<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>An Information Security Place &#187; Spam</title>
	<atom:link href="http://infosecplace.com/blog/category/spam/feed/" rel="self" type="application/rss+xml" />
	<link>http://infosecplace.com/blog</link>
	<description>Commentary on the State of Information Security</description>
	<lastBuildDate>Wed, 23 Jun 2010 11:19:44 +0000</lastBuildDate>
	<generator>http://wordpress.org/?v=2.9.2</generator>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
			<item>
		<title>What do we call Twit Spam?</title>
		<link>http://infosecplace.com/blog/2008/09/03/what-do-we-call-twit-spam/</link>
		<comments>http://infosecplace.com/blog/2008/09/03/what-do-we-call-twit-spam/#comments</comments>
		<pubDate>Wed, 03 Sep 2008 21:30:49 +0000</pubDate>
		<dc:creator>Michael Farnum</dc:creator>
				<category><![CDATA[Spam]]></category>
		<category><![CDATA[Twitter]]></category>

		<guid isPermaLink="false">http://infosecplace.com/blog/2008/09/03/what-do-we-call-twit-spam/</guid>
		<description><![CDATA[I have been blocking more and more Twit spam followers lately on my Twitter account.  Some of the accounts have been suspended by Twitter, which is great, but it is still a a nuisance.  Just one more by-product of Web 2.0 I guess.
But the real quandary is what to call Twitter Spam.  SPIT is already [...]]]></description>
			<content:encoded><![CDATA[<p>I have been blocking more and more Twit spam followers lately on my <a href="http://twitter.com/m1a1vet">Twitter account</a>.  Some of the accounts have been suspended by Twitter, which is great, but it is still a a nuisance.  Just one more by-product of Web 2.0 I guess.</p>
<p>But the real quandary is what to call Twitter Spam.  SPIT is already taken (Spam over Internet Telephony).  Maybe SPITT, with an extra &#8220;T&#8221;?  How about TWAM?  But most spam names are acronyms and start with &#8220;SP&#8221;.  How about SPER?  Uhhh, that would probably not be good.  SPITTER?  Hmmm, that might work.</p>
<p>Any ideas?</p>
<p><strong>[UPDATE]: What about &#8220;Spittle&#8221;?</strong></p>
<p>Vet</p>
]]></content:encoded>
			<wfw:commentRss>http://infosecplace.com/blog/2008/09/03/what-do-we-call-twit-spam/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>SpamThru trojan analysis</title>
		<link>http://infosecplace.com/blog/2006/10/23/spamthru-trojan-analysis/</link>
		<comments>http://infosecplace.com/blog/2006/10/23/spamthru-trojan-analysis/#comments</comments>
		<pubDate>Mon, 23 Oct 2006 16:37:42 +0000</pubDate>
		<dc:creator>Michael Farnum</dc:creator>
				<category><![CDATA[Malware]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Spam]]></category>

		<guid isPermaLink="false">http://infosecplace.com/blog/2006/10/23/spamthru-trojan-analysis/</guid>
		<description><![CDATA[Link
This is the trojan I mentioned in my last post.
Vet
]]></description>
			<content:encoded><![CDATA[<p><a href="http://www.secureworks.com/analysis/spamthru/" target="_blank">Link</a></p>
<p>This is the trojan I mentioned in my last post.</p>
<p>Vet</p>
]]></content:encoded>
			<wfw:commentRss>http://infosecplace.com/blog/2006/10/23/spamthru-trojan-analysis/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Spammers getting ultra-sophisticated</title>
		<link>http://infosecplace.com/blog/2006/10/20/spammers-getting-ultra-sophisticated/</link>
		<comments>http://infosecplace.com/blog/2006/10/20/spammers-getting-ultra-sophisticated/#comments</comments>
		<pubDate>Fri, 20 Oct 2006 22:38:09 +0000</pubDate>
		<dc:creator>Michael Farnum</dc:creator>
				<category><![CDATA[Malware]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Spam]]></category>

		<guid isPermaLink="false">http://infosecplace.com/blog/2006/10/20/spammers-getting-ultra-sophisticated/</guid>
		<description><![CDATA[Go check out this articleÂ at Dark Reading.Â  Looks like this group is creating a botnet with a trojan that has a cracked version of Kaspersky AV to clean machines (except for itself, of course) to make sure it gets all the bandwidth it can to send out spam.Â  It is called the SpamThru trojan.Â 
This is [...]]]></description>
			<content:encoded><![CDATA[<p>Go check out <a href="http://www.darkreading.com/document.asp?doc_id=107951" target="_blank">this article</a>Â at Dark Reading.Â  Looks like this group is creating a botnet with a trojan that has a cracked version of Kaspersky AV to clean machines (except for itself, of course) to make sure it gets all the bandwidth it can to send out spam.Â  It is called the SpamThru trojan.Â </p>
<p>This is crazy.</p>
<p>Vet</p>
]]></content:encoded>
			<wfw:commentRss>http://infosecplace.com/blog/2006/10/20/spammers-getting-ultra-sophisticated/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Akismet was down today</title>
		<link>http://infosecplace.com/blog/2006/08/27/akismet-was-down-today/</link>
		<comments>http://infosecplace.com/blog/2006/08/27/akismet-was-down-today/#comments</comments>
		<pubDate>Mon, 28 Aug 2006 00:01:13 +0000</pubDate>
		<dc:creator>Michael Farnum</dc:creator>
				<category><![CDATA[Blogging]]></category>
		<category><![CDATA[Spam]]></category>

		<guid isPermaLink="false">http://infosecplace.com/blog/2006/08/27/akismet-was-down-today/</guid>
		<description><![CDATA[Thanks to Mike at MCWResearch for letting me know that Akismet was down today.Â  I got a good amount of obvious spam, butÂ they caught it pretty quick and everything seems OK now.Â  I didn&#8217;t notice it because it is Sunday, and I just happened to check my email.
I can&#8217;t say anything bad about those guys [...]]]></description>
			<content:encoded><![CDATA[<p>Thanks to Mike at <a href="http://mcwresearch.com/" target="_blank">MCWResearch</a> for letting me know that <a href="http://akismet.com/blog/2006/08/downtime/" target="_blank">Akismet was down today.</a>Â  I got a good amount of obvious spam, butÂ they caught it pretty quick and everything seems OK now.Â  I didn&#8217;t notice it because it is Sunday, and I just happened to check my email.</p>
<p>I can&#8217;t say anything bad about those guys at Akismet.Â  Thanks for all you do over there.</p>
<p>Vet</p>
]]></content:encoded>
			<wfw:commentRss>http://infosecplace.com/blog/2006/08/27/akismet-was-down-today/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Comment spam</title>
		<link>http://infosecplace.com/blog/2006/08/17/comment-spam/</link>
		<comments>http://infosecplace.com/blog/2006/08/17/comment-spam/#comments</comments>
		<pubDate>Thu, 17 Aug 2006 20:15:27 +0000</pubDate>
		<dc:creator>Michael Farnum</dc:creator>
				<category><![CDATA[Blogging]]></category>
		<category><![CDATA[Spam]]></category>

		<guid isPermaLink="false">http://infosecplace.com/blog/2006/08/17/comment-spam/</guid>
		<description><![CDATA[Here&#8217;s my &#8220;poor self esteem&#8221; question for the week.  Should I be concerned that I have not been getting much comment spam the last two weeks?  I am fairly sure my readership has gone up in the last month or so, but the amount of spam has gone down.  I use Akismet, [...]]]></description>
			<content:encoded><![CDATA[<p>Here&#8217;s my &#8220;poor self esteem&#8221; question for the week.  Should I be concerned that I have not been getting much comment spam the last two weeks?  I am fairly sure my readership has gone up in the last month or so, but the amount of spam has gone down.  I use Akismet, and it does a great job.  But I was getting 20 and 30 at a time.  Now I can go a day or more without one.  When I do get them, it is maybe 2 or 3 at a time.</p>
<p>BTW, Mike Rothman&#8217;s links to my blog keep getting marked as spam, even after a few times of marking them as not spam.</p>
<p>What are you doing over there, Mike?  I&#8217;m starting to get suspicious.  <a href="http://infosecplace.com/blog/wp-content/uploads/2006/08/WindowsLiveWriter/Commentspam_D68C/SI-Logo-SF%5B2%5D.gif"><img width="140" height="38" src="http://infosecplace.com/blog/wp-content/uploads/2006/08/WindowsLiveWriter/Commentspam_D68C/SI-Logo-SF_thumb.gif" /></a></p>
<p>Vet</p>
]]></content:encoded>
			<wfw:commentRss>http://infosecplace.com/blog/2006/08/17/comment-spam/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>Stock Spam</title>
		<link>http://infosecplace.com/blog/2006/08/17/stock-spam/</link>
		<comments>http://infosecplace.com/blog/2006/08/17/stock-spam/#comments</comments>
		<pubDate>Thu, 17 Aug 2006 17:09:37 +0000</pubDate>
		<dc:creator>Michael Farnum</dc:creator>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[Spam]]></category>

		<guid isPermaLink="false">http://infosecplace.com/blog/2006/08/17/stock-spam/</guid>
		<description><![CDATA[I saw this article about the rise of image spam, and I started thinking about the image spam I have been receiving.  A very high percentage of it (for me) has been stock spam, just like in this article.  And the author of the article mentioned that there was a rise in the [...]]]></description>
			<content:encoded><![CDATA[<p>I saw <a target="_blank" href="http://searchsecurity.techtarget.com/tip/0,289483,sid14_gci1210679,00.html?track=sy320">this article</a> about the rise of image spam, and I started thinking about the image spam I have been receiving.  A very high percentage of it (for me) has been stock spam, just like in this article.  And the author of the article mentioned that there was a rise in the value of the stock (almost 28%) from the previous day&#8217;s closing.  This obviously could have been a coincedence, but it got me to thinking.</p>
<p>So, I bought a few penny stocks, connected to my IRC server, got a few bots going,&#8230;oh, wait.  Sorry, my nefarious personality just reared his head.</p>
<p>Anyway, I thought it would be cool to track the effectiveness of stock spam.  Does this actually work?  It certainly seems plausible.  Unfortunately, I delete all the spam that comes in to me, so I don&#8217;t have a good record.  I thought I would hit my email gateway&#8217;s message log and filter on &#8220;stock&#8221; to get a list, but that doesn&#8217;t work too well because the spammers don&#8217;t usually include the actual word &#8220;stock&#8221; in their emails, and it definitely doesn&#8217;t work in image spams.</p>
<p>So, what to do?  I don&#8217;t want to have to wait too long to gather a bunch of spams, especially since my filter seems to be performing better since I did some tuning.  So, I thought I would look around the net for something.  Lo and behold, I am not as an original thinker as I thought.  Take a look at <a target="_blank" href="http://www.crummy.com/features/StockSpam/">this site</a>.</p>
<p>Here&#8217;s a quick screen shot as well.</p>
<p><a href="http://infosecplace.com/blog/wp-content/uploads/2006/08/WindowsLiveWriter/StockSpam_AAFB/stock%20spam%5B1%5D1.jpg"><img width="240" height="187" border="0" style="border: 0px none " src="http://infosecplace.com/blog/wp-content/uploads/2006/08/WindowsLiveWriter/StockSpam_AAFB/stock%20spam1.jpg" /></a></p>
<p>Basically, this site is showing the short term gains that a lot of stocks show when a stock spam comes out.  It is interesting, but <a target="_blank" href="http://www.spamstocktracker.com/">this site</a> shows that almost every stock that has been spammed shows a long term drop.  This didn&#8217;t surprise me at all, but it is still an interesting point.</p>
<p>Go <a target="_blank" href="http://www.spamnation.info/stocks/FAQ.html">here</a> to see an excellent FAQ about stock spam and <a target="_blank" href="http://www.spamnation.info/stocks/">here</a> to see a list of spam-advertised stocks (both of these are also linked at the first site above).</p>
<p>Vet</p>
]]></content:encoded>
			<wfw:commentRss>http://infosecplace.com/blog/2006/08/17/stock-spam/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>
