’ve been tagged. People like me are tagged in Facebook content where we have no context with the expectation that we will be notified of the content (event, whatever) and will click through and maybe cover their product.

So. Not. Cool.

This flack doesn't have a FaceBook account; but as I am in the custom of aggressively tagging things on every topic on which they could conceiveably be searched, this is the sort of error I might have made. Not now. Thank you Brazell for explaining why this is not such a hot idea.

Someone is spoofing the FDIC

This morning's mail brought a missive allegedly from the FDIC asking me to use a link to check my account. Obviously I realized the FDIC does not send email about such matters.

I contacted the FDIC by phone and was assured that they were aware of the scam and were in the process of shutting it down.

The Federal government takes an extremely dim view of this sort of fraud. I predict the perpetrators will be brought to justice.

Edit -
FDIC Consumer Alerts

Spam, who sends, who recieves

Government Computer News reports a survey from MessageLabs that lists, Illinois, South Dakota, Oregon, New Hampshire, Wisconsin, North Carolina, Indiana, Texas, Pennsylvania, and Alabama as the most spammed states.

So where is the spam coming from? An earlier report from MessageLabs lists Florida and Texas.

Mark Sunner, CTO of MessageLabs, said: "Florida and Texas are the only two US states where bankruptcy laws treat the company or the individual so favourably."

"The laws in Florida actually favour the spammer," added Sunner. He told silicon.com that spammers base themselves there because in their worst case scenario - getting caught and being put out of business by hefty penalties - they will be able to keep possession of assets "bought with their ill-gotten gains" such as cars and houses.

Boca Raton, Florida has the dubious distinction of being the spam capital of the world.

The problem with Gmail

I just received an email from a spammer using a Gmail account. Perusing Gmail support, I was unable to work out how to report spam. I have no desire to join a discussion group, I simply want a way to inform Google that 5zigen.com, a spammer who lists their contact address as whoisdatashield[@]gmail[.]com, is using Gmai. If I were Google, I would want to know about things like that.

Business practices and computer security

Jeremy Kirk interviews Bruce Schnier

So what do you think is the biggest threat right now

Schneier: Crime.

So how do you fix it? It's expensive to investigate, it's cross-jurisdictional.

Schneier: It might not be fixable. A lot of [the solution] is going to be making the things that criminals are going after harder to get. You're not going to stop the criminals. But in the United States, it's really easy to get a credit card in someone else's name. The credit card companies like it that way. So a lot of it is looking at how the criminals are attacking things and making it harder to attack them. The brokerage companies want it to be easy for you to log on and make trades. Make it harder, and the businesses don't like that.

They're afraid they're going to drive away customers.

Schneier: Of course. If I strip search you before you go into the bank, you might change branches. In the U.S., the government doesn't have the balls to require stuff like [stronger authentication]. You've got to make the banks responsible for losses. The brokerage company has to [reimburse] me if I didn't make the trade. Period. End of sentence.

That's how you fix it. Because then, my brokerage is going to start buying security, otherwise they won't. The basic rule of security: You make the entity in the best position to mitigate the risk, responsible for the risk. Make them responsible. They'll figure it out. That's how capitalism works.

I had a similar take on spam and the issuance of merchant accounts:

Nothing in this writer’s research has explained why VISA, Mastercard, et al, tolerate spammers. Without credit cards spamming would not be possible. So why do these companies traffic with such operators? We need to make this a customer relations issue.

Unsolicted commercial email blues

The End of Spam Research

One leader in the field declares that the basic parameters of spam fighting are all set and real research is over.

Anti-spam research isn't really all that old, as security research fields go, but it may have hit the end of the line. A thread in the mailing list of the Internet Engineering Task Force's Anti-Spam Research Group (ASRG) argues that all the basic questions have been answered.

Phillip Hallam-Baker, CTO of VeriSign, argues that, "It is now accepted that there are two approaches to stopping spam, filtering out the bad stuff, making it easier to identify the good stuff."

There is a third way

Nothing in this writer’s research has explained why VISA, Mastercard, et al, tolerate spammers. Without credit cards spamming would not be possible. So why do these companies traffic with such operators? We need to make this a customer relations issue.

When lawsuits are good PR

Lawsuit Seeks to Identify Harvesters of E-Mail Addresses

A company representing Internet users in more than 100 countries filed a federal lawsuit yesterday seeking the identities of people responsible for collecting millions of e-mail addresses on behalf of spammers.

The lawsuit, filed in U.S. District Court in Alexandria, was filed on behalf of Project Honey Pot, a service of Unspam Technologies, a Utah firm that consults with companies and government agencies.

Well done Unspam Technologies.

The effective use of email

What is your Internet Service Provider's reputation?

SEC's 'Operation Spamalot' Targets Penny-Stock Hype

Trading Halted For 35 Firms Over E-Mails

Securities regulators yesterday halted trading in nearly three dozen companies -- the initial salvo in "Operation Spamalot," a campaign to block e-mails promoting stocks to unsuspecting investors.

Three cheers for the SEC.

Edit -

Via Thomas Claburn of Information Week, Brad Taylor of Google calls on Gmail users to report spam.