December 2007 Archives

Everybody's favorite piece of malware, Storm Worm, is back again. Since Storm made its debut in 2006, its developers have used a variety of tactics to lure recipients to download sites where they can infect their machines, beginning with fake news articles about storms in Europe (hence the name) and moving on through fake greetings cards, and pitches for imaginary games or MP3 download sites. Along the way, there have been several 'topical' or 'seasonal' variants that refer to particular events or holidays.

For Christmas this year, Storm has been offering a variety of Christmas-themed messages pointing to download sites with names like 'merrychristmasdude.com' and 'uhavepostcard.com'. Now that Christmas is past, it has switched to New Year greetings, pointing to 'newyearcards2008.com', 'happycards2008.com' and so on.

The prevailing opinion seems to be that the threat posed by Storm is diminishing, but its operators seem determined to show that there's life in the old worm yet. It's worth remembering that each time you get a fake New Year greeting from Storm, that probably represents a compromised machine running Storm.

Bizarre spammer disclaimers are making a comeback. Here's one that appeared on a spam from an Indian web design company touting for business:

Disclaimer: This is an unsolicited Business-to-Business correspondence. If you are not interested in this matter, you may delete this message without reading it. Please note that we have not purchased your e-mail address from any commercial sources. We have accessed it through primary research on the internet. In case you prefer not to receive any future business communication from us, kindly reply to this email with the subject `REMOVE' in the subject line.

I like the gracious way they authorize the recipient to delete the message without reading it. That's very generous. Unfortunately, they don't explain how you're supposed to delete the message without reading it when the disclaimer is attached to the bottom of said message. Oh, those wacky spammers and their paradoxes. I'm also glad to know that they haven't purchased my email address (“In which case, you're the only one that hasn't, buddy.”) but have obtained it through ‘primary research’. Apparently, I'm supposed to feel better that their spider crawled my site.

... doth protest too much.

Here's the disclaimer from a recent piece of Brazilian spam:

This message is not a spam, given that it's only being sent once, and also it contains a way to be removed, it's a normal email like so many others that you receive, we're not invading your privacy and sending an email isn't a crime, since it doesn't contain messages that can cause harm to the user. If you want your address to be removed from our list, it's enough to send a mail to ... with the title (subject) 'remove', for your email to be removed permanently from our list. Please excuse us if we've bothered you with our advertising e-mail. Thanks!

The logical flaw (aside from the fact that it most definitely is a spam) is that if they were really only going to send the message once, there'd be no need for anyone to remove themselves from the sender's list: clearly, they plan to send more in future.

I was a little disturbed by how easily I could read the disclaimer: apparently a steady stream of Brazilian spam has given me a good grasp of written Portuguese. I guess it's not a bad thing, but next time I think I'll just buy the book and tapes, thank you.

(And yes, I know that the title of the post is a misquotation — but it fit better than the correct version.)

While I'm not one to underestimate the threat posed by spam, there are some possible risks that I can't get too excited about. Take, for example, this article from nanotechnology newsletter Azonano which suggests that — when we all have functional nano-assemblers hooked up to our computers — spammers may somehow find a way to cause them to materialize 3D objects on your desktop. Apparently, as soon as domestic nano-factories become as common as refrigerators, those pesky spammers will start popping up miniature statuettes of porn stars (“I have no idea where that thing came from, honey, I swear.”), spy-bots or even bombs (or viruses, as in New Rose Hotel) in our homes and offices.

This is a pretty dystopian vision of the future. I think I could handle the Rolex spammers creating replica watches all over my house, but I'm really not eager to see what the penis enlargement spammers will do with the technology. However, before you all run to bury yourselves in a disused missile silo in Iowa, I should just point out that the capabilities hinted at in the article don't exist and that by the time they do, we might just have figured out a way to keep spam out of our mailboxes. There's also the question of attachment size: I'm willing to bet that the recipe to make a functional spy-bot or even a saucy miniature of Jenna Jameson would require a fair number of bytes to describe. Unless we see some correspondingly impressive advances in communications technology, nano-spams will take so long to download that the spammer will have given up and found honest work before his sales pitch gets delivered.