I was interested in what the .XLS attachments were in the SpamSentinel quarantine, so I made a view, extracted the contents (minus the XLS extension) and let Google translate show my what these attachments REALLY say. Like some spam subjects, many of these sound like zen inspired quotes. Here are a few of my favorites:
To manage or to leadership
Become Devil coach
Management does not manage tired
Here is the results of my search for virus attachment wisdom:
行政到人力的转变 Administrative changes to human
行政管理师 Administrative division
行政领导还是行政管理 Administrative leadership or administration
行政管理还是管家 Administrative or housekeeper
美国式顾问式销售技巧 American consultative selling skills
中坚力量（互动式） 15个经典案例 Backbone ( Interactive ) 15 Classic Case
行与政谁先谁后 Backwards line with government
成为魔鬼教练 Become Devil coach
行政的攻心术 Chief of Psyche
中国顾问式销售行为 Chinese consultative selling behavior
中国人看顾问式销售 Chinese people look at consultative selling
中国式职业管理阶层 Chinese -style career management
业务员的考核方案 Clerk of the assessment program
教练常用的具体操作方法 Coach common specific methods of operation
客户对产品或服务总是很挑剔 Customers for the product or service is always very picky
销售团队文化方向化 Direction of the sales team culture
劳务派遣实务应对策略 Dispatch Practice Strategies
想轻松就不要做管理 Do not want to easily manage
你是否有管理的潜质 Do you have management potential
干销售不如干团队 Dry sales team as good as dry
放大客户痛苦 Enlarge customer pain
企业微信营销如何策划 Enterprise micro-channel marketing, how to plan
树立品牌在门店落地生根信念 Establish a brand in the stores take root beliefs
工厂行政的喜与悲 Factory administration joy and sorrow
柔性与强势管理 Flexible and strong management
要自由就要远离管理 Freedom is necessary to stay away from management
管理边界的模糊美 Fuzzy US border management
勤奋做事，简单做人 Hard work, simple life
帮助客户成长 Help customers grow
行政绩效如何体现 How to administrative performance reflects
如何有效处理违纪违规员工 How to effectively deal with disciplinary violations Staff
如何有效调岗调薪 How to effectively transfer Kong salary
主管如何能让销售团队业绩提升 How to make sales executives to improve team performance
为人失败，是中层最大的失败 Human failure , is the biggest failure of the middle
工业品销售 Industrial Sales
企业微信营销系统的整合打造 Integration of enterprise micro-channel marketing system to build
中间力量还是中坚力量 Intermediate strength or backbone
网络营销实战专家 Internet marketing expert
找关键拍板人 Key people find finalized
知晓微信营销运营 Known micro-channel marketing operations
门店领导与管理的方法 Leadership and management approach stores
领导力最怕四不像 Leadership fear nothing on earth
领导力也不难 Leadership is not difficult
让你难以置信好的营销模式 Let your incredibly good marketing model
营销代表的薪酬杠杆 Leverage Marketing Representative salary
提起销售团队就头痛 Lift the sales team headache
长用者多批评，短用者多表扬 Long used by more than criticism , short- users more recognition
管理其实与ｄｎａ有关系 Management actually has a relationship with dna
管理不累就不是管理 Management does not manage tired
管理很郁闷就没有合格 Management is very depressed there is no qualified
店长的苦恼 Manager of distress
群众领袖、小国之君 Mass leaders, the king of a small country
微营销策划 Micro- marketing plan
微网络大市场 Micro Network big market
微信营销接口及拓展应用介绍 Micro-channel marketing and expand the application interface to introduce
企业做微信营销应避免的误区 Micro-channel marketing companies do to Avoid Mistakes
中小企业的微信营销 Micro-channel marketing for SMEs
微信营销几何式增长 Micro-channel marketing geometric growth
微信营销研究 Micro-channel marketing research
微信营销致胜诀窍 Micro-channel marketing success tips
微信营销落地搭建团队 Micro-channel marketing team to build landing
微信营销从入门到实战 Micro-channel marketing, from entry level to combat
微信营销完善系统 Micro-channel marketing, improve the system
中层管理其实是个传话筒 Middle management is actually a mouthpiece
中层管理其实就是来受气的 Middle management is actually to be bullied
中层管理就是上了贼船 Middle management is Shangliaozeichuan
中层管理有领导力吗 Middle management leadership you have
中层管理其实做的是基层的事情 Middle managers actually doing the grassroots thing
中层不自觉干的事情 Middle unconsciously doing things
中层最不愿意干的事情 Most reluctant to do things the middle
没有冲突就没有改善 No conflict is not improved
不背黑锅就不是中层 Not a scapegoat is not the middle
中间还是中坚还是中艰 Or in the middle of the storm or backbone
业绩目标互为驱动 Performance targets mutually drive
销售主管的定位 Positioning sales director
服务性产品销售 Product sales service
快速提升门店执行力 Quickly improve store execution
明确店长的角色定位 Role clear manager
销售服务 Sales and Service
销售事业 Sales Division
销售主管如何管理销售团队、如何选人、育人、留人 Sales executives how to manage the sales team , how to choose people, educating people, keep people
销售人员成长过程引导与管控技巧 Sales growth process guidance and control techniques
销售内勤销售设置 Sales Inside Sales Set
销售人生 Sales of life
销售员关键绩效指标评估设置 Salesperson set of key performance indicators to assess
销售是传递价格还是价值 Selling price or value is passed
中高层管理近亲繁殖的流弊 Senior inbreeding abuse
门店超级卖手的七大特质 Seven super stores selling hand qualities
小企业靠管理，大企业靠规则 Small businesses rely on management , large enterprises rely on rules
小订单靠个人，大订单靠团队 Small orders by individuals, teams rely on large orders
专项培训系统 Special training system
初创阶段销售团队现状分析 Status infancy sales analysis team
门店四类顾客的特征 Store features four customers
持续拉动门店销量 Store sales continued to pull
门店领头羊的四好角色 Stores four good leader role
门店最有效的培训方法 Stores the most effective training methods
门店是这样盈利的 Such stores are profitable
量身定制的级差薪酬 Tailored differential salaries
团队管控要有系统思维 Team management and control systems should be thinking
技术买家 Technical Buyer
中层管理欧亚有分别吗 There were middle managers do Eurasia
要管理还是要领导 To manage or to leadership
了解决策过程 Understand the decision-making process
销售团队为什么不好管 Why bad management sales team
客户为什么认为你在骚扰他 Why do customers think you are harassing him
为什么单子有希望最终却输给了 Why list eventually lost hope
狼性门店团队 Wolf store team
Tuesday, January 7, 2014
Thursday, June 23, 2011
50+ 5 Star Reviews of SpamSentinel on the NotesAppStore
SpamSentinel has now passed the 50 reviews mark on the
NotesAppStore now. I am happy to say that they are all 5 star reviews, like the few most recent ones, below. These 5 star reviews are a confirmation of our company approach towards software: Great Software and Great Support. I say it all the time to our staff: "Customers only care about two things from a software company. Great software and great support.
When people are making a software buying decision, they want to know if, when there is a problem, they will be able to find support. Saving a few dollars on a solution is a bad decision if it interrupts mail flow. Email is still the #1 corporate application, and we take its importance very seriously. Which is why, when we get a phone call from a customer, we handle it as if our own mail was affected.
We are not done making the software better, nor are we done improving support. These are "continuous improvement" areas which means we work on them each and every day.
Monday, February 7, 2011
Lotusphere 2011: Find us on the NotesAppStore!
I spent some time walking around the Product Showcase floor meeting as many NotesAppStore vendors as I could without taking them away from customers.
It was a lot of fun, and I created a video of as many of them as I could in the three days, Monday through Wednesday. In fact, I got so involved with everyone else, I forgot to film my own SpamSentinel booth, so I added it at the end.
Here are 23 (+1) vendors telling the world, in English, Danish, German and Italian to "Find us on the Notes App Store!"
It was a lot of fun, and I created a video of as many of them as I could in the three days, Monday through Wednesday. In fact, I got so involved with everyone else, I forgot to film my own SpamSentinel booth, so I added it at the end.
Here are 23 (+1) vendors telling the world, in English, Danish, German and Italian to "Find us on the Notes App Store!"
Monday, June 28, 2010
Searching the NotesAppStore
Thanks to Peter Smith at IONET software, we have improved and launched new site search for the NotesAppStore.
Peter graciously agreed to donate his FT Search software to the site to make the search experience much better, in terms of speed and utility.
To search the site, all you need to do is click Search
Potential customers also get a great place to see a live application in use right on the NotesAppStore itself!
It is a great search tool, and thanks also to Peter for spending the time to configure it for the site!
Thursday, May 27, 2010
Lotus Notes has an App Store!
The point of NotesAppStore is to show that there is a vibrant community building customer-tested apps for Lotus Notes. Anyone looking at Google apps can find many comparable apps in Lotus Notes. However, the Lotus Notes apps are more mature and have been field tested, some for many years. The variety and functionality of these apps also is unrivaled by anything Google offers to businesses.
The other huge distinction is vendor support. Most of the vendors in the NotesAppStore are small to midsize businesses (SMB) who are available to help install and support their Apps. They will answer the phone. This excellent app support will be critical when there is a problem. And they have references to prove it!
NotesAppStore Site Features
Under the Company Listing, I put all the Twitter name and company blogs that I could find, along with a link to the management page of each website. Again, most of these Lotus Notes App vendors are approachable leaders of small to midsize businesses who are quite visible in the Lotus community.
You can also Search for anything on the site.
There is also a place to Recommend an App and another place to Post a Comment to help make the site more useful.
So, Lotus Notes and Domino users, finally we can say "There is an App for that" !
Monday, May 11, 2009
Reseller in Paris
Sometimes this is a tough job. Here is Allison Cote meeing Jean-Pierre Venancio at Fouquet's Restaurant on the Champs-Elysees in Paris.
For the record, Jean-Pierre's company, Activweb.fr after an excellent cafe at Fouquet's, decided to be our Hosted SpamSentinel partner in France.
Monday, February 2, 2009
Nobody's Perfect (not even Google)
In a rolling perfect storm of errors, in one day Google marked all websites as bad
and, in conjunction with that marked all mail as spam.
Being in the business, I feel for them, as it was a regular update gone awry that caused the problem. I am sure no one in that group slept over the weekend. I think we don't realize how good all this spam and Malware blocking is. The state of the art has gotten so good that we all take it for granted. I certainly do. When the defenses come down, the continuous barrage of junk becomes apparent to us (to our dismay).
In my own moment of insanity, I tried shutting down our own internal spam filters for one day only, to experience the pain. Unfortunately, I quickly shut the experiment down after only one hour when I discovered that no one at Maysoft.com was particularly fond of feeling the pain or receiving all of their spam. Where is their sense of adventure?
11:00 AM and we're off...the "World Without Spam Filters" test begins
11:21 AM
21 minutes into the test, my Lotus Notes Inbox is being flooded. Here is a snapshot:
11:38 AM
Blackberry users are complaining about the spam. Allison Cote wants to know what is happening. She had to leave her Blackberry and delete a bunch of messages from her Inbox. My test is distracting her, and others, from their work.
11:42 AM
I am checking mail1.box and mail2.box. There are 3,341 messages in one, and about the same number in the other. The router is going crazy trying to send some of these back to the senders as delivery failure reports. Aaaargh... this is worse than I thought.
11:46 AM I have to stop this test early. The amount of pain everywhere is too much. I am turning on the SMTP mail filter now as the only prudent course of action.
(Read about the full text at A World Without Spam Filters)
Google did for the entire world what I could only do for people internally: Re-awaken them to the value and necessity of a good spam filter.
Tuesday, January 6, 2009
Trust and Social Networks: The New Frontier of Phishing
Twitter recently being hacked Twitter Blog: Gone Phishing is just the latest example of Spear Phishing. Luring someone in based on a common affiliation.
Lately, a new technique, predicted by the University of Indiana talks about gaining the trust of the recipient by putting recognized names and other familiar details into the email body. This makes the email look "genuine" and significantly increases the chance that the recipient will act on the message (the action rate increases 5 times over a "normal" Phishing scam, according to the study).
Social Phishing is a type of highly targeted "spear Phishing" attack that could be made on a few thousand people with high success rates. The University of Indiana study showed a 74% response rate. The control group has a 16% response rate. Correcting this for the typical 3% control response rate (university students are more trusting or less risk averse than the population at large), gives a success rate of about 12%, which would be very productive for the Phishers.
In the on-line world, Phishing has been very successful (for the Phishers). But users are becoming much more savvy, so they are not getting "hooked" as much. For example, the Nigerian email scam is laughably lame now. I have to believe they continue these out of habit, like a dog barking to get a bone. People recognize the fact that there is no personal information in the email. That is the main flaw with "generic" Phishing attacks.
Lotus Notes User Network Penetrated
Fast forward to today. Take the Lotus users' various networks. Searching PlanetLotus.org, various blogs and the IBM Notes/Domino 8 Forum would enable anyone to find many names, and quickly identify the popular names based on the number of times it is mentioned. Without a lot of work, you could build a web of connections to be able to pretend to part of the network, or pretend to be referred by someone you know. (A friend of a friend).
That is how Bernie Madoff (pronounced Made-Off, which in English means "to steal") worked his Ponzi investment scheme. Trust. People trusted him because other people trusted him. That is how the "confidence" game works.
Once a network is penetrated, it will be pretty easy to get users to act on emails. Crafting an email would be easy. Even a non-Notes users could take a blog or forum posting from an individual who is frequently mentioned and use it to simulate subject matter expertise. Finishing it off with a request or other action and you have a powerful tool for fraud.
An Email "from" Volker Weber
To penetrate a community, a Social Phishing attack would start by spoofing the name most often mentioned in our Lotus Notes world. Based on PlanetLotus.org's list of Hits in the last 20 days the person most likely to be spoofed would be Volker Weber. Using his name means trust. So, I did what a Social Phisher would do and grabbed a blog posting from Volker's blog to create an example of how said Social Phisher could infiltrate a community and wreak havoc. For simplicity, I shortened it, but it can be seen in its entirety on vowe.net
I then fabricated a plausible story around the blog posting. A real attack would weave real details relating to Lotus Notes with false information or Malware links. I wrote the additions to the blog posting in red, for demonstration, but the Social Phisher would not be so kind to point out the Phishing section!
(Note: This is just a demonstration email. It was not written by Volker. You could take any Lotus Notes or Domino blog and do the same, targeting users in that space, especially those, like me, who freely post their email addresses on-line).
From: volker@vowe.net
To: frank_paolino@maysoft.com
Subject: Winners of the 2009 Lotus Awards
Winners of the 2009 Lotus Awards
by Volker Weber
Best Industry Solution
1. Winner: e-On Integration S.A.
2. Finalist: iEnterprises
3. Finalist: Ascendant Technology
Best Lotus Energy and Environment (Green) Award
1. Winner: KLG Systel, Ltd.
2. Finalist: Alphalogix
3. Finalist: Enterprise Information Management, Inc.
Best Mid-Market Solution Award
1. Winner: iEnterprises
2. Finalist: Pavone AG
3. Finalist: Nortel
...
...
...
Congratulations to all the winners! Click on the links to learn more about the winners and see these excellent Lotus Notes products!
Volker
Find me on-line at:
vowe.net
(these links are the actual links and are harmless.... those in a Social Phishing Attack would not be!)
A spoofed message "from" Volker Weber in this context would be likely to be opened. And the relevant, topical nature of the email would make it widely read.
In a Social Phishing scam, the links would really be Malware such as keyboard loggers. As such, they would be very helpful in gathering all types of information such as PayPal accounts, LinkedIn logins, etc. to continue the scam.
The point is that the Social Phishers are getting a lot smarter, using
context,
recognition
familiarity
to get people to read and act on the emails.
Like spam, these attacks prey on our open protocols (SMTP) and our open Lotus communities. I am not advocating any change in these community sites. PlanetLotus.org, the IBM Forum and all the Lotus Notes blogs are open, and should remain so.
But beware of emails from trusted sources. If you are not sure, reply and ask if they sent it. Do not give personal information in any link provided in an email. With all of these precautions, many of us will still fall prey to these scams.
Here is another blog about Spear Phishing:
Trust and Social Networks: The New Frontier of Phishing
Lately, a new technique, predicted by the University of Indiana talks about gaining the trust of the recipient by putting recognized names and other familiar details into the email body. This makes the email look "genuine" and significantly increases the chance that the recipient will act on the message (the action rate increases 5 times over a "normal" Phishing scam, according to the study).
Social Phishing is a type of highly targeted "spear Phishing" attack that could be made on a few thousand people with high success rates. The University of Indiana study showed a 74% response rate. The control group has a 16% response rate. Correcting this for the typical 3% control response rate (university students are more trusting or less risk averse than the population at large), gives a success rate of about 12%, which would be very productive for the Phishers.
In the on-line world, Phishing has been very successful (for the Phishers). But users are becoming much more savvy, so they are not getting "hooked" as much. For example, the Nigerian email scam is laughably lame now. I have to believe they continue these out of habit, like a dog barking to get a bone. People recognize the fact that there is no personal information in the email. That is the main flaw with "generic" Phishing attacks.
Lotus Notes User Network Penetrated
Fast forward to today. Take the Lotus users' various networks. Searching PlanetLotus.org, various blogs and the IBM Notes/Domino 8 Forum would enable anyone to find many names, and quickly identify the popular names based on the number of times it is mentioned. Without a lot of work, you could build a web of connections to be able to pretend to part of the network, or pretend to be referred by someone you know. (A friend of a friend).
That is how Bernie Madoff (pronounced Made-Off, which in English means "to steal") worked his Ponzi investment scheme. Trust. People trusted him because other people trusted him. That is how the "confidence" game works.
Once a network is penetrated, it will be pretty easy to get users to act on emails. Crafting an email would be easy. Even a non-Notes users could take a blog or forum posting from an individual who is frequently mentioned and use it to simulate subject matter expertise. Finishing it off with a request or other action and you have a powerful tool for fraud.
An Email "from" Volker Weber
To penetrate a community, a Social Phishing attack would start by spoofing the name most often mentioned in our Lotus Notes world. Based on PlanetLotus.org's list of Hits in the last 20 days the person most likely to be spoofed would be Volker Weber. Using his name means trust. So, I did what a Social Phisher would do and grabbed a blog posting from Volker's blog to create an example of how said Social Phisher could infiltrate a community and wreak havoc. For simplicity, I shortened it, but it can be seen in its entirety on vowe.net
I then fabricated a plausible story around the blog posting. A real attack would weave real details relating to Lotus Notes with false information or Malware links. I wrote the additions to the blog posting in red, for demonstration, but the Social Phisher would not be so kind to point out the Phishing section!
(Note: This is just a demonstration email. It was not written by Volker. You could take any Lotus Notes or Domino blog and do the same, targeting users in that space, especially those, like me, who freely post their email addresses on-line).
From: volker@vowe.net
To: frank_paolino@maysoft.com
Subject: Winners of the 2009 Lotus Awards
Winners of the 2009 Lotus Awards
by Volker Weber
Best Industry Solution
1. Winner: e-On Integration S.A.
2. Finalist: iEnterprises
3. Finalist: Ascendant Technology
Best Lotus Energy and Environment (Green) Award
1. Winner: KLG Systel, Ltd.
2. Finalist: Alphalogix
3. Finalist: Enterprise Information Management, Inc.
Best Mid-Market Solution Award
1. Winner: iEnterprises
2. Finalist: Pavone AG
3. Finalist: Nortel
...
...
...
Congratulations to all the winners! Click on the links to learn more about the winners and see these excellent Lotus Notes products!
Volker
Find me on-line at:
vowe.net
(these links are the actual links and are harmless.... those in a Social Phishing Attack would not be!)
A spoofed message "from" Volker Weber in this context would be likely to be opened. And the relevant, topical nature of the email would make it widely read.
In a Social Phishing scam, the links would really be Malware such as keyboard loggers. As such, they would be very helpful in gathering all types of information such as PayPal accounts, LinkedIn logins, etc. to continue the scam.
The point is that the Social Phishers are getting a lot smarter, using
context,
recognition
familiarity
to get people to read and act on the emails.
Like spam, these attacks prey on our open protocols (SMTP) and our open Lotus communities. I am not advocating any change in these community sites. PlanetLotus.org, the IBM Forum and all the Lotus Notes blogs are open, and should remain so.
But beware of emails from trusted sources. If you are not sure, reply and ask if they sent it. Do not give personal information in any link provided in an email. With all of these precautions, many of us will still fall prey to these scams.
Here is another blog about Spear Phishing:
Trust and Social Networks: The New Frontier of Phishing
Tuesday, November 25, 2008
Thanksgiving Wishes
So here is my prayer for Thanksgiving:
I want to give thanks to all the people that I associate with via the blogosphere. Like the Pilgrims and the Indians, we often come from different backgrounds. And like them, we don't always agree, but we need to find a way to get along, even when we disagree (especially when we disagree). We spend a lot of on-line time working together in all forms of groups. These groups often become polarized, and much anger and vitriol is spewed against those who are "less" enlightened than us. I love passion, and passionate arguments, even when I disagree. It is energizing to have a strong passion for what we do, otherwise why get out of bed?
Thanksgiving is an opportune time to reflect about our relationships to others. As Charles Dickens said so well in "A Christmas Carol" that it is a time to "think of people (around us) as if they really were fellow-passengers to the grave", which should give us pause to reflect on the shortness of our time here.
We are all on this planet for only 78 round trips. Some get a few more, many get a lot less. So above all, the first thing that I am (and all of us should be) thankful for is good health. Without it, all the rest really does not count for very much.
So, I would like to summon this spirit to wish everyone a Happy Thanksgiving, and hope that we can re-learn what we were taught as young children: to be nice to others. This is especially needed in the blogosphere, where anonymity and distance cloaks civility and open discourse which oftentimes provokes needless harsh words and enmity. In that spirit of brotherhood (or should I say community), I give thanks to all the people in my life, associates at Maysoft, fellow workers, and fellow bloggers everywhere for the chance to spend a few moments, in person or virtually, together, enriching our shared experience here on earth. Isn't that, after all, what the Indians and Pilgrims were doing at the first Thanksgiving in the year 1621?
Tuesday, November 18, 2008
A World without Spam Filters
After looking at our spam blocking statistics for yesterday (we blocked 279,706 messages on our 2 Domino SMTP gateways), I wondered what the world would be like if we had no spam filters?After I pondered this question for some time, I finally decided that the only way to really know the answer is to stop the automated blocking and just see what happens. After all, SpamSentinel has been working so well
for so long that I've forgotten what it is like to live without a Spam filter. So I have decided to do a one hour test, bypassing the filter on our main SMTP gateway, from 11 AM to 12 noon today, for our Lotus Notes email users.
10:55 AM
I am writing this part of the blog before the test, not knowing if a small mutiny will ensue, or not. All is calm now, at 10:55 AM. The test begins in five minutes, at 11 AM, and runs for one hour. I am afraid to run it for more time than that, as this is our
live email and people have work to do.
10:59 AM
So, it is 10:59 now, and I have just sent one last warning email about the test to everyone ....
"At 11 AM EST today, we are running a test of a World Without Spam Filters.All automated Spam blocking will be turned off for sixty minutes. We expect all users to block their own spam manually"
11:00 AM and we're off...the "World Without Spam Filters" test begins
11:21 AM
So, 21 minutes into the test, my Lotus Notes Inbox is being flooded. Here is a snapshot:
11:38 AM
Blackberry users are complaining about the spam. Allison Cote wants to know what is happening. She had to leave her Blackberry and delete a bunch of messages from her Inbox. My test is distracting her, and others, from their work.
11:42 AM
I am checking mail1.box and mail2.box. There are 3,341 messages in one, and about the same number in the other. The router is going crazy trying to send some of these back to the senders as delivery failure reports. Aaaargh... this is worse than I thought.
11:46 AM I have to stop this test early. The amount of pain everywhere is too much. I am turning on the SMTP mail filter now as the only prudent course of action.
Blackberry users are still complaining.
Good mail is buried in the spam.
The router task on the server is working way too hard, trying to deliver these spam messages or delivery failure reports. Some messages are being sent back out as Backscatter.
I have stopped the router task while I delete the contents of mail1.box and mail2.box.
Good messages that were in mail1.box or mail2.box may have been lost when I deleted all the pending messages to clear out the spam
I just restarted the router. It is quiet now. I will have all users resend all messages between sent between 11:30 and 11:45, as they were most likely deleted by me.
11:58 AM Looking around at other mail boxes to see the damage. Most people got about 10 messages, which tracks well with the 200 a day most people receive on average.
I found this gem in one Inbox, containing malware and a funny subject, "CNN: Aliens send us cartoon messages!"
12:06 PM All the mailx.box files are clean now. Users are not making any more noise, but they have questioned my sanity.
So what did I learn from this Social Experiment? What would a World Without Spam Filters be like?
1. For starters, deleting real messages is a highly likely possibility, both by users in a hurry to clean their Inbox and by the Lotus Notes email administrator.
2. It took me about 15 minutes to clean up 45 minutes of spam. That makes the clean up and delete job, as an administrator,
to be about 15 minutes per hour, or 2 hours per day.
3. Spam is still heavily reliant on random dictionary attacks, hence the amount of delivery failure reports.
4. Backscatter causes collateral damage to others outside the organization.
5. Servers would be overwhelmed with the workload, trying diligently to deliver every message as if it were a valid email.
6. Blackberry Users: It is not just the inconvenience of hitting the *delete* button. It is the mind-numbing distraction of having the Blackberry go off every time an email message comes, especially when you are in a meeting but also waiting for a critical email that needs an immediate response. The tension over false alarms kills concentration.
7. Attention Deficit Disorder: Some studies have been done which detail how much productivity is lost for every interruption. The cost of a Spam email isn't just the time it takes for our minds (and hands) to figure out it is Spam and ignore/delete it, it is also the amount of time it takes us to get our mind focused again which can magnify the loss of productive thinking time. Without a Spam filter, I would NEVER enable any sort of pop-up 'you have email' alerts in my mail client, as I do a lot of programming and project work where I need time to work for a stretch without interruption in order to keep up the quality of my output.
8. The cost of spam without a filter is nearly 120 times what the filter costs. This is based on the fact that, between deleting spam and hunting for good messages in the mess takes about 30 minutes a day, or about 120 hours annually. At a pay rate of $30 (25 Euros) per hour, which approximately equals the annual cost of spam filtering, the payback is only a single day of usage. Myself, I couldn't stand even one hour with the filter off, let alone one entire day.
9. Spam Filters, although imperfect, are an absolute critical necessity.
10. In a World Without Spam Filters, email would be almost useless.
SpamSentinel for 64 Bit Domino
I now know why 64 bit Domino is gaining in popularity. It really gives Domino access to so many more memory resources. Performance is not limited by the old 2 gig RAM barrier for applications. So we are happily releasing the 64 bit version of SpamSentinel to beta customers this week. The conversion from 32 bit to 64 bit was no fun, but that is why they call it work!
SpamSentinel also has less constraints on processing, and it shows! We are seeing much faster throughput, past the 2 million messages per server per day mark!
We have been running this on our internal server for 5 days and it has remained stable. It is running on our internal mail server, a 64 bit server running Windows 2003, along with Domino version 8.0.2, where all of our mail files exist. This is our own internal "vote of confidence", meaning we will not release software until we are confident enough to put it on our internal production servers, as errors can cause dreaded work interruptions.
So, for those of you who like to have your anti-spam and anti-virus solution run natively on the Domino server, you can use this solution. As before, you can expect a 99.44% block rate.
Any customers who want this version can call us at our main line at (978) 635-1700 or email me, frank_paolino@maysoft.com to obtain an advance copy.
SpamSentinel also has less constraints on processing, and it shows! We are seeing much faster throughput, past the 2 million messages per server per day mark!
We have been running this on our internal server for 5 days and it has remained stable. It is running on our internal mail server, a 64 bit server running Windows 2003, along with Domino version 8.0.2, where all of our mail files exist. This is our own internal "vote of confidence", meaning we will not release software until we are confident enough to put it on our internal production servers, as errors can cause dreaded work interruptions.
So, for those of you who like to have your anti-spam and anti-virus solution run natively on the Domino server, you can use this solution. As before, you can expect a 99.44% block rate.
Any customers who want this version can call us at our main line at (978) 635-1700 or email me, frank_paolino@maysoft.com to obtain an advance copy.
Friday, November 14, 2008
How to Build a Botnet
So, one Washington Times reporter did what a whole "Can Spam" act couldn't do, make a significant dent in spam. It is still down 2/3, which worldwide is huge!
As a designer of anti-spam software at www.maysoft.com/, it did make me start to think that if we could figure out how the botnets work technically, then we could begin to shut them down. To defeat an enemy, you must think like them. So, to understand how to build a botnet in detail, I decided to do a "thought experiment" of building a sustainable fault tolerant botnet system. So, the first thing we need are some requirements. The "requirements" if one were to build a botnet, would be the following:
- A master server (host) that gives instructions to all the bots
- Bots need to check into a host daily to get instructions
- Host needs to be able to give it pointers to a list of email recipients and the message(s) for today
- Host needs to give bot a number of messages to run (or instructions to run the whole list)
- Fault tolerance - Botnet needs to tolerate if a host is unavailable, having the ability to look for another host
Requirement 5 is interesting, as it applies to McColo going off-line, and the recent reduction of spam by 2/3 because the bots are not sending billions of messages. Why? Because they have no controlling host to get instructions from. Where are the botnets going to go next? The spammers have deployed an amazing grid computing platform. I have to believe anyone capable of building such a platform would have thought about what happens if the host becomes unavailable, making it a single point of failure? My design would be for it to try other servers if the default host is unavailable for 1 day.
How to do that? This was a puzzle at first. If you just hard code IP addresses, you give computer forensic researchers (anti-virus companies, government agencies, and hackers) a list of all of your servers. Not a good idea if you run an illegal operation. So, you would generate DNS names randomly. Then look for them. But if you do it randomly, how can the host know which DNS names to create?
The answer for my design would be to have the bots try to connect to a domain name and use DNS to find the server. For example, spammer1.com, spammer2.com, etc. This is still pretty easy to stop. So my design would be to have the domain names generated by the bots based on an algorithm based on date, so they are dynamic. The spammer creates the new domains as needed and points them to the new host computer. This could change daily to avoid the problem of cutting off one host. (Frank's note: This answer is too basic. I think their actual system is more clever than this simple approach).
So that is my idea of how to design a botnet. So when these zombies start reconnecting, and my guess is soon, unfortunately these millions of compromised computers will start to spew more spam.
So the answer here seems to be to find ways to locate and disable the host computers. I prefer technical solutions to legal ones. But in this case, if the techies can notify the government(s) where these hosts are located, maybe that one-two punch will really help to "Can Spam" !
(Read my other postings about Lotus Notes Spam at http://blog.maysoft.org )
Thursday, November 13, 2008
Worldwide Spam Volume Down 60% !!!
One spam controlling source, McColo in San Jose, was shut down. The result was that the botnet it controls basically had nothing to do. This botnet is responsible for 60% of spam, and its demise means everyone is noticing a 60% drop in spam worldwide in one single day! We have noticed it internally, dropping from 250K message daily to 90K.
Our phones at Maysoft are ringing with SpamSentinel customers who want to know where their spam is. Well, it never arrived in the first place!
Maybe if we can get 3 or 4 more of these firms shut down, I can take a vacation!
Seriously, though, I fear for the millions of rogue computers who no longer have a way to phone home to McColo. What if they have some malicious code built in if they cannot communicate to the controlling servers for x days? Sort of like a rogue army, with no leader?
I would prefer that they self-destruct, but, alas, that is just wishful thinking.
Monday, May 12, 2008
SpamSentinel Stops Backscatter
Although backscatter is not spam, many of our Lotus Notes customers complain about it to us, as they know we can be pretty creative when stopping unwanted email. I'll admit that this one had us stumped for a few weeks. We tried to find a way to distinguish between a backscatter email and good mail. Backscatter is a common issue at the moment. What happens is that the spam sender forges the return address so that it points to you. When the receiving server rejects the message, due to an invalid user name or mail box full error (for example), the server creates a non-delivery failure and sends it back to the user who it thinks the mail came from - i.e. you or one of your users.
Some customers report hundreds of these each day for a single user, and one customer had so many it amounted to a Denial of Service attack (see Case Study of DoS Attack ). Customers were begging us for a solution to this problem.
Well, we finally figured out how to stop baskscatter that your server receives.
We accomplish this using unique properties of Domino messages that help distinguish real NDRs from backscatter. The trick was that some senders send back a non-delivery report (NDR) and some send back only a "Memo", which complicates the problem. These Memos are simple mail messages from a legitimate email server to your email server. If they include the body of the message, SpamSentinel is able to stop the message as spam. If they simply say "We are unable to deliver the message" then it is almost impossible to stop. But we have found a way!
So, if you upgrade to version 7.5.3.1 of SpamSentinel, your problem is solved. This version has two new options:
- Block NDRs that are not from Emails generated from one of your Domino SMTP servers
- Block Memos that are effectively NDRs
Here is a sample email backscatter message that SpamSentinel 7.5.3.1 catches:
This version is available by request. Email me Frank Paolino and I will get you the software. This is a "no charge" upgrade, and includes the ability to block spam at the SMTP gateway (see the blog posting SpamSentinel Now Blocks Spam at the SMTP Level)
Some customers report hundreds of these each day for a single user, and one customer had so many it amounted to a Denial of Service attack (see Case Study of DoS Attack ). Customers were begging us for a solution to this problem.
Well, we finally figured out how to stop baskscatter that your server receives.
We accomplish this using unique properties of Domino messages that help distinguish real NDRs from backscatter. The trick was that some senders send back a non-delivery report (NDR) and some send back only a "Memo", which complicates the problem. These Memos are simple mail messages from a legitimate email server to your email server. If they include the body of the message, SpamSentinel is able to stop the message as spam. If they simply say "We are unable to deliver the message" then it is almost impossible to stop. But we have found a way!
So, if you upgrade to version 7.5.3.1 of SpamSentinel, your problem is solved. This version has two new options:
- Block NDRs that are not from Emails generated from one of your Domino SMTP servers
- Block Memos that are effectively NDRs
Here is a sample email backscatter message that SpamSentinel 7.5.3.1 catches:
This version is available by request. Email me Frank Paolino and I will get you the software. This is a "no charge" upgrade, and includes the ability to block spam at the SMTP gateway (see the blog posting SpamSentinel Now Blocks Spam at the SMTP Level)
Subscribe to:
Posts (Atom)
