Watch out for a special present included with your e-mail Christmas greetings. A mass-mailing worm, W32/Zafi.d@MM or Zafi.d, is making the rounds of e-mail users and is transmitted in the form of a Christmas greeting card with the subject line of either “Merry Christmas” or “Happy Holidays.” The e-mail message will appear to come from one of your acquaintances.

The messages of good cheer come in 15 different languages and the language is selected, based on the recipient’s -mail address. The worm modifies the system registry of Microsoft Windows computers, automatically self-executing when the computer is rebooted. Zafi will also seek out antivirus and firewall applications, overwriting those programs. The nefarious action of the worm is to open a backdoor on the PC, allowing the system to be turned into a zombie, remotely controlled to send more spam or participate in a distributed denial of service attack on selected websites.

Dave’s Comments
I’ve got as much holiday good cheer as the next person, but e-mailed greeting cards rub me the wrong way, especially at this time of the year. I think that holiday cards should be hand signed and either postal mailed or hand delivered. Take the time to show how much you care for your friends and loved ones, write them a card. Oh, and as for this worm; you know the drill: don’t open any file attachment that you didn’t expect, no matter from whom it comes.

Call for Comments
What do you think? Leave your comments below.

Bought Any Illegal Software From A Spammer, Lately?
The offer advertised in that e-mail message is awfully tempting. Microsoft Windows XP Professional for only $39? The entire Microsoft Office Professional suite for less than a few sawbucks? It’s real software, isn’t it? Well it sure is, and it’s a lot more, too.

Spammers stay in business because we’re buying their wares, and pirated software applications are one of the most popular products to be sold through spam advertising. Spam, unsolicited commercial e-mail, is not just a nuisance, but in the United States, usually illegal. Both spam and software piracy are big business: why not meld the two?

Dave’s Opinion
Here’s why you should never buy anything, especially software, from a spammer: you’re dealing with person of questionable, if not downright malformed, ethics. If the person is breaking the law (or at least the local common mores) by sending you spam, it’s not much of a stretch to think that the below-market price software he’s hawking may also be either stolen or illegally duplicated. Do you want to participate in the breaking of both national and international copyright laws by installing pirated software?

Moreover, that bonus software included with your order may just be a Trojan that turns your PC into a zombie for the spammer’s use in sending out even more spam … now you’ve become not only a pirate, but a spammer, too. Nice work.

Call for Comments
What do you think? Leave your comments below.

The United States Federal Trade Commission (FTC) announced, in a public report, that a system of monetary rewards would help improve the enforcement of the Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2002 (CAN-SPAM Act.) That Act, which became effective on January 1, 2004, required the FTC to conduct a study and provide a report to Congress on a CAN-SPAM “bounty system.” While the fact that bounties may be offered to those who help authorities in nabbing spammers doesn’t unusual, what is very much out of the ordinary is the projected bounty amounts necessary to make them effective.

The FTC reports three hurdles exist in enforcing the CAN-SPAM Act: 1) identifying and locating the spammer, 2) developing sufficient evidence to prove the spammer is legally responsible for sending the spam, and 3) obtaining the source of funding for the bounties. The report states that those with the information most helpful to authorities are whistleblowers and insiders: those who have had personal or business contact with the spammers, themselves. Because of the real possibility of retaliation, the monetary awards encourage the whistleblowers to come forward. The FTC thinks that awards of about $100,000, upward to $250,000, are reasonable, with funding for the bounty program to come from federal taxes.

Dave’s Opinion
I wish I knew a spammer; for a quarter of a million, I could by RV my kids are clamoring for and go on the road for a few months. Why do we need an incentive to do the right thing. Turning in details of bona fide spammers is just a good thing to do. Why should we expect to be bribed by the government?

Call for Comments
What do you think? Leave your comments on the message center.

References
FTC Report
Message Center

Two LA spammers were ordered to pay $2 million and received various business restrictions in Santa Clara County Superior Court, this past Friday. This is the largest judgment won by government prosecutors against senders of unsolicited e-mail. The spammers are also the object of a Federal Trade Commission suit; however, both legal cases are civil suits, so there’s not much chance that the spammers will see the inside of a jail cell anytime soon.

Since 1999, almost three-quarters of states have passed anti-spam laws, but prosecutors have brought only a handful of lawsuits; success in the legal system often requires integrating case law (past judgments), and until more criminal suits are won this catch-22 will continue. Rather than pursue criminal penalties, ISPs and frustrated individuals have been using the courts by filing suit using various laws such as consumer fraud and trespass.

Dave’s Opinion
The U.S. Senate unanimously approved an anti-spam bill this past Wednesday: the first federal legislation to tackle spam. The Sentate bill requires bulk e-mailers to indicate a valid return address, disclose that the content is advertising, and give consumers valid and working opt-out mechanisms. In addition, the bill bans the use of addresses obtained from automated mechanisms, such as web-crawling and e-mail harvesting.

Senate bill S.877, CAN-SPAM Act of 2003, also directs the FTC (Federal Trade Commission) to come up with a plan for a do-not-spam registry, similar to the do-not-call telemarketing registry.

The U.S. House of Representatives is considering competing anti-spam legislation, and may have a more difficult time reaching agreement; however, I’m holding out hope for a valid and reliable do-not-spam registry by 2005.

Call for Comments
What do you think? Leave your comments below.

References
S.877 CAN-SPAM Act of 2003

The craziest thing that I’ve ever heard is to pay spammers not to spam, and that’s just what a startup company from San Antonio, Texas, Global Removal (GR), is planning to do. Their theory is that spammers are in business to make money, and that the lowbrows will remove your e-mail address from all of their junk mail lists for a buck.

In addition, subscribers (you and me) are required to pay a fin to be part of this crazy scam.

Dave’s Opinion
My B.S. radar is way overloaded after reading about GR’s plan to pay spammers one dollar for each e-mail address that subscribes to GR’s program (after being spammed in an effort to garner subscribers). Yes, you read that right.

Here’s the scoop as I read it from Global Removal’s website:

1. spammers seek to get people to subscribe to Global Removal’s “do not spam list” by sending the invitation as a spam message.
2. spammers are paid $1.00 for each address that subscribes to the “do not spam list.”
3. uninformed users give Global Removal their e-mail address and $5.00 to be added to the list.
4. spammers are to purge their list of all subscribers.

Am I the only one who sees a problem here?

I’ve got to start giving spammers more credit. They’re smarter than I thought.

Call for Comments
What do you think? Leave your comments on the message center.

References
Global Removal
Message Center