The FBI is contacting more than one million PC owners who have had their computers hijacked by cyber criminals. The initiative is part of an ongoing project to thwart the use of hijacked home computers, or zombies, as launch platforms for hi-tech crimes.
The FBI has found networks of zombie computers being used to spread spam, steal IDs and attack websites.
The agency said the zombies or bots were "a growing threat to national security".
The FBI has been trying to tackle networks of zombies for some time as part of an initiative it has dubbed Operation Bot Roast.
This operation recently passed a significant milestone as it racked up more than one million individually identifiable computers known to be part of one bot net or another.
The law enforcement organisation said that part of the operation involved notifying people who owned PCs it knew were part of zombie or bot networks. In this way it said it expected to find more evidence of how they are being used by criminals.
"The majority of victims are not even aware that their computer has been compromised or their personal information exploited," said James Finch, assistant director of the FBI's Cyber Division.
Many people fall victim by opening an attachment on an e-mail message containing a virus or by visiting a booby-trapped webpage.
Many hi-tech criminals are now trying to subvert innocent webpages to act as proxies for their malicious programs. Once hijacked, PCs can be used to send out spam, spread spyware or as repositories for illegal content such as pirated movies or pornography.
Those in charge of botnets, called botherders, can have tens of thousands of machines under their control.
Operation Bot Roast has resulted in the arrest of three people known to have used bot nets for criminal ends.
One of those arrested, Robert Alan Soloway, could face 65 years in jail if found guilty of all the crimes with which he has been charged.
In a statement about Operation Bot Roast the FBI urged PC users to practice good computer security which includes using regularly updated anti-virus software and installing a firewall.
For those without basic protections anti-virus companies such as F Secure, Trend Micro, Kaspersky Labs and many others offer online scanning services that can help spot infections.
The organisation said it was difficult for people to know if their machine was part of a botnet.
However it said telltale signs could be if the machine ran slowly, had an e-mail outbox full of mail a user did not send or they get e-mail saying they are sending spam.
Showing posts with label spam. Show all posts
Showing posts with label spam. Show all posts
Saturday, 7 July 2007
Tuesday, 29 May 2007
Email Validation Spec
The Internet Engineering Task Force (IETF) has adopted a vendor-developed specification designed to detect e-mail with bogus header information. The technology could help reduce spam and phishing attacks that clog Internet traffic.
Yahoo was the initial developer of the spec, called DomainKeys Identified Mail (DKIM), but other participants joined the effort, including Cisco, Sendmail and PGP Corporation for later revisions.
The hope is that the specification could succeed where other efforts have failed. It puts validation of both the sender and receiver at the domain level. Phishing almost always involves faking an address of a legitimate site, such as a bank or e-commerce sites like eBay and PayPal.
The spec will require a key for domains, but DKIM will distribute keys to any domain requesting one. Each domain has its own private and public keys. E-mail messages are signed with the private key and sent with the public key, which is embedded in the letter's header. The receiver then validates with the public key, and this tells the receiver that only someone with a valid private key could have originated the letter.
If the signature doesn't pass validation, the receiver has their choice of how to handle the letter. The DKIM spec doesn't dictate how to handle invalid letters. Most ISPs will likely label the letter junk mail although they have the right to block it.
Dave Crocker, principal consultant and founder of Brandenberg InternetWorking, is also involved in developing the spec and has decades of experience in working with e-mail systems. He said DKIM will be far more effective than the current method of IP filtering.
"IP addresses are a problem because they are associated with a machine rather than an organization or a person. Because they change, and they can be faked for all sorts of usage," he told internetnews.com.
One of the goals of DKIM is to create something easier to administer. A domain name is good for that, better than having it done on the individual clients. By having the server handle signing and validation, changes and updates are done on a few servers rather than every client computer.
However, that leaves DKIM open to a weakness. Crocker said it won't necessarily help defeat botnets (define), compromised computers with hidden software that pumps out spam unbeknownst to the computer's owner. Botnets are the primary source of spam on the Internet.
Because the client doesn't do the signing, the sending server does, DKIM has no way of knowing if an e-mail originated from the user's e-mail client or from a botnet program spitting out spam. And even if the good guys find a barrier, the bad guys find a way around it.
"DKIM is not about stopping botnets. It's about verifying that a message really involves whoever it says it involves. There's certainly an expectation it will be helpful against phishing because it allows you to start building for a basis for trust," he said.
It would also help that both sender and receiver are using DKIM. Moviola.com, a film equipment rental company in New York and Los Angeles, is one of the first companies to sign up for the service since its mail provider was involved in testing the specification, so it really isn't seeing benefits yet, said Shawn Silvas, system administrator with the company.
But he expects to. "It's going to change the nature of who's spamming," he said. "Hopefully it will help get rid of the spam, like zombies, but it won't help with business spam from legitimate companies like JC Penny. But if it can help reduce Viagra and stock spam, that will be nice."
Silvas said he doesn't care much for the existing spam blocking methods, such as IP black listing, because IP addresses can change on a DHCP network.
"Just because an IP has sent out spam in the past isn't always bad, and just because it's flagged as good doesn't mean I want it. That really hits hard on small businesses whose e-mail is legit because if they are on a DHCP connection, they could get blocked," he said.
The DKIM spec has been fully approved by the IETF and published as an RFC, so people can start deploying it now. Crocker maintains a list on his home page, which at this point is rather modest. He expects it to grow.
Yahoo was the initial developer of the spec, called DomainKeys Identified Mail (DKIM), but other participants joined the effort, including Cisco, Sendmail and PGP Corporation for later revisions.
The hope is that the specification could succeed where other efforts have failed. It puts validation of both the sender and receiver at the domain level. Phishing almost always involves faking an address of a legitimate site, such as a bank or e-commerce sites like eBay and PayPal.
The spec will require a key for domains, but DKIM will distribute keys to any domain requesting one. Each domain has its own private and public keys. E-mail messages are signed with the private key and sent with the public key, which is embedded in the letter's header. The receiver then validates with the public key, and this tells the receiver that only someone with a valid private key could have originated the letter.
If the signature doesn't pass validation, the receiver has their choice of how to handle the letter. The DKIM spec doesn't dictate how to handle invalid letters. Most ISPs will likely label the letter junk mail although they have the right to block it.
Dave Crocker, principal consultant and founder of Brandenberg InternetWorking, is also involved in developing the spec and has decades of experience in working with e-mail systems. He said DKIM will be far more effective than the current method of IP filtering.
"IP addresses are a problem because they are associated with a machine rather than an organization or a person. Because they change, and they can be faked for all sorts of usage," he told internetnews.com.
One of the goals of DKIM is to create something easier to administer. A domain name is good for that, better than having it done on the individual clients. By having the server handle signing and validation, changes and updates are done on a few servers rather than every client computer.
However, that leaves DKIM open to a weakness. Crocker said it won't necessarily help defeat botnets (define), compromised computers with hidden software that pumps out spam unbeknownst to the computer's owner. Botnets are the primary source of spam on the Internet.
Because the client doesn't do the signing, the sending server does, DKIM has no way of knowing if an e-mail originated from the user's e-mail client or from a botnet program spitting out spam. And even if the good guys find a barrier, the bad guys find a way around it.
"DKIM is not about stopping botnets. It's about verifying that a message really involves whoever it says it involves. There's certainly an expectation it will be helpful against phishing because it allows you to start building for a basis for trust," he said.
It would also help that both sender and receiver are using DKIM. Moviola.com, a film equipment rental company in New York and Los Angeles, is one of the first companies to sign up for the service since its mail provider was involved in testing the specification, so it really isn't seeing benefits yet, said Shawn Silvas, system administrator with the company.
But he expects to. "It's going to change the nature of who's spamming," he said. "Hopefully it will help get rid of the spam, like zombies, but it won't help with business spam from legitimate companies like JC Penny. But if it can help reduce Viagra and stock spam, that will be nice."
Silvas said he doesn't care much for the existing spam blocking methods, such as IP black listing, because IP addresses can change on a DHCP network.
"Just because an IP has sent out spam in the past isn't always bad, and just because it's flagged as good doesn't mean I want it. That really hits hard on small businesses whose e-mail is legit because if they are on a DHCP connection, they could get blocked," he said.
The DKIM spec has been fully approved by the IETF and published as an RFC, so people can start deploying it now. Crocker maintains a list on his home page, which at this point is rather modest. He expects it to grow.
Subscribe to:
Posts (Atom)