Fighting Spam/Junk Mail/Sales Calls

[Adam's Apple]

How to Fight Spam, Junk Mail and Sales Calls
By Liz Pulliam Weston, MSN Money

On a fairly ordinary day recently, I received:
--A prerecorded phone message pitching a mortgage refinancing service.
--A “live” phone message offering me a debt consolidation loan.
--Three unsolicited faxes.
--A few dozen spam e-mails with deceptive subject lines.

The volume of unwelcome marketing attacks wasn’t remarkable. What is -- or should be -- of note is that all of these communications were illegal.

Recorded phone messages and junk faxes have long been against the law. Live phone pitches became off-limits shortly after I signed up for the federal Do-Not-Call List, and misleading spam was outlawed by the federal CAN-SPAM Act of 2003, which took effect in January 2004. Yet the bombardment continues.

Junk faxers continue to spew out unwanted, unsolicited ads, even after the Supreme Court upheld the constitutionality of the 1991 law banning them and the Federal Communications Commission slapped one of the most notorious offenders, Fax.com, with a record $5.4 million fine.

The volume of e-mail spam keeps rising, despite the CAN-SPAM Act.
Fraudulent e-mails were 4% of the total.

It’s clear, privacy advocates say, that the federal government needs to kick its enforcement up a notch. But there’s also a lot we as consumers can do both to protect our own privacy and aid regulators in the hunt for scofflaws.

For each type of incursion into your privacy, I’m offering three levels of response: the “no-brainer,” or basic way to defend yourself; the “next step” for those who want a higher level of protection; and the “warrior stance,” which can help fight these intrusions on a more global scale.

Telemarketing and Junk Faxes

The No-Brainer. Sign up for the federal Do-Not-Call List online or by calling (888) 382-1222.

Despite the violations and complaints, privacy advocates say the federal registry does seem to be dramatically reducing telemarketing calls.

“From the information we’ve gotten from consumers, they have seen a significant decline in the number of telemarketing calls,” said Jordana Beebe, spokeswoman for the Privacy Rights Clearinghouse. “The FTC was pretty close when they said it would reduce calls by 80% or more.”

Unsolicited faxes aren’t covered by the do-not-call registry, since they were already banned under the Telephone Consumer Protection Act of 1991.

The Next Step. There are a host of other ways to block telemarketing and junk faxes.

Sign up for your state’s do-not-call list. Most states with such lists share their data with the federal registry, said privacy expert Robert Ellis Smith, but your state may have stricter rules about who can and can’t call. Some of the states that don’t share with the federal registry include: Georgia, Indiana, Louisiana, Missouri, Tennessee, Texas, Utah, Wisconsin and Wyoming.

Don’t call toll-free or 900 numbers unless you already have a business relationship with the company. Your phone number can be “harvested” from your call, even if you have Caller ID blocking, and sold for marketing purposes. If you must call, demand to be put on the company’s do-not-call list and insist that your information not be sold.

Consider your phone choices. Some privacy advocates recommend an unlisted number or Caller ID systems, but Smith, publisher of the Privacy Journal finds those to be an unnecessary expense and hassle. He recommends listing your phone number without your address, to foil most marketers, and having “distinctive ringing” on your phone line so that friends and family trigger one kind of ring, while outsiders trigger another.

Tell companies you do business with that you don’t want to be contacted. The federal Do-Not-Call List exempts calls from companies when you have a business relationship. But even these companies are required to put you on their do-not-call lists if you ask.

When you donate, tell charities and nonprofits not to contact you or sell your information. Charities and nonprofits are exempted from the federal do-not-call registry, but they also must maintain an internal do-not-call list.

Don’t give out your phone or fax number. Seems obvious, but you probably give out your number way more often than necessary. There’s no reason, for example, to include your number when filling out warranty cards, product registrations and magazine subscriptions requests. If required to give your number, demand to be put on the company's do-not-call list.

If you receive a junk fax with a toll-free opt-out number, use it. Unlike spam e-mails, where opt-out options seem to bring on more spam, junk faxers generally respond by taking your number off their lists, privacy advocates said. If there’s no toll-free number or the number doesn’t work, consider reporting the faxer to the FCC (see below).

Review the steps below for blocking direct-mail solicitations. There’s lots of overlap between telemarketers, junk faxers and junk mailers.

The Warrior Stance. If you really want to strike some blows for a telemarketing-free world, consider the following.

Report do-not-call violators. There’s a complaint form right on the FTC Web site. You also can contact your state’s attorney general. Regulators can’t investigate each and every violation, but they do look for patterns of abuse. Your report can help build their cases. Junk faxers should be reported to the FCC in writing, with a copy of the fax attached. Junkfaxes.org describes which addresses to use and the information to include.

Sue them. Some anti-telemarketing crusaders make a hobby of suing telemarketers in small claims and other courts. If you’re interested, you can start with Ben Livingston’s site, Zen and the Art of Small Claims. Arizona attorney Richard Keyt offers resources, including a sample demand letter to send to junk faxers. You also can send $10 for a copy of Private Citizen’s booklet, “So you want to sue a telemarketer.”

Goad your lawmakers. The massive, favorable response to the federal do-not-call law (more than 50 million numbers registered in its first few weeks) drove home the message to politicians that their constituents want to be left alone. Keep up the pressure with letters and e-mails urging them to make sure the law gets enforced.

Junk Mail

The No-Brainers. Use the opt-out services for general junk mail and credit card solicitations. These will reduce but not eliminate unwanted mailings.

Write the Direct Marketing Association’s Mail Preference Service at PO Box 643, Carmel NY 10512, including the name and address of all household members you want deleted from members’ mailing lists. You also can opt out online, but the service costs $5.

Call (888) 5 OPT OUT, a service maintained by the three major credit reporting companies, to be removed from marketing lists the credit bureaus provide to credit card companies. You’ll need to provide your Social Security number and other identifying information.

The Next Step. A growing number of companies that collect data are offering opt-out options. Among them:

Real estate data companies. Two companies that collect and sell data from public tax assessor records are Acxiom, which has an opt-out hotline at (877) 774-2094, and DataQuick, whose opt-out hotline is (877) 970-9171.

Phone companies. Call yours and demand your number be taken off any marketing lists. The Privacy Rights Clearinghouse has a partial list of opt-out numbers for telephone companies.

Your doctor. A federal law that took effect in April 2003 requires medical care providers to give you a copy of their privacy policies and to allow you to opt out of any marketing efforts.

Avoid sweepstakes. Their real purpose is usually to collect a list of names and addresses for marketers.

Be alert for opt-out choices. Look for boxes you can check on forms, applications and Web sites that let you stay off marketing lists. If you can’t find a box, consider taking your business elsewhere or write a letter telling the business, charity or other organization that you don’t want your information sold or shared.

Be wary of loyalty cards. They can offer great deals, but often at the expense of your privacy. If you do decide to use them, you can often leave the address and phone number blank.

Respond to privacy policy notices. Financial institutions are supposed to send you information each year about how they might use your data, and give you a chance to opt out. You should only have to respond once to these annual mailings.

Widen your net. Any organization to which you belong could sell its mailing list. That includes professional associations, religious groups, nonprofits, museums -- the list goes on and on. When renewing your membership or donating, include a letter demanding that your personal information not be shared or sold. You can threaten to stop attending/donating/doing business with the recipient if it fails to honor your wishes.

The Warrior Stance. The Do-Not-Call List is, unfortunately, expected to lead to a new surge in junk mail. You can fight the trend in the following ways:

Subscribe to anti-junk services like the one provided by Private Citizen for $10. These services say they have access to many more junk mailing lists and ways to target and defeat persistent junk mailers.

Sue them. Many of those crusading against telemarketers and spam are also taking on junk mailers. Check out the links above.

Goad your lawmakers. Besides being irritating, junk mail takes an environmental toll -- in paper, compact discs, product samples and wrapping that are created and then (more often then not) tossed directly into the trash. If that bothers you, or you’re just irritated by the volume of mail you get, consider contacting your lawmakers about setting up a national Do Not Mail list.

Spam and Pop-Ups

The No-Brainer. If you’ve been on the Internet more than about five minutes, you’ve probably read about the basic ways you can cut down on spam: using spam filters, keeping your e-mail address off Web sites and out of chat rooms, not opening or responding to spam.

The Next Step. Look for “spyware” that’s been secretly installed on your computer. These programs secretly track your movements and lurk on an estimated 9 out of 10 computers. Spyware can spawn legions of pop-up ads, or hijack your browser and force you to visit unwanted Web sites. (The most odious specialize in sticking porn in your face.) Spyware also can collect data about you and send it to companies without your knowledge.

Activate spyware detectors in your antivirus software. The two major antivirus programs, McAfee and Norton, have spyware detectors in their latest versions.

Download free spyware detection software. Free programs include Spybot Search and Destroy and Lavasoft Ad-aware.

The Warrior Stance

Sue them. Anti-spam crusaders are taking their battles to state and small claims courts. Use the links above as a starting point, or just type “suing spammers” into any search engine.

Goad your lawmakers. The CAN-SPAM Act overrode some state laws that were seen as tougher and more likely to have an effect. You can urge your congressional representatives to put some teeth in the federal law or at least push for active enforcement of its provisions.

 

[waltky]

Hard drives seized in raids are being analysed for clues to who was behind Rustock...

Spammers sought after botnet takedown
25 March 2011 - The Rustock botnet, which sent up to 30 billion spam messages per day, might have been run by two or three people.

Early analysis, following raids to knock out the spam network, suggest that it was the work of a small team. Rustock was made up of about one million hijacked PCs and employed a series of tricks to hide itself from scrutiny for years. Since the raids on the network's hardware, global spam levels have dropped and remain relatively low.

Net gains

"It does not look like there were more than a couple of people running it to me," said Alex Lanstein, a senior engineer at security firm FireEye, which helped with the investigation into Rustock. Mr Lanstein based his appraisal on familiarity with Rustock gained while working to shut it down over the past few years. He said that the character of the code inside the Rustock malware and the way the giant network was run suggested that it was operated by a small team. That work by FireEye, Microsoft, Pfizer and others culminated on 16 March with simultaneous raids on data centres in seven US cities that seized 96 servers which had acted as the command and control (C&C) system for Rustock.

Mr Lanstein said hard drives from the servers had been handed over to a forensic firm that will scour them for clues as to the identity of the network's controllers. His hunch that a small team was behind Rustock is partly based on how different it was to other spam networks such as Zeus. That network, said Mr Lanstein, operates on a franchise basis and involves many different groups and cyber criminals. By contrast, Rustock was a tightly controlled, if huge, network that brought with it many of the administration headaches suffered by any web-based business.

More BBC News - Spammers sought after botnet takedown

See also:

Microsoft aids shutdown of Rustock spam net
17 March 2011 - Rustock's main business has been to send out offers of cheap pharmaceuticals

The sudden drop in activity of a major spam producer was the result of a larges co-ordinated attack on spammers, it has emerged. At 15:30 GMT on 16 March, a network of spam-producing computers, known as Rustock, suddenly stopped. Raids on the network's infrastructure were triggered by a long-running investigation by Microsoft.

During raids, servers that acted as Rustock's command and control systems were seized. In 2010, the Rustock botnet - a collection of infected machines - was the most prolific producer of spam on the internet, at its peak accounting for nearly half of all spam sent globally - some 200 billion messages a day.

Prolific spammer

Initially it was not clear that the network had been tackled by law enforcement because the volume of spam coming out of Rustock has fluctuated wildly recently. Usually the spikes in activity last for 12 to 16 hours, Vincent Hanna of anti-spam group Spamhaus told BBC News.

"When Rustock stopped yesterday it was in mid-campaign," he said. Writing on Microsoft's public policy blog Richard Boscovich, a senior attorney in the company's Digital Crimes Unit, said the raids effectively severed the link between the million or so drone computers in Rustock and the servers that control them.

More http://www.bbc.co.uk/news/technology-12772319

 

[waltky]

Should be 18% less spam now...

Huge spam botnet Grum is taken out by security researchers
19 July 2012 - The Grum botnet was made up of more than 120,000 infected computers, researchers said

A botnet which experts believe sent out 18% of the world's spam email has been shut down, a security firm said. Grum's control servers were mainly based in Panama, Russia and Ukraine. Security company FireEye and spam-tracking service SpamHaus worked with local internet service providers (ISPs) to shut down the illegal network. A botnet is a network of computers that has been hijacked by cybercriminals, usually by using malware. "Grum's takedown resulted from the efforts of many individuals," wrote Atif Mushtaq, a security researcher with FireEye. "This collaboration is sending a strong message to all the spammers: Stop sending us spam. We don't need your cheap Viagra or fake Rolex."

'Bad news'

Mr Mushtaq wrote that on Monday he learned that a Dutch server involved in Grum had been shut down. He said it "at least made a dent" in the botnet. On Tuesday, the command and control servers (CnCs) in Panama had been shut down. "This good news was soon followed by some bad news," he explained. "After seeing that the Panamanian server had been shut down, the bot herders moved quickly and started pointing the rest of the CnCs to new secondary servers in Ukraine. "So at one point, I was thinking that all we needed was to take down one Russian server, but right in front of my eyes, the bot herders started pointing their botnet to new destinations."

He noted that in the past Ukraine has been something of a "safe haven" for bot herders. "Shutting down any servers there has never been easy." Disabling Grum is just one of many high-profile efforts to neutralise botnets worldwide. Russian Georgiy Avanesov was in May sentenced to four years in jail for being behind the Bredolab botnet which was believed to have been generating more than £80,000 a month in revenue. Microsoft has been working to disrupt Zeus, another huge network responsible for, researchers said, millions of pounds in theft.

'Keep on dreaming'

FireEye collaborated with other experts in the worldwide security industry to apply pressure to local ISPs to suspend the illegal operation. Mr Mushtaq said more than 20,000 computers were still part of the botnet, but that without the active CnCs they would soon be rendered ineffective.

Grum's closure was an encouraging development in clamping down on botnets across the world, he said. "When the appropriate channels are used, even ISPs within Russia and Ukraine can be pressured to end their cooperation with bot herders. "There are no longer any safe havens. Most of the spam botnets that used to keep their CnCs in the USA and Europe have moved to countries like Panama, Russia, and Ukraine thinking that no one can touch them in these comfort zones. "We have proven them wrong this time. Keep on dreaming of a junk-free inbox."

BBC News - Huge spam botnet Grum is taken out by security researchers

 

[waltky]

Mebbe dat'll put a stop to dem Nigerian spammers...

Cybercriminals in developing nations targeted
20 July 2012 - The ICSPA says it has already started advising Ghana's government how to tackle cybercrime

Cybercriminals in developing nations are being targeted in a new effort to combat the illegal activity. The International Cyber Security Protection Alliance has launched a research project to identify how attacks are likely to evolve over the next eight years. It said that faster links to the net in parts of Africa, Asia and Eastern Europe were likely to create problems. The ICSPA will advise governments and local authorities on how best to react. The organisation is a coalition of law agencies, security companies and businesses, including Visa Europe and the defence firm EADS.

"It's not just about putting a black mark against a particular nation because many of these countries are the unwilling hosts to cybercriminal networks," John Lyons, the organisation's chief executive, told the BBC. "We know the countries that provide 'organised cybercrime' with the ability and the hosting capability to attack the West in terms of its business and customers. "So, what the ICSPA is looking to do is to work with those nations to provide support to help them improve the cyber-resilience of their national infrastructure, to aid their own economies, and to help their law enforcement groups tackle cybercriminals who work out of their country."

Advising Africa

Although the research project has only just got underway, the group has already started to co-ordinate action. Members of the UK's Serious Organised Crime Agency (Soca) began work with the Ghanaian government in February to help it take technical steps to prevent cybercrime, and ensure offenders are prosecuted. Mr Lyons said Nigeria, Botswana, Uganda and Rwanda were among nations likely to be targeted by the campaign. The countries were starting to benefit from improved internet access, but would struggle to "suppress the criminality that will come with that connectivity," he said. Other countries on his group's watch list included Bulgaria, Romania, India, the Philippines and parts of Latin America.

October report

The ICSPA wants companies based in developing nations to contribute to the costs of its efforts. However, Mr Lyons acknowledged that the richer nations also needed to do more to combat internet crime. "Something like 67% of malware which is used to attack Western businesses is hosted in the US on servers," he said. "The US needs to take steps to tackle that particular issue." The ICSPA plans to issue a report covering its initial findings before the end of October.

BBC News - Cybercriminals in developing nations targeted

 

[waltky]

Europol's EC3 goin' after cybercrime...

EU police agency opens unit to tackle cybercrime
Jan 11,`13 -- The European Union's police coordination agency opened a new cybercrime unit Friday to combat online offenses from banking fraud to peddling images of child sex abuse.

But as the European Cybercrime Centre, or EC3, formally opened its doors at Europol's Hague headquarters, European Home Affairs Commissioner Cecilia Malmstrom conceded it will be playing catch-up with organized crime gangs reveling in a "Golden Age" of cybercrime. Online criminals, she said, "are ahead of us when it comes to imagination and cooperation." Europol is fighting back with experts huddled around computer screens in blue-lit "labs," monitoring internet traffic and able to retrieve data users believe they have deleted from their cell phone or computer hard disks.

The agency says online payment card fraud generates an estimated (EURO)1.5 billion ($2 billion) a year, while recent international investigations into pedophiles trafficking child abuse images on the Internet have led to hundreds of arrests worldwide. Europol expert Valerio Papajorgji said the new center will chase criminals who attempt to conceal their activities in parts of the Internet and online networks not generally accessed by regular users or search engines - known as the "deep web" and "darknet." It also will track and tackle malicious software used to steal personal and banking information from people's computers and empty their online accounts.

Europol Director Rob Wainwright called the establishment of the center a milestone in Europe's fight against crime and efforts to deny criminals "the cyberspace and opportunity they are currently exploiting to harm governments, businesses and citizens." The European center aims to cooperate with other such agencies around the world, and Wainwright signed a letter of intent on cooperation with John Morton, director of the U.S. Immigration and Customs Enforcement agency, which has a long-established cybercrime unit known as C3.

Morton said cross-border teamwork is key to tackling cybercrime, which knows no borders. "This level of international cooperation is not just an ideal or something to be wished for but rather a necessity," he said at the opening ceremony in The Hague. "You literally cannot investigate and prosecute these cases any more - the large-scale ones - over the Internet without very strong international cooperation."

Source

 

[Politico]

Don't give anyone your private info and you don't get spammed. Works everytime.

 

[waltky]

Dutch spammer nabbed in Spain...

Dutchman arrested over huge web attack
26 April 2013 - Spanish police have arrested a Dutchman suspected of being behind one of the biggest ever web attacks.

The 35 year-old-man was detained in Barcelona following a request from the Dutch public prosecutor. The attack bombarded the websites of anti-junk mail outfit Spamhaus with huge amounts of data in an attempt to knock them offline. It also slowed data flows over closely linked networks and led to a massive police investigation. The man arrested is believed to be Sven Kamphuis, the owner and manager of Dutch hosting firm Cyberbunker that has been implicated in the attack. "Spamhaus is delighted at the news that an individual has been arrested and is grateful to the Dutch police for the resources they have made available and the way they have worked with us," said a Spamhaus spokesman.

He added: "Spamhaus remains concerned about the way network resources are being exploited as they were in this incident due to the failure of network providers to implement best practice in security." Spamhaus servers were hit with a huge amount of data via an attack technique known as a Distributed Denial of Service (DDoS) attack. This attempts to overwhelm a web server by sending it many more requests for data than it can handle. A typical DDoS attack employs about 50 gigabits of data every second (gbps). At its peak the attack on Spamhaus hit 300 gbps.

Spamhaus runs lists that log sources of junk mail and other malicious messages

Cyberbunker is thought to have kicked off the attack in late March after Spamhaus blocked some servers hosted by the Dutch firm. Cyberbunker bills itself as a firm that will host anything but child pornography and terrorism material. Non-profit Spamhaus maintains what are known as "block lists" which many organisations use to spot sources of spam and other junk mail to stop them clogging mail servers and inboxes with unwanted messages. Mr Kamphuis took exception to Spamhaus's action saying in messages sent to the press that it had no right to decide "what goes and does not go on the internet".

In a statement, the Dutch public prosecutor said the Dutchman, who it only identifies as "SK", was "suspected of unprecedented heavy attacks" on Spamhaus. The house where SK was stayed was searched at the time of his arrest and Spanish police confiscated computers, phones and hard drives. It said it expected SK to be transferred to the Netherlands very soon. A spokesman for the Dutch police said they were co-operating with British and American authorities on the investigation into the attack.

BBC News - Dutchman arrested over huge web attack

 

[waltky]

Oh, please don't throw me into dat briar patch...

Cyberattack suspect to be sent home to Netherlands
April 29, 2013 -- A Dutch citizen arrested in Spain on suspicion of launching what authorities have called the biggest cyberattack in Internet history is expected to be handed over to the Netherlands within 10 days, a Spanish court official said Monday.

The suspect - identified only by his initials S.K. - was questioned Saturday in the National Court in Madrid after his arrest last week and agreed to the deal, according to the official, who spoke on condition of anonymity because court rules prevent him from giving his name. Police say the 35-year-old suspect operated from a bunker in northeast Spain and also had a van capable of hacking into networks anywhere in the country. He was arrested Thursday in Granollers, 35 kilometers (22 miles) north of Barcelona.

He is accused of attacking the anti-spam watchdog group Spamhaus, whose main task is to halt ads for counterfeit Viagra and bogus weight-loss pills reaching the world's inboxes. Dutch authorities alerted Spanish police in March of large denial-of-service attacks being launched from Spain that were affecting Internet servers in the Netherlands, United Kingdom and the U.S. These attacks culminated with a major onslaught on Spamhaus.

Denial-of-service attacks overwhelm a server with traffic, jamming it with incoming messages. Recent cyberattacks - such as the ones that caused outages at U.S. banking sites last year - have tended to peak at 100 billion bits per second. The attack on Spamhaus was three times that size. Police from the Netherlands, Germany, Britain, Spain and the U.S. took part in the investigation.

Cyberattack suspect to be sent home to Netherlands - Europe - Stripes