Check out The Complete Guide to Avoiding Online Scams @ lifehacker, a great article for the less "savvy" users in your life.

Labels: security, tech

Last year the company Exchange server I manage almost crashed because spammers got a hold of it (BZ you should feel me here). Not just relaying spam but, a simultaneous DoS attack flooding the server with NDR messages. Yeah I had to call in the big boys on that one (Microsoft). Anyway, the point is, after I stopped all relays (except me), cleaned up the messages, changed a password and finally got off all the blacklists I was pretty peeved. It didn't help that in the following days coworkers began to complain of increased spam in their inboxes! We run GFI MailEssentials which normally performs pretty well but, now it wasn't catching them.

Turns out the Bayesian filtering system that is it's highlight was my downfall here. By default outgoing messages are added to the legitimate database. This is because under normal conditions all of these messages would be sent by you. In this case, however, spammers sent thousands of messages which were added to the legitimate database seriously lessening it's ability to to detect actual spam. Another side effect was that the whitelist, which also auto adds the address of outgoing mail, had about 65,000 bogus entries.

Well I got it all cleaned up and it runs better than ever now but, I'm still a little paranoid. The whole experience got me really focused on security. Since then I've made a lot of improvements at work and I've been spending a good bit of time places like PhishTank trying to find a way to get one back at em. So much time I managed to make the top 10 list last month. I've got a page where I plan to put samples from work that range from "damn near perfect" to "why did they bother". It's interesting, at least I think so........

Labels: security, spam, work