Nuno’s blog

Around 80% of the Spam messages on the Internet are sent by Spam Zombies. For those who don’t know what I’m talking about, Spam Zombies are normal PCs that were infected by some malicious software and then controlled by some spammer.

The spammer then uses a backoffice to send orders to those infected PCs, or basically to send spam for living..

This nice post from pmontoya, shows exactly what such a backoffice looks like.

I was reading a paper about an engine to detect phishing Web Sites - CANTINA - developed by Carnegie Mellon University and University of Pittsburgh. I guess they came up with an interesting idea:

Roughly, CANTINA works as follows:
• Given a web page, calculate the TF-IDF scores of each term
on that web page.
• Generate a lexical signature by taking the five terms with
highest TF-IDF weights.
• Feed this lexical signature to a search engine, which in our
case is Google.
• If the domain name of the current web page matches the
domain name of the N top search results, we consider it to be
a legitimate web site. Otherwise, we consider it a phishing
site. (We varied the value of N, as described in the evaluation,
to balance false positives with false negatives; however, we
found that going beyond the top 30 results had little practical
effect.)

They say the effectiviness of this engine is 95%. I guess they’re presenting this paper at www2007.

Now you ask: What the hell is TF-IDF?
The term frequency (TF) is simply the number of times a given
term appears in a specific document. The term IDF (inverse d ocument frequency) measures how common a term is across an entire collection of documents.

I guess ClamAV folks released the long awaited ClamAV 0.90.

This version introduces lots of new interesting features and marks a big step forward in the development of our antivirus engine.

(…)

As part of the Google Summer of Code program, we have introduced support for a new phishing signatures format that has proved very effective in detecting phishing emails. The ClamAV phishing module allows better and more generic detection of phishing emails by searching for URLs in email messages, and comparing the real site with the URL displayed to the user in the message.

(…)

On the performance side, support for the MULTISCAN command has been implemented in clamd, allowing to scan multiple files simultaneously.

PS: I know someone that will not go to sleep before upgrade to this version somewhere…