TechWeb Spams me; Am I "Impatient"?

Oh, this is just peachy. It's amazing how some legitimate organizations just love to act like spammers. Well, if it walks like a duck and quacks like a duck...

[Also note update at end]

I was recently interviewed by the delightful Kelly Jackson Higgins at Dark Reading for an interesting story about legitimate organizations that get the reputation of being spammers. But I had to tell Kelly about a bad experience I had with her organization spamming me. I'd registered to post at Dark Reading's forum. I religiously checked the privacy policy, and unsubscribed from all the newsletters and "information about exciting new products and services."

However, within the hour I started getting promotional email from Dark Reading's parent company, Light Reading, Inc. (Both organizations are part of TechWeb.) While I'm aware that ZDNet is a spammer haven, I'd not come across this problem with TechWeb before.

After some investigation and back-and-forth emails, Kelly blogged the spamming issue, including comments from Warren Hultquist and Chris Williams, from Light Reading's "Web Team." These amount to the usual litany of spammer excuses:

1. Just unsubscribe, using the link in the email.
   
2. It's noted in our privacy policy.
   
3. Promotional email is the price of registration.

My response:

1. I did unsubscribe. As instructed in your privacy policy, I unchecked the box labeled, "Occasionally Light Reading Inc. sponsors may want to send you information about exciting new products and services. If you prefer not to receive these solicitations, please uncheck this box."
2. Your privacy policy does not say anything about unsubscribing from promotional email using a link within such email. What it does say is, "At any time, you may opt out of receiving information about Light Reading or other parties by changing your registration profile." This is precisely what I did. After registration, I went to the User Preferences page and ensured that I was unsubscribed from everything (including the section in the picture below).
   
3. In my opinion, such Faustian bargains are OK, so long as there's informed consent. The policy as described by Warren and Chris clearly doesn't meet this test. In addition, Light Reading isn't abiding by its privacy policy.
   

Oh, and by the way, your privacy policy's link to the "User Preferences" page is 404. I think you meant this one.

Finally, Kelly signs off with "a less patient user might report it as spam." Well, I guess that makes me impatient, then.

Ironically, this was the whole point of the original article -- if senders do stupid things, they'll get reported to blacklists, so their deliverability will come crashing down, causing bad things to happen to their business.

Update 1: it seems Dark Reading have heeded the key complaint and added two more checkboxes to the preferences page. In life, the mistakes we make aren't as important as how we fix the issues that arise.

Update 2: the next post is a forum exchange between Light Reading's web team and me.

The 2000 Bloggers Project

Check out the latest idea from the crazy world of Tino Buntic (crazy name, crazy guy). He's trying to link to 2000 bloggers, with photos.

Pump'n'Dump: It's all About the Timing, Baby

Funny guy: What's the secret of great comedy?
Straight man: I don't know, what is the secret of gr...
Funny guy: Timing.

And timing is also the secret to profitable stock kiting. In my previous post, I quoted Symantec's Amado Hidalgo, who hinted that the Trojan writers appeared to be working to a deadline. Presumably it was a deadline imposed by their stock-kiting scam-masters.

I'm guessing from the date of the blog post that the "burst of almost 1,800 emails" that Hidalgo talks about would have been over the weekend, or certainly before the markets opened on Monday.

Yes, timing is everything when encouraging fools to part with their cash. The botnet needs to be ready to spew out its quota of kiting come-ons at what the scammers calculate is just the right moment:

• Too soon, and they risk clever day-traders buying in on the upswing and cashing out before the scammers do, thus reducing the ill-gotten profits

• Too late, and the regulators might take an interest in the scammers' unusual transactions, before the scammers have had a chance to cash out and launder the profit

Not only that, but the spam needs to be sent in as short a time as possible -- in one, concentrated burst. If it's too spread out, the scammers can suffer either or both of the problems above. I conclude that this is why we're seeing these new botnets send a load of messages quickly, then falling silent -- as opposed to dribbling out fewer over a longer period.

This new strategy risks quicker discovery, but there seems to be no end to virus writers' ingenuity in infecting new victims' PCs.

Pump'n'Dump Spam Botnets: New Malware

This post is a quick overview of the latest happenings in the world of stock-kiting botnet malware. The key news is a nasty new derivative in the CME-711 family of Trojan Horses (AKA Trojan.Peacomm, TROJ_SMALL.EDW, Small.DAM, Downloader-BAI, Troj/Dorf-Fam).

In case you've been living in a cave for months, stock-kiting spam (AKA pump'n'dump spam) is a major part of most people's inbound spam right now. Most of it's being sent by botnets (networks of malware-infected PCs).

It uses a simple-yet-effective social engineering technique to fool unwary recipients into opening an executable. It promises video of Saddam Hussein, European storms, Chinese missiles, or other breaking news, designed to make people put their critical faculties to one side (assuming they had any in the first place).

Symantec's Amado Hidalgo has an in-depth writeup of how the Trojan builds a botnet. Money quotes:

The bot ... has fully fledged rootkit capabilities, albeit not very sophisticated. It would appear that the malware writers were in a rush to get the new version out as quickly as possible and some functionality of the rootkit has not been implemented correctly ... So, what is the purpose of all this renewed activity, you ask? The primary goal is to create a botnet that sends tons and tons of penny stock spam.
...
We saw an infected machine sending a burst of almost 1,800 emails in a five-minute period and then it just stopped.

In my next post, I'll talk about how timing is all-important, when running a stock-kiting scam.

Symantec: Spammers Forge Phony Newsletters, Trying to Fool Filters

It seems that spammers have a new tactic in their war to get their unwanted... uhhh... content through our spam filters: forged newsletters.

What they're doing is sending messages that look like legitimate newsletters. Nasty. Examples seen so far appear to be from well-known brands such as 1-800-Flowers, Kohl, U.S. Airways, and "a fantasy football league" [Statto the spammer?].

There's no suggestion that the spammers have broken into the sending systems used by these brands. They just seem to be cloning legitimate content and modifying it. In the same way that phishers modify a bank's legitimate transactional messages to link to their own site, these spammers are taking copies of legitimate newsletters and tweaking them to include their spamvertisements.

But why go to all that trouble?

The idea is to take advantage of people's abhorrence of false positives. Spam filters will be carefully programmed, trained, or whitelisted to let legitimate newsletters through. If a spammer can make their spam look like one of these newsletters -- especially a widely-read newsletter -- they can get through the filter and in front of the user's eyes.

The spammers only seem to be testing the tactic right now -- it's at a very low level, but the theory is that if they find this is an effective trick, we'll see it a lot more.

I've not seen the test runs in my overflowing spam traps -- credit for discovering the phony newsletters goes to Symantec. I guess it takes a large organization, with 24x7, follow-the-sun labs to really keep on top of new developments in spam tactics. It's the speed of identifying these sort of early indications that separates the men from the boys, as it were.

Update: Symantec sent a picture to illustrate. Wasn't that kind?

More coverage:

• David Utter: Spammers Target Email Newsletters
  
• Richard M. Georges: New spam trick
• Anick Jesdanun: New spam trick
• Kelly Jackson Higgins: Spam Hidden in Email Newsletters
• Frank Washkuch: Spammers hijacking legit newsletters
• SecGuru/Nov1: Newsletter creators aren't the only ones hoping their products don't get caught in spam filters