Slashdot Log In
Google Says Spam, Virus Attacks to Get More Clever
Posted by
CmdrTaco
on Mon Mar 10, 2008 11:39 AM
from the also-good-feels-good dept.
from the also-good-feels-good dept.
eweekhickins writes "Google's Postini team says new attacks will take the form of sneaky viruses that will blend with spam, leveraging specific current events, such as the Super Bowl or the Summer Olympic Games. Better yet, virus attacks will target executives at companies whose intellectual property is deemed valuable on the black market.
A lot of these attacks will masquerade as legitimate business agencies, such as the Internal Revenue Service, the Better Business Bureau and the SEC."
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
And you know (Score:5, Insightful)
Re:And you know (Score:5, Insightful)
Parent
Re: (Score:2, Insightful)
Re: (Score:3, Funny)
Re: (Score:2)
ten thousand?
Radiometric dating shows there are at least 4.54 billion people connected to the internet.
Re: (Score:2)
phishing attacks against irs.gov (Score:4, Interesting)
One was an ordinary phishing attack.
The other gave a URL in a valid subdomain of irs.gov
So either
- the attack was broken (certainly possible)
- the attack was relying on DNS cache poisoning or compromised servers
Parent
Re: (Score:2)
that these will be successful. So many suckers, so little time./quote.
Not with me. I us Linux and get my meds from my doctor (or local dealer, depending on the "med").
Re: (Score:2)
that these will be successful. So many suckers, so little time.
(that looks better)
Its kinda ironic (Score:3, Funny)
SSDD (Score:4, Interesting)
The bastards!! I'd better warn my associates in South Africa.
Seriously, TFA comes off as a padded version of "uhm, so...they're probably going to keep finding new ways to do this...since that's what they already do". The report itself looks to hold a little more substance, but then, I guess it's hard to make news out of spam that doesn't involve a big shift in the court, because it's pretty boring by definition.
You don't say? (Score:5, Funny)
What happened to "Bayesian Filters"... (Score:4, Interesting)
What happened?
Parent
Re: (Score:3, Informative)
In conclusion: whenever you hear the word "totally solve" being associated with anything involving uncertain/probabilistic rea
Crims get more entrepreneurial (Score:5, Informative)
Crims have always been good at adapting and exploiting conditions. The Mafia really got their power due to exploiting the prohibition. Cable thieves in South Africa are using rolling blackout schedules to plan their cable thefts.
As more business services are done online it makes sense to phish for more than some lame paypal accounts.
Re: (Score:3, Insightful)
/. emails. (Score:3, Funny)
Ric Romero working for Google? (Score:2)
IT systems are increasingly complex, security is still an after-thought on products (instead of a core design consideration), and there's also the simple economies of scale; what was tens of thousands of targets, became millions of targets, and is now probably billions. A simple crack that works on 0.001% of the systems will still be cost-effective for whatever the net result is, most likely.
And?
Google? Don't you just mean Postini? (Score:4, Informative)
Re: (Score:2)
Plus, I imagine a year is an eternity at Google.
Well, which is it? (Score:5, Funny)
A lot of these attacks will masquerade as legitimate business agencies, such as the Internal Revenue Service, the Better Business Bureau and the SEC.
Will these attacks masquerade as legitimate business agencies, or as agencies such the Internal Revenue Service, the Better Business Bureau, and the SEC?
ASCII art (Score:5, Interesting)
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Interesting)
http://www.jasons-toolbox.com/images/ASCIISpam.jpg [jasons-toolbox.com]
Obviously that mess of characters between "www" and "com" was their URL which I've munged so as not to give them any traffic.
Re: (Score:2)
Wait, isn't this already the case? (Score:3, Informative)
How? (Score:2)
Re:How? (Score:4, Funny)
Parent
Re: (Score:2)
Re: (Score:2)
YAWN (Score:4, Insightful)
Re: (Score:3, Funny)
This is a sales pitch, there's nothing new in that article. Google is just fishing for more business for postini...
You mean TFA is just a sophisticated form of spam :-)
Rich.
Human Intelligence (Score:3)
Targeting executives (Score:2, Interesting)
SMTP = evil (Score:2)
The sheer amount of bounced spam that I get makes me want to surrender my email account and move to a mountaintop in Nepal and herd goats.
In other news.... (Score:2)
(translation for sarcasm impaired - "duuh!!")
-Em
Slashdot article links to hostile code (Score:2)
Nice demo. The link for this article leads to an ad page which won't close if you have AdBlock installed.
Like a firehose.... (Score:3, Informative)
Here's a simple example: most Gmail users know they have a Spam folder, into which Gmail transfers any messages which appear "spammy." This works pretty well, and I keep around 30 days worth in there, as I used to occasionally look through for false positives (which happened sometimes.)
The problem now is just that there is too much spam to do this. Let's compare: here is the count of spam in ONE Gmail account, for the past 30 days -- can anyone match it?
Spam (84194)
I figure that's a rate of 2,800 per day, or 116 per hour. Nearly two spam messages, every minute, 24x7.... and most of it consists of duplicates. Why are the spammers doing this? Unless they are paid per message they send, I don't see it improving their chances of getting a message past filters.
Re: (Score:2)
It's likely that you are on the spammers list more than once, though a smarter spammer would check for that sort of thing, so quite possibly you are in a number of different lists that the same spammer is using.
Re: (Score:2)
I figure that's a rate of 2,800 per day, or 116 per hour. Nearly two spam messages, every minute, 24x7.... and most of it consists of duplicates. Why are the spammers doing this? Unless they are paid per message they send, I don't see it improving their chances of getting a message past filters.
The spam is being sent by a botnet of indeterminate size, and not always in direct communication back to their "masters". Sending emails, even duplicates, costs nothing and is better than having to know the siz
Time for PGP/SMIME to go mainstream? (Score:4, Interesting)
This would help against spam similar to how anti-phishing technologies in IE and Firefox protect against bad websites, but its still not perfect.
S/MIME and PGP are strong technologies to help against fraud. I just wish more companies would send out mail with it. For example, one could register a PGP public key with a shop, and when the shop would send E-mail, it would send it signed, and encrypted to that key. Even just using S/MIME's signing capability which works with virtually any E-mail client [1] would help matters greatly.
[1]: Even pine and mutt support S/MIME. A lot of cellphones support this functionality as well, such as all recent Windows Mobile devices and Blackberries.
Good idea, however... (Score:5, Insightful)
However, I can see a few issues that would impact the rate of adoption and the overall utility of your approach (assuming, for the sake of simplicity, that the cryptographic aspects are implemented in a truly secure manner, the crypto itself is strong, etc. I fully realize that this is like the proveribial "frictionless surface" and the proverbial "ideal conductor" used in science books. I'm just trying to cover the big points here, OK?):
1. It will not happen until Verisign (for example) decide that there is enough of a market that they can make a decent profit.
2. It will either price small businesses out of the market (given Verisign's prices, this is likely) or it the price will be such that small businesses can afford it and then so can the spammers. Before you start claiming that is why there is a vetting process, I would suggest that hurdles low enough for small "mom-and-pop" businesses to jump will be low enough for a determined spammer.
3. Either we need a "Root CA" mechanism like other certificates (again, profit and "are you sure you can trust this") or the whole "web of trust" thing from PGP. The web of trust would be difficult in that it would make legit messages appear fake until you can determine it. Also, how would "Joe Sixpack" know the difference between a legit cert for the IRS and a faked one?
Your idea is good. Unfortunately, the current environment is not ready for it. I hope we will see the day when it will work.
Parent
will?? (Score:2)
nothing to see here, please move on.
Great (Score:2)
Perhaps then something might get done.
Good... (Score:2)
Hopefully the spammers will develop better bots which target only those.
My first thought... (Score:2)
Like the numbers stations (Score:4, Interesting)
Already Happening (Score:2)
By the Power of Grayskull NO..... (Score:4, Funny)
They found the biggest security weakness of every single company... The Pointy Haired Ones.