The Language of Internet Danger He Internet Spawns Files for Messages That Include a Contact Page for a Water System, New Meaning for Random Text to Confuse Filters
Total Page:16
File Type:pdf, Size:1020Kb
by Jen Sharp JenSharp.com The language of Internet danger he Internet spawns files for messages that include a contact page for a water system, new meaning for random text to confuse filters. The recreational activity or club. words that used to be part unnecessary costs Spammer robots are created that of a different vernacular. in time, money, automatically detect an e-mail But as our culture and resources are address format from Web pages changes, passed on to users much like search engines “crawl” Tso does the in the form of sites to index them. Then, the technology higher access that gives fees. Using Where did using the term rise to new filters is only “spam” to mean unsolicited definitions – a temporary e-mail originate? and not always solution, and only The prevailing theory is that it is from the song for the better. worthwhile when they are in Monty Python's famous spam-loving vikings coupled with some of the other Spam and sketch that goes, roughly, "Spam spam spam weapons for combating spam. Filters spam, spam spam spam spam, spam spam spam Spoofing spam..." The vikings, who were sitting in a Today spam is not primarily restaraunt whose menu only included dishes the harmless yet repugnant brick A “spoof” used refer to a satire made with spam, would sing this refrain over and of chopped meat product. It is or parody. The Internet version of a over, rising in volume until it was impossible for now the scourge of the e-mail spoof is not as innocuous. One of the other characters in the sketch to converse inbox. By December 2006 spam the dangerous things about (which was, of course, a large part of the joke.) accounted for 90% of all e-mails. spammers is an ability to “steal an – from www.cybernothing.org And there’s more bad news on the identity.” They can do this even if horizon – it is predicted to get worse. Specialists The Internet spawns new meaning for words that used at the California to be part of a different vernacular. But as our culture based global IT security firm, changes, so does the technology that gives rise to new Secure Computing, predict that the definitions – and not always for the better. volume will fraudster spoofs your e-mail increase to 97% no personal information is given address and uses it as the “Return- by December out. Let’s say a user has an e-mail Path” for their spam e-mails. Any 2007! address on a Web site, on a return path can be used by simply Jen Sharp Like the oil changing a user’s e-mail account JenSharp.com filter on a car, settings. It doesn’t even have to be spam filters work similarly, but a valid e-mail address. It can appear they are not a stand alone solution. that any innocent Internet user is There is simply too much spam! sending out spam, even if it did Filtering means the end user, the not originate from their computer! Internet Service Provider (ISP), A somewhat effective solution and the computer system all have for this is a Javascript snippet that to work together and work harder. is placed directly into the html Yet, spam still gets through as document exactly where the e- spammers incessantly find new mail address will be displayed ways around filters. For example, (see at left.) Another solution is to spammers are now using image use an e-mail address separate 20 THE KANSAS LIFELINE March 2007 from one’s personal will redirect to the address for public use. E-mail header – complete appropriate region. Most Yahoo and Hotmail are of the time, one will find two providers of free from sender to recipient the IP address as part of a e-mail services. From KRWA Wed Jan 10 06:24:34 2007 range of numbers assigned to a company. However, Headers X-Apparently-To: [email protected] via 192.168.12.711; Wed, 10 Jan 2007 06:27:16 -0800 by looking at the range of Not the All-American X-Originating-IP: [192.168.12.711] IP addresses, an double header baseball Return-Path: <[email protected]> investigator can narrow game, e-mail headers are Authentication-Results: mta129.sbc.mail.mud.yahoo.com down what company a a sort of “envelope” that from=krwa.net; domainkeys=neutral (no sig) Received: from 192.168.18.408 (EHLO particular spammer uses traces the path of an e- as their ISP. E-mail mail from its sender to its flpi136.sbcis.sbc.com) (192.168.189.408) by mta129.sbc.mail.mud.yahoo.com with SMTP; Wed, 10 addresses can be found recipient. In the sidebar at Jan 2007 06:27:16 -0800 along with physical right shows an example of X-Originating-IP: [192.168.12.711] addresses, and phone an e-mail header. The Received: from vision.worldhosted.com numbers to contact these number following the (vision.worldhosted.com [192.168.12.711]) companies. Since in most Originating IP is usually by flpi136.sbcis.sbc.com (8.13.8 inb/8.13.8) with ESMTP id l0AER40W007437 cases, individuals will the sender’s IP address have a different IP number (the yellow hi-lited line). for <[email protected]>; Wed, 10 Jan 2007 06:27:05 -0800 each time they log on, a An IP address is a Received: from SMTP32-FWD by jensharp.com sleuth will need to report specially assigned (SMTP32) id A037032D0; Wed, 10 Jan 2007 09:22:59 -0500 the IP number and time of number, like a serial Received: from server.haugcomm.com [12.40.38.9] by the abuse to the network number, assigned to the vision.worldhosted.com with ESMTP administrators, who user’s exact computer. (SMTPD32-8.05) id A65E2DE4007C; Wed, 10 Jan 2007 09:21:18 -0500 should be able to use log Although the user can files to contact the assign their own IP Received: from 12.40.38.196.haugcomm.com ([12.40.38.196] helo=[192.168.0.5]) individual involved. ISPs address to their hard by server.haugcomm.com with esmtpa (Exim 4.60) will not give out detailed drive, many Internet (envelope-from <[email protected]>) information about the service providers id 1H4eNR-0006cx-Tg exact user. If that company dynamically assign a for [email protected]; Wed, 10 Jan 2007 08:25:12 -0600 Message-ID: <[email protected]> receives multiple and number to the user as they frequent abuse complaints log onto their service. The Date: Wed, 10 Jan 2007 08:24:34 -0600 From: KRWA <[email protected]> about a particular IP IP addresses following User-Agent: Mozilla Thunderbird 1.0.7 address, they can take Received: from tells the (Windows/20050923) action on that spammer, story from top to bottom, X-Accept-Language: en-us, en such as a refusal to the path that e-mail took MIME-Version: 1.0 continue providing service. to reach the user’s To: Jen Sharp <[email protected]> Obviously, looking up computer. Online Subject: Re: Web Update an IP address for every databases can be used to References: <[email protected]> In-Reply-To: <[email protected]> spam e-mail would be look up information about Content-Type: multipart/alternative; time consuming and suspect IP addresses. boundary="------------070708090509090601050300" nearly impossible. Internet numbers are Content-Length: 422056 However, if there is a assigned by region. particular repetitive Anyone can look up a How do I view a header in my e-mail program? problem, complaining to specific IP address using the ISP of a spammer can any one of these Regional With Outlook Express – Select a message, under main menu: get results. There are also File, Properties, Details tab Internet Registries (RIR) services and shareware With MS Office – Select a message, under main menu: View, and find information available that do this about where that IP Options: Internet Headers at bottom of window With Yahoo – click on Full Headers at the top right of automatically, such as originated (see chart on SpamCop, Spam!Alert, the next page.) It may not the message With Hotmail – on top menu bar at right: Options, Mail Display and Spam Control. Other known immediately what resources can be found at region the IP address is Settings, under Message Headers select Full or Advanced With Thunderbird – under the main menu: View, Headers, All http://spam.abuse.net/ in, but these IP databases userhelp/#report. March 2007 THE KANSAS LIFELINE 21 The language of Internet danger . World Regional Internet Registries APNIC – Asia Pacific Network Information Centre www.apnic.net/apnic-bin/whois.pl Asia/Pacific Region RIPE NCC – Réseaux IP Européens Network Europe, the Middle East, Central Asia, and African Coordination Centre www.ripe.net/perl/whois countries located north of the equator ARIN – American Registry for Internet Numbers Canada, the United States, and several islands in www.arin.net/whois the Caribbean Sea and North Atlantic Ocean AfriNIC – African Regional Network Africa Region Information Centre www.apnic.net/apnic-bin/whois.pl LACNIC – Latin American and Caribbean Internet Addresses Registry http://lacnic.net/cgi-bin/lacnic/whois Latin America and some Caribbean Islands ICANN – Internet Corporation for Assigned www.icann.org & www.internic.net Global non-profit organization that oversees Names and Numbers distribution of IP addresses to RIRs In general, these databases contain details of the networks that are using address space, not the individual users. There are two major types of whois databases. One type contains records on domain names and the other contains IP address (the numerical sequence that serves as an identifier for an Internet server) records .These are IP address databases.