Blue Security "do not email list" compromised? No!

It had to happen. I'm amazed it's taken so long.

Spammers are passing around a list of names that is purportedly the Blue Frog "do not email" list. Someone is already spamming the list with dire warnings of falling skies.

I've seen the list. It's not complete in the sense that it doesn't include the wildcard domain entries. It also doesn't include spamtraps that I know to be there. Presumably a spammer has taken his list and "cleaned" it against the blue list, then done a diff? Like I say, I'm amazed it's taken so long.

In other words, people won't get spam from these spammers unless they're already getting spam from them.

Blue Security's community forums are down "for maintenance." ;-)

Links (updated as I find them): 1 2 3 4 5 6 7 8 9...

Visit SpamOrHam.org and assist anti-spam research

Last week, John Graham-Cumming launched SpamOrHam.org. If you're familiar with 'Hot or Not' you'll probably get the idea. As Graham-Cumming says:

The basic idea is to get humans (that means you) to read a small number of messages (some are ham; some are spam) and decide what they are. I'm doing this because there are currently two usable corpuses of spam and ham: the SpamAssassin Public Corpus (which was hand sorted) and the TREC 2005 Public Corpus (which was machine sorted) ... Once I've got enough human decisions (I'd love to get 10 per message; that means almost 1,000,000 human classifications) I'll make all the data public.

In other words, if you visit the site, you can vote on individual messages, to say whether or not you think they are spam or legitimate. This voting will be very helpful to spam researchers, because an acurate "corpus" of spam and ham allows them to automatically test new anti-spam techniques. Graham-Cumming continues:

I'll highlight any emails where people disagree with the current classification published by Gordon Cormack ... I expect it'll throw up some interesting data... for example, just how good are humans are sorting spam? Since we'll be able to look at where the corpus and the humans disagree we'll be able to spot machine errors and human errors.

Tips for your new anti-spam idea

So you have a fantastic new idea to solve the spam problem once and for all? Of course, you're sure it'll work brilliantly and you're sure nobody else has thought of it.

Sounds like you've come up with what spam fighters call a FUSSP -- a Final Ultimate Solution to the Spam Problem. Vernon Schryver maintains a list of fallacies that appear again and again from FUSSP inventors. It's fairly impenetrable to those outside the spam-fighting clique (as some think of it). So here are a few rephrased highlights. Think of them as tips to prevent making yourself look foolish:

• Don't assume that spammers are stupid.
• Don't rely on email recipients changing their behavior with nothing to show for it.
• Don't rely on other email senders responding to automatic challenges (or on victims of challenges sent to forged addresses not to respond).
• Don't rely on all ISPs, web hosts, and registrars being active, reponsible, spam-hating net citizens.
• Don't propose replacing SMTP, DNS, TCP/IP, Microsoft Exchange, Lotus Notes/Domino, or other immovable objects.
• Know what these terms mean: tarpit, DNSBL, HELO, EHLO, MX, RMX, MTA, MUA, DCC.
• Know the difference between the SMTP envelope and header.
• If your scheme requires a new standard, make sure you understand how standards are set on the Internet -- at a minumum, read and understand RFC 2223 and RFC 2026.
• With few exceptions, strangers won't pay money to send you mail.

Panda Software has a shill?

I just got a spammy comment in my moderation queue linking to pandasoftware.com. (Well, I say "linking" -- in fact the spammer mistyped the link.)

Here's the details:

Referrer was a Google search for blog virus
IP was 62.14.249.65 (looks like customer space in a Spanish ISP called Jazztel)
Computer runs WinXP at 1280x1024 with IE6 and JavaScript enabled.

Spain, huh? In which country is Panda based?

While I'm sure Panda Software will tell me that this person isn't doing this with their permission, let me say ... ¡Este comportamiento no es aceptable!

SearchSecurity: It's time to fix AV warning messages

SearchSecurity has published an expanded version of my blog post from last month, It's time to fix AV warning messages:

Ever received e-mail from your company's antivirus filter, telling you that someone you've never heard of has sent you a virus? I'm betting you have. If not ... well, consider yourself lucky.
These AV warning messages have become nearly as frequent and as burdensome as run-of-the-mill spam. They're certainly not doing the job they were intended to do. [more]