Proposal: This House Will Legalize Spam

I sent this today to the newly formed debate mailing list. While this is not necessarily my opinion, I am picking a side and running with it.

In other words, the opinions presented in this debate are not necessarily my own. People will either support this proposition, or tear it apart.

---

Proposal: This House Will Legalize Spam

Spam is a service answering a demand. Making the product legal will will inject our suffering economy with much needed currency and allow our government to tax this billions of dollars industry.

We have seen this happening with alcohol during the prohibition. Alcohol is no longer illegal, and great benefits resulted from that decision with a booming world-wide industry and disappearance of the black market economy.

Spam is a black market economy. Medicine is sold for high prices in the US, so black market spam operations answered the demand and sell drugs from Canada for a lower price. Many of these are fake and result in poor care in the best of scenarios.

Economically, the pharmaceutical industry is suffering and the government is losing potential taxation revenue. More importantly, if spam was regulated controls could be put in place to protect public health.

We have been waging a "war on spam" for two decades now with no victory in sight. More than that, the email system is under continued threat of no longer being usable.

Similar misuses have been addressed by legalization in the past. This includes post spam and fax spam, which today have clear regulation.

Most of the email traffic on the Internet today is spam, resulting in:

1. Increased operational costs for networks and service providers.

2. Clogged mail boxes, user annoyance and legitimate email being lost, resulting in loss of productivity.

3. A support infrastructure for other criminal activity ranging from phishing to child pornography.

Our respected opposition may claim that legalizing spam will open the door for other sorts of legalization. We believe this claim is a logical fallacy, falsely claiming a slippery slope to muddy the waters.

We believe that taking this route on spam is positive, other directions with other "products" should be considered on their own merit. It is a fact that the end of prohibition did not result in legalization of drug usage.

In support of my case I bring before you a case study (below), written by me two years ago for a zdnet blog. I demonstrate how an unrelated legalization caused a large percentage of spam to stop and spam operations to collapse, when the demand ceased.

Gadi Evron,
ge@linuxbox.org.

---

Taking down spammers: Successful spam fighting via legalization, regulation and economics

Original URL:
http://blogs.zdnet.com/security/?p=720

By Gadi Evron

Working in the Israeli city of Netanya, next door to our offices was a spam operation with roughly 30 employees. One day they weren’t there anymore.

They were blog comment spammers, but officially were doing Search Engine Optimization or SEO. Instead of optimizing content, they posted illicit comments on many blogs with commercial or misleading messages leading to their clients’ web sites, mainly for the purpose of increasing their clients’ web sites visibility in search engines such as Google. They would do this using an illegal tool such as botnets, and make quite a bit of money.

The reason for their disappearance soon became clear; nearly all their clients were gone. A law was passed in the United States which addressed online gambling operations (”Unlawful Internet Gambling Enforcement Act” - UIGEA). As a result, the public gaming industry ceased accepting online wagers. More than that, UIGEA addressed processing payments to and from Internet gambling sites. In a day, most of US-based gambling web sites ceased to exist (others moved over-seas, although quite a bit of the world’s credit processing is done by US firms). This effectively caused
the death of numerous black hat SEO companies–comment spammers. Perhaps the UIGEA measure against processing of payments proved too difficult to overcome. Not being a lawyer I can’t say exactly how UIGEA caused this death. No matter, US online gambling operations were effectively destroyed.

Spam decreased. The underlying cause for that was that the clients weren’t there due to the inability to process payments because of the online Casinos law.

....
More...

Follow me on twitter! http://twitter.com/gadievron

Debate and general discussion mailing list, with good arguers

Hi all,

Do you want to participate in a debate and general discussion mailing list which will have members who are good and intelligent arguers?

Please contact me if you do.

Gadi Evron,
ge@linuxbox.org.

Follow me on twitter! http://twitter.com/gadievron

Reimage named "Cool Vendor" by Gartner. They are COOL

My friend Zak Dechovich started a startup named Reimage and I am very exited because Reimage was just named by Gartner as a "cool vendor".

While I was a disbeliever at the very beginning, I saw the light. I am VERY excited Reimage does. They are COOL.

The original idea behind the company was to help US, the computer savvy folk who have to fix our family's computers all the time, by creating easy to use software that does it for us.

While it originally was unintentional, they remove a lot of malware while they are at it. Making it a very useful security product to boot.

Reimage's web site:
http://www.reimage.com/

Gadi Evron,
ge@linuxbox.org.

Follow me on twitter! http://twitter.com/gadievron

Fascinating Omegle Chat Logs

I have been chatting on Omegle all night, and some of the chats are absolutely fascinating. I don't want to flood this blog like I do my fun one. I will summarize here with links.

So far, I spoke with a dirt-road worker from Australia and a 15 years old sophomore girl tennis player from Maryland (trying to explain without sounding parent-yy about not sharing private information on the net).

I have been sharing these logs with a group of social scientists in an email thread. This is so intriguing.

The more interesting chat logs:

1. NSFW, very funny log where you see how anonymity lets people let loose.

2. A guy (apprently) coming out of the closet on Omegle.

3. Seeing social responsibility as base for good and evil
You may find this one boring, but I found it absolutely fascinating seeing how a person views the world in a way I find fscked up.

The person's social identity is what builds her (my guess) view of good and evil. I am thinking 17 years old.

Gadi Evron,
ge@linuxbox.org.

Follow me on twitter! http://twitter.com/gadievron

Omegle: An Impressive "Web 2.0" Chat Service

[syndicated from my "not professional" blog: http://gevron.livejournal.com/15256.html]

Are you interesting enough at first impression? Do you introduce yourself well? On Omegle if you don't you're disconnected.

Reading the funsec mailing list discussion about twitter, David Chess referred to a new web site called Omegle. Dave wrote about it here.

Omegle allows you to start real-time chats with random anonymous people who can disconnect you at any time. Fascinating stuff.

My friend Imri Goldberg checked it out and convinced me I should look as well. On funsec he said:

---

My impressions:
1. Technically, it works really well.
2. What it is: web-based chat with random strangers.
3. Reminds me of my early days on IRC. You meet new people that are guaranteed to be at least somewhat interested in talking.
4. There is full anonymity, in the sense that you don't have a consistent identity that's kept from one conversation to another.*
5. There is no cost to disconnecting, if you don't like the conversation.
6. It's very much like speed-IRC, as in "speed dating" as opposed to regular dating.
7. Since you get a very specific IRC-like experience (meeting new people you'll never meet again anonymously), you can practice like Socrates did on the beach (Imri corrected this to Demosthenes: http://itotd.com/articles/319/demosthenes-stones/). You have only a few minutes and a few sentences to convince someone you're interesting, or they just disconnect, and you both move on.
8. You still have a lot of the IRC-like stuff, as in being asked "a/s/l" and so on. [age/sex/location]
9. I wondered how secure it is, who is logging the conversations/ip addresses involved etc.

All in all, a cute service. Also nice to know it was written by an 18-year old that's just finishing high-school, and as I said, it works well.

Cheers,
Imri.

* I was reminded of a very good discussion of online identities here: http://www.juliandibbell.com/texts/bungle.html. Old, but thought-provoking read. The relevant quote from that text is:

"Inside the MOO, however, such thinking marked a person as one of two basically subcompetent types. The first was the newbie, in which case the confusion was understandable, since there were few MOOers who had not, upon their first visits as anonymous "guest" characters, mistaken the place for a vast playpen in which they might act out their wildest fantasies without fear of censure. Only with time and the acquisition of a fixed character do players tend to make the critical passage from anonymity to pseudonymity, developing the concern for their character's reputation that marks the attainment of virtual adulthood."

---

My take on it is similar, I was very excited:

Omegle has a simple interface. No complex functionality at all. You can chat, and you can disconnect. You are anonymous unless you choose to tell the other person who you are.

I just finished my first chat there, and it was fun. It seems like a waste to me to be able to chat with people and yet not necessarily keep in touch, but the experience with the types of people you meet makes all the difference.

Unlike Imri, I was not reminded of Demosthenes meeting random people on the beach, but rather of the old classic movie adaptation for the novel Logan's Run where random people who match you exactly are transported to you so you can have non-committal sexual relations. Only in Omegle's case, not sexual.
This won't turn into a dating service (I'll probably be proven wrong).

The experience felt like a shot in the dark. You find someone random, defying the whole idea of the Internet where interest groups on every subject meet each other and become a marketing force based on that affiliation.

More interesting, this service as Imri mentioned with the Demosthenes story, raises the subject of how one introduces oneself to be interesting. Also, it allows us to talk to people without any prior knowledge or prejudice on who they are, which normally affects our social engine--how we treat other people and get treated.

The story of Omegle once again shows us that the cost of developing on computers is small to non-existent. If an 18 years old guy can create this, anyone can learn how to.

Update:
Chat bot for Omegle:
http://robotstranger.com

Gadi Evron,
ge@linuxbox.org.

Follow me on twitter! http://twitter.com/gadievron

Obama and Afghanistan: "Predict Success and You May Fail. Predict Failure and You Will Fail"

[syndicated from my non-security blog: http://gevron.livejournal.com/]

I read an article this week which made me think. It took a generic phrase for success right out of a business self-help book, and covertly showed how it applies to current events with specific examples from politics and international relations. Tying it together at the end to show President Barack Obama where the author believes he went wrong. While the phrase was not specifically mentioned I was inspired and impressed. I am not sure this was intentional, but non-the-less "ME like".

In this post I will examine both what the article said (part which inspired me, anyway) and why I usually tend to disrespect others who say the same thing. If you want to read just about Barack Obama, skip to the right section below. Hint: it's the same as the title of this post.

It was in the last Economist (March 26th, 2009). There was a section examining President Obama's progress during his two months in office. I can't find the precise link online at the moment (I will look for it), but these were the two main articles.

"Just Think Positive"
When someone spits out a buzz sentence for instant success as a Tao of living one's life, I get suspicious. Most of the time these would be people who learned to believe in these buzzwords and take them to be The Tao of Life. Copy-cats who went to some workshop for three days and believe they discovered the answer to life's mysteries, religiously. They didn't learn how to think, only how to default to a "safe" programming routine which shows them what they should do, and where they went wrong.

No matter the circumstance (particular incidents or events which may be special cases) and never mind perspective (truth changes depending on point of view). It's all The Truth. Replacing one religion for another.

Useful, and pathetic. Yes, at the same time.

"Always Look Forward. Never Look Back"
You know the type. This is not to diss on all "workshops" or self-help courses and books, only on the Fad of The Month ones, and the people who get reprogrammed there.

I first encountered the phrase "Fad of The Month" when I purchased The Thin Book of Appreciative Inquiry (very thin at 63 pages. Packaging cost me more than the book, and of course Amazon put it in a new box before mailing).

In it the author mentioned that when the developer of this organizational development and change method (I believe David Cooperrider of Case Western Reserve University) was asked why he didn't write any popular article or book on the subject, he replied he didn't want it to become yet another Fad of The Month (my addition: think most self-help books and workshops).

Always Keep Trying
Question these folks who believe this is their truth and they will retort with the same buzzwords, in a circular logic. They may also blame you for being unenlightened (or an a-hole).

Try and accept their premise to be able to hold a discussion, trying to show them how always thinking positive is OKAY, but doesn't apply to this specific case, and you get more of the same. Logic escapes them. Strike that, thinking escapes them.

"Predict Success and You May Fail. Predict Failure and You Will Fail"
Barack Obama is starting to waver on Afghanistan. He was referred to as saying that the war may not be winnable. Through-out his campaign he mentioned how Afghanistan was a Just War (Casus Belli) and a Must War, as that's where the enemy is. To illustrate why this is important, Iraq he treats as a war of Choice.
Disclaimer: All of the above is my understanding of what he said, in my own words.

It is true that NATO and the United States are not winning in Afghanistan. It is also true the strategy employed there does not seem to be working, and that while said strategy is currently under review, [apparently] no one has any idea how to win it.

While the above can be acknowledges, saying it is not winnable is far from advisable:

1. If you don't want to get out, don't show signs of weakness to an enemy that watches for them with the strategy of "out-live the West's (or the American's) will to fight.
2. If you want to get out, don't tip your hand.

Further, as President Obama is currently looking for support to conduct war in Afghanistan, at his own party, in both houses (especially Congress?) and in Europe, displaying such a poor outward appearance is appalling.

Beyond not showing leadership, it shows those you want to commit to your cause with soldiers who may die fighting for it, that you don't really believe in it, or that they may get stranded without you.

Appearances aside, what's missing is called Resolve, and it is called Leadership.

Showing this example of diplomacy and international relations and tying it with the quoted phrase
"Predict Success and You May Fail. Predict Failure and You Will Fail", makes it one of the most inspiring articles I read this year. I wish that the Economist mentioned author names so I could email with thanks.

Any entrepreneur and business major, MBA and CEO, should read the articles in this section.

Gadi Evron,
ge@linuxbox.org.

Follow me on twitter! http://twitter.com/gadievron

GhostNet and computer spying on Tibet. It's just Spear Phishing.

Gary Warner covers the recent GhostNet story, where the New York Times told of academic research, uncovering a computer spy network using Trojan horses to spy on Tibet and the Dalai Lama, with fingers pointed at China.

While interesting as a case study and the researchers did good work... It's not new, it's really just old news called Spear Phishing. Using a "technology" called RAT.

You can read more about what Gary has to say here:
http://garwarner.blogspot.com/2009/03/ghostnet-or-gh0st-rat-cyber-persecution.html

Gadi Evron,
ge@linuxbox.org.

Follow me on twitter! http://twitter.com/gadievron

Wireless service "steals" and proxies emails

Wireless (swisscom) at hotel steals my email messages and relays through a proxy rather than my MTA! WTF!!

Even "experts" can be fooled.

I automatically clicked "YES" on accepting the SSL certificate, I'm ashamed!

I know it is self-signed and therefore gives an error (I installed a new mail client).
Regardless of it being the first time, I would have liked the violations (self-signed and unknown) to be written in red, on separate lines. Make it a bit more user friendly so that at least folks who care about security are not tempted to act as lusers and click "yesyesyes".

No wonder a friend bounced my emails, they were being relayed from a non-authoritative MTA for linuxbox.org.

: host mx01.speakeasy.net[69.17.117.60] said: 554 5.7.1
: Client host rejected:
Access denied (in reply to RCPT TO command)

linuxbox's log file:

Mar 25 ... linuxbox ...
A53E6.2070502@linuxbox.org>, proto=ESMTP, daemon=MTA, relay=mail-out-01.swisscom-eurospot.com [83.97.120.90]

WTF?!

Worse still, this is the first time in ages I use a GUI client, so my mistake was installing it for the first time on a wireless hotel network.

Well, we learn.

Update:
These are called "transparent proxies" and apparently "everyone" does that. It helps, among other things, control outgoing spam from users.

One suggestion was to use submission on port 587 with STARTTLS

Update #2:
So I didn't click "yesyesyes" after all, I configured it wrong.
In Thunderbird I needed to set up encryption for SMTP regardless of what I set for the account. I was set to "tls, if available" so I was never alerted.

Gadi Evron,
ge@linuxbox.org.

Follow me on twitter! http://twitter.com/gadievron

Phishing attacks against ISPs (also with Google translations)

In this email message I'd like to discuss two subjects:
a. Phishing against ISPs.
b. Phishing in different languages against ISPs as soon as Google adds a new translation module.

[My apologies to those who receive this email more than once.]

In the past few weeks there has been an increasing number of phishing attacks against clients of Israeli ISPs. I've only seen a few of these, but the local ISPs confirm it's happening across the board.

In all these cases, the phishing email is in Hebrew.

While we have seen ISP phishing and Hebrew phishing before, these attacks started when Google added translation into Hebrew.

Is this a trend? Have other countries (or populations) been targeted when Google added a translation module for more languages?

Notes:
a. Some Israeli ISPs emailed their clients warning against such attacks. Saying they'd never ask for their password, etc.

b. While I was certainly heavily involved with phishing originally and even started the first coordination group to deal with the issue, I am somewhat removed from it now, dealing more with phishing/banking Trojan horses.
Can anyone educate me as to how often ISPs get phished, if at all?

c. If you get phished, what strategies if any have you taken to prevent the attacks/respond to them/educate your clients? What worked?

d. I wonder if these translation misuses could eventually translate into some intelligence we will see in Google security reports, such as on malware.

Gadi Evron,
ge@linuxbox.org.

Follow me on twitter! http://twitter.com/gadievron

My Blog on Dark Reading

I recently started blogging for Dark Reading, I will still be blogging here, but what I write there is for Dark Reading alone.

I noticed that because I didn't write for a while, my writing became rather poor (in my taste). I constantly move between between official and personal language, and find it more difficult to write short, and to the point. But I'm getting there.

So far I posted two blogs:
German Intelligence Caught Red-Handed In Computer Spying, Analysis

According to German Web site Der Spiegel, the German foreign intelligence agency BND has supposedly been spying on computer systems around the world in the past couple of years.

Everyone does it. Why not governments?

Authoritatively, Who Was Behind The Estonian Attacks?

In the past couple of weeks the press has been humoring a couple of rumors about who was behind the 2007 cyberattacks against Estonia [PDF]. During these attacks, Estonia's infrastructure, which relies heavily on the Internet, nearly collapsed.

This is not the first time such baseless attributions were made.

I was in Estonia when the attacks occurred. I wrote the post-mortem analysis and recommendations for the Estonian CERT, and I am going to authoritatively show you why these claims are baseless. I will list these accusations and responsibility claims, and show you why they should be ridiculed.

Gadi Evron,
ge@linuxbox.org.

Follow me on twitter! http://twitter.com/gadievron

Parliamentary debate at an Anime convention

Today I came across an event announcement for Anime-expo, which was:
A debate tournament. At an Anime con! :)

I considered implementing something similar myself for defcon (THE security and hacking conference).

I've just shared this with about 500 other con organizers in the scifi and Anime realms, so I think things are about to become interesting.

Finding it, I had to share, it's a grand idea!
http://forums.anime-expo.org/index.php?showtopic=8744

You will be hearing more from me on this. Perhaps a plan on how to combine a British Parliamentary Debate with a fan convention is an article I need to write?

Gadi Evron,
ge@linuxbox.org.

Follow me on twitter! http://twitter.com/gadievron

Deceptive use of language in conference advertisement [and on the difference between communication and manipulation]

[This was originally written for a community of science fiction con runners, which is why it has that clear theme. I altered it to fit the subject I ended up with.]

I just came across a blog post (linked at the bottom of my post), where the author discusses an email he received, advertising a conference in a deceptively persuasive fashion.

While I use the "scarcity" "trick" myself, I make sure and use it only when seats really are running out, and once at the beginning--Alerting people to how many seats we have as they all already know we will run out very quickly.

That of course refers to another "trick" the author mentions--social proof. Looking back at my "spam" emails I don't abuse it beyond the mentioning the seats available, in any advertisement. But I do make use of it, I know people who go to the con enjoy themselves, and discuss it amongst themselves and with their peers. I enjoy the back-lash email bombardment of "I really wanted to make it" as it helps me help others make it next time.

There is a downside to understanding persuasion. Our knowledge of it.

After being exposed to quite a bit of manipulation, especially in corporate environments and around Washington DC, I became _aware_ (apologies for use of new age terminology) that it "exists". Later on I was disturbed by finding out the same tools in my repertoire (or weapons in my arsenal if you like) I've used in good communication are used in manipulation as well. This made me think quite a bit if others, and myself, are acting in a manipulative fashion.

The difference between communication and manipulation is tricky at best. It is in Intent (of attacker) and Perspective (of victim), and we can add a third category of examination, the X, or Asimov "Mule", factor--Specific incident--which might change our normal understanding in specific odd-ball cases. Both in the decent meaning of influence, in good communication, and in the "evil" one, manipulation, noticing that I, or others, say or do something which answers to one of these possible "tricks" of influence immediately puts it under scrutiny of self-awareness (apologies for new-agey term) if it makes use of any of these "tricks".

Robert Cialdini in his book "Influence: Psychology of Persuasion" takes apart a sub-set of the world of influence and helpfully puts it into clearly defined and named categories by the use of terminology. That, not the text, is the greatest asset of the book.

He often mentions how all these tools of persuasion are really normal tools humans use to avoid over-loading with needless, indeed countless, decisions that spam our daily lives, and to make better decisions to boot (everybody buys an iphone, it *must* be better! it sure is cool, though). Knowing about how these work though, means the con artists, sales people, etc. will use them against us.

But as people who run conventions and conferences, how do we both use, and abuse, these "tricks" of influence? How can we make better use of them, and avoid being deceptive?

Notice yourself using it in your advertisement? Feeling left out as you are not a convention/conference manager? Have any anecdote from your position.. or daily life?

You can view the discussed blog which inspired this post, here:
http://www.changingminds.org/blog/0902blog/090227blog.htm

Gadi Evron,
ge@linuxbox.org.

Follow me on twitter! http://twitter.com/gadievron