I continue to get a small number of spam emails to my ISP account. This is one that I’ve never used or given out. Based on other addresses in the email they seem to be spamming a sequential range of addresses.

Comment spam at The OS Quest continued to drop drastically. There were 331 comment spam attempts which is a 51% drop from the previous week and a 87% drop from the 2,458 attempts of two weeks ago. The slide started soon after I switched to the Spam Karma WordPress plugin. Spam Karma put two comments in moderation as possible spam and let two get through. All four of these comments were a format that didn’t include any URL’s in the comment itself, just linked to the name were WordPress allows an optional website address.

There were 10 comment spam attempts at this website which is a 67% increase from last weeks six attempts. The lifetime total for this site sits at 220 comment spam attempts.

The bad news is I’ve picked up a couple new spam sources. The email address for my ISP (DSL provider) account received four spam emails this past week. This address is one I’ve literally never used. I’ve always used aliases and forwarders rather than ever giving out the actual email address. Based on the other email addresses in the header for a couple of them it looks like they were just spamming a whole sequence of email addresses.

I addition, it looks like the hosting provider ip01-webhost.net spams Whois contact addresses. I use private registration and this past week I received 4 forwarded emails from them with promotional offers. McAfee site advisor has one complaint about them spamming Whois addresses. What’s interesting is that they include the notice:

iP01-webhost.net does not send or support unsolicited email, this email is sent to you because you have been exclusively selected and invited to receive iP01′s services.

They clearly send unsolicited email since I never contacted them. Listing in Whois is hardly “exclusive” and since that’s the only place that email address exists (other than my registrar) there’s little doubt about their selection method. So far it’s only been one email per domain so it’s not egregious, but I don’t think I’d want to do business with a company that starts off playing so loose with their own declared policies.

Website comment spam dropped drastically this week. There were only 671 attempts which is a drop of 73% from the previous weeks 2,458 attempts. Spam Karma caught them all. That’s still an average of 95 attempts a day. The lifetime total for The OS Quest has hit five figures and is now at 10,155.

Comment spam at the Spam Chronicles remains low. There were 6 attempts this week. down 1 from the previous week. The lifetime total for the Spam Chronicles is 210.

None of my other email addresses received any spam.

Comment spam and trackback spam continues to increase at The OS Quest. Comment/Trackback spam for the week grew by 21%. There were 2,458 spam attempts during the week which is a increase of 422 from the week before. This was an average of 351/day. The lifetime total now stands at 9,484 attempted spam comments/trackbacks.

Comment/trackback spam attempts at the Spam Chronicles dropped by 56% as there were only 7 attempts. The total now stands at 204 in its lifetime.

Spam Karma 2 did it’s job and nothing made it through although one was thown into the moderation queue.

My second Gmail account, the one getting the phishing email, picked up one more phishing email to bring the total to 9.

Comment spam (including trackback spam) continues to climb at The OS Quest. There were 2,036 spam attempts during the week for an average of 291/day. This is up from last week’s 274/day average. The total now sits are 7,026 spam attempts. Two trackback spams made it through bringing the total to 13.

The Spam Chronicles saw a drop by almost 50% in comment spam this past week with 16 attempts (down from last week’s 31), all of which were stopped. The total now stands at 197 for the life of the site.

I switched the anti-spam plugin being used by both The OS Quest and Spam Chronicles. Akismet has been replaced with Spam Karma 2. The main reason for the change was that trackback spam that was getting through Akismet. While the number was small, it was still annoying. So far, SK2 has stopped 757 comment spams without letting anything through. Akismet takes a “black box” approach to anti-spam where the analysis is done by their servers and there’s no local configuration. SK2 does the processing locally so can provide greater detail about what it flagged something as spam. As the name suggests, it assigns a “karma” value for spam-like or non-spam like behavior. It has numerous configuration options, although I’m using the defaults.

News

Items in the news that caught my attention this week were:

Spyware was used to steal municple funds from Carson, CA. They stole almost $450K with IDs/passwords obtained with key-logging spyware. All but $45K was recovered. From the article:

Avilla said she still dosn’t know how her computer was targeted. She said she doubts it had the latest security software patch protections — something sheriff’s detectives and bank investigators told her is essential in safeguarding her computer.

The CIO website has an article on how hard it is to find and nab online criminals, even harder than actually catching them. In what may be a clue to one way the spyware could get on Carson’s computer this article mentions:

He learned, for example, that an aquarium employee had downloaded an audio file while eating a sandwich on her lunch break. He learned that when she played the song, a rootkit hidden inside the song installed itself on her computer.

Slashdot had a posting about addresses provided to AmeriTrade (for accounts) being used as a source of spam. Rather than a network security breach it’s likely someone within AmeriTrade is leaking the email addresses to spammers. AmeriTrade attributes the spam to bot-nets and the past loss of customer data On a backup tape). They ignore the fact that people set up email addresses dedicated to AmeriTrade after the breach. This is something I do, set up dedicated email addresses with financial related accounts. This helps identify phishing emails and can be used to identify data leaks as in this case.

My second GMail account picked up a three new phishing emails from last week bringing the total to eight. Seven have been for Paypal and one claimed to be from the “National Credit Union Association”. So far the only spam this account has received have been these phishing emails.

Comment spam at The OS Quest continues to climb dramatically and is now at 4,990. New spam comments averaged almost 274 per day for the past week with a total of 1,917 for the week. That was 670 more this week than the week before. An increase of 54% for the week. All these spam comments were caught by Akismet.

A couple trackback spams made it through and had to be manually deleted, bringing the total to eleven.

The Spam Chronicles had 31 spam comments this week, bringing the total to 181. All the spam comments were caught be Akismet.

I have a second GMail account that was created less than a month ago. It received 5 PayPal phishing emails, two of which made it through the GMail spam filters. The two that made it through were correctly flagged by Thunderbird 2.0 as potential scams. This email address has been used exactly two places. On Blogger, with the option to show the email address turned off. And on StumbleUpon.com, where the email address is not displayed.

Comment Spam to The OS Quest continued to grow at a large rate. It’s up to 3,073 due to 1,247 new spam comments. This is a weekly increase of 47% over the 850 spam comments received the week before. The lifetime total count climbed 68% in just a week.

Trackback spam also continues to grow at The OS Quest with nine spam trackbacks getting posted.

It’s time to do something about all the spam comments at The OS Quest so I’ll be looking into ways to curb it. At a average 178 spam comments a day it’s become a waste of resources even though Akismet catches almost all of them. Even if I ignore them and allow them to be automtatically deleted over 30 days they’ll take up space in the database which will take my backups take longer.

There were 42 spam comments to this site during the past week, bringing the total to 150.

The 30-day spam count for my Gmail account dropped almost 7% to 366 spam messages. None made it through. Back on December 3rd when I started counting the spam I had only 18 spam messages in a 5 day period. Now I’m averaging 61 spam messages every five days.

Comment spam at The OS Quest almost doubled again this week, the lifetime total was up 87% in just a week with 850 new spam comments which brings the current total to 1,826. Trackback spam continues to be a problem with 4 spam trackbacks getting posted.

Comment spam to this site remains slower in number but is grower as fast as The OS Quest. Fifty new spam comments were received which was a 86% increase with a current total of 108.

Site Changes

A couple of structural changes to the Spam Chronicles. The calendar is gone from the left sidebar as is the archive by month drop-down. I think most people are like me and don’t browse by month, especially for a blog like this. To compensate I added a sitemap that’s in the header menu. It list’s all my site pages plus the posts. The posts are listed by category, with the most recent posts listed first.

My GMail spam count held steady from last week and stayed at 392 spam emails stopped in the last 30 days.

Comment spam at The OS Quest exploded and closed in at 1,000 but stopped at 976. With a 98% increase in just a week It came close to receiving nearly as much comment spam in the last week as it did since the site was established in November 2006. Trackback spam became a problem and two of them ended up being posted,

Comment Spam to this site jumped 380% with 58 pieces of new comment spam this week to bring the total to 73.

News Summary

A summary of news that didn’t make it into their own posts.

If you use AOL you might want to check your password if it’s over 8 characters. According to the Washington Post AOL allows 16 characters in their account password. But it seems they were only using the first 8 characters and ignoring everything else. The Washington Post article gives the example of someone who thinks they have a good 13 character password except the problem is the first 8 characters are their name. So someone trying to access the account may assume the person used their name and try it. Even though the person tried to make it more secure by making it longer the hacker would get into their account. At least if they said there was an eight character limit people would have known and made their passwords fit the size.

Also in the category of stupid, a big topic this week was the attempt by the AACS to suppress the hex code that can be used to decrypt HD-DVD’s. The AACS sent out a bunch of take down notices to sites that had the number posted. One of the sites was Digg.com which complied. Then the Digg community revolted and did nothing but post the number in hundreds of articles. Digg finally gave up and left the articles up. The AACS says they still intend to pursue people who publish the number. They’ve stopped using the number with new DVD’s and as old systems get updated the key will be revoked. The story made the mainstream press, so now everyone knows the number. Plus, there’s news of a new hack available and this one claims to be unpluggable. Since the encryption has to be self-contained on the DVDs it’s going to be crackable given enough time and resources. All it does is cause problems for the consumer who lays out their money while forcing people who pirate as a business work a little harder but still make their money.

As CNet News.come reports, hacker’s continue to target 3rd party apps. In this case a critical security flaw was found in a Photoshop Plug-in.

Site News

There was a problem with the RSS Feed for this site earlier this morning. There weren’t any posts while it was broken and it’s fixed now so you shouldn’t have a problem if you’re subscribed. If you tried a new subscription you got a 404 Not Found error. Kudos to feedburner for noticing the feed was broken and sending me an email (through an optional free service they provide). It took me awhile to sort out since I didn’t think I had changed anything. But I eventually found my .htaccess file was missing. I had copied it to use at another site, so I thought. But I must have moved it instead. A restore from backup and all was well.

My GMail account stands at 392 spam emails in the last 30 days which is down 11% from last week’s 30-day count of 440.

The OS Quest comment spam count jumped a staggering 115 to 493 from last week’s 378. This website is now in the sites of the bots and jumped from 4 to 15 spam comments in a week.

None of the spam, email or comment, made it through the filter.

Summary

This past week’s news that didn’t make it into their own posts.

Recent media reports talk about spam and viruses being combined. In this case a pump-and-dump spam email carries a trojan that installs a bot that is then used to send more spam. This doesn’t seem too original and viruses have previously replicated themselves vii email in the past. The new twist is spam botnets are used to send the email/virus rather than self-replication, and the spam is traditional in that it tries to make money for the spammers.

Eugene Kasperksy, of Kaspersky anti-virus fame, made news by predicting a rise in attacks on Mac and Linux. He predicts a slight shift away from Vista to Mac and Linux. He doesn’t say how much the shift will be. As I previously posted, I think the social engineeering factor, along with improved Vista security is going to make Macs worth targeting for web based attacks.

CNet reports on Trend Micro’s prediction that web based attackes will overtake email as the most common way to spread malware. This will occur in 2008. The reason for the shift is that email is store and forward and the protection tools are getting better. While web access is real-time and port 80 can’t be blocked. The article also touches on the motivation of spammers.

“Malware for profit is definitely driving these Web threats,” Genes said. “The last real virus we had was in 1999, Melissa. Since then it has been mostly worms and Web threats.”

Criminals are offering up to $75,000 for a Windows XP vulnerability and $50,000 for a Windows Vista vulnerability, Genes said. Security firms such as VeriSign’s iDefense and 3Com’s TippingPoint pay around $12,000, he said. “The good guys are paying, but the bad guys are paying more,” Genes said.

Trend Micro is getting ready to launch a new web security service for corporate desktops. So the motivation could be to hype their product. or, they could have the product because they believe this is true and it’s an astute marketing move.

Computing has another article that echos the theme predicting in an increase in spam.

In the catagory of reports and predictions, Virus Bulletin has a summary of reports from various anti-virus vendors about a rise in spying, zombies, spear-phishing and cracked websites. From the article:

Spam levels for the quarter have been variously measured at between 65% and 90% of all email, with pump-and-dump scams, image spam and hijacked newsletters the big ideas of the season. Botnets, still a major source of advertising and other spam, are increasingly being put to use for phishing and data theft as the trojans used to run them develop better stealth and more sophisticated data-harvesting and communication functions. China and the US are generally held to be the biggest sources of both spam and malware.

Billing World and OSS Today and Webwire have articles about the effects of spam on the mobile phone industry. They make the point that spam costs the industry considerable expense, from customer churn to the expense of the customer service calls to reverse the changes. There’s discussion of the current model of billing for both incoming and outgoing sms messages. This effectively splits the cost of spam. There’s a prediction this could result in the elimation of charges for receiving sms messages.

My GMail account has stopped 440 SPAM emails in the last 30 days which is a 9% increase from last week’s 30 day total. My other website has had 378 spam comments stopped by Akismet and none made it through. The Spam Chronicles is up to four stopped Spam comments

Spam/Virus News

Yahoo news had a story about US Stae Department computer being hacked via email. The email included what seemed like a legitimate Microsoft Word attachment. But when the document was opened. The document contained code that exploited a previously unknown vulnerability witch was then reported to Microsoft. It took Microsoft 8 weeks to deliver a patch.

While Spam can be used to deliver the exploits to large numbers of PCs, Techworld is reporting an increase in targeted spam attackes to deliver exploits. This sounds like what happened to the State Department incident since they received a Word document that appeared legitimate for them (text of a speach).

Computing has an article about how spammers exploited the Virginia tech tragedy to deliver spyware which is related to the Computing News report of a increase of spam combined with social engineering.

CNET News had a couple of PC security related articles this week. The first talks about the increasing complexity of rootkits. The second talks about their improved ability to hide malicious code in a website.

Wired news has a column title “How Security Companies Sucker Us With Lemons“. It’s about how bad security products, because they can be cheap, push the good security products out of the market. People see the lower prices which lowers the price they are willing to pay which in turn pushes the good (more expensive) products out of the market. In addition to price, ease of use and setup is a critical factor. By it’s nature security tends to be more intrusive so in many cases ease of use means a lack of security. It’s easier for most people (including IT professionals who don’t specialize in security) to evaluate products on ease of use than it is on true security.

Software Updates

The following  software, which is free for personal, non-commercial use was recently updated.

Avast Antivirus has ben updated to version 4.7.986 (from 4.7.942). If you run this software it should update automatically

AntiVir Personal has been updated to version 7.00.04.13 and includes Vista support.

AVG Free Edition has been updated to version 7.5.463

If you don’t have current anti-virus and spyware protection you should check out the “Free Security Software” links in the left sidebar. Windows XP SP2 also has a built-in firewall that’s on by default. You can also check out the “Trial Security Software” section on the links page to try additional software. Several of the trials are full-featured (but time limited) so you can see if you PC has spyware or viruses and clean it if it does,