Virus Info Center - Content Security

Spam

Spam is unsolicited commercial email, commonly called "junk mail." Most of it consists of advertisements for dubious businesses, such as "get-rich-quick" schemes or adult-oriented websites. Some spam email tries to generate sales leads for sub-prime lenders, Internet merchant service companies or vendors of alternative medicines. Some spam also engages in illegal practices like "pump and dump" stock scams that try to inflate the price of thinly-traded stocks or try to trick users into divulging their ISP or network passwords.

Spam is more than just a pain in the neck. Spam wastes bandwidth and slows Internet traffic. Important email messages may become "buried" in a flood of spam and are thus overlooked. For businesses, the resources used to sort, store and deliver spam cost money and drain productivity. The cost to ISPs of processing spam email can be substantial and these costs are then reflected in higher customer subscription fees.

How to Fight Spam

Never buy anything from a spammer. Don't encourage them by supporting their business.

Do not reply or try to unsubscribe to a spam message. Many spammers try to encourage recipients to reply to their messages in order to confirm the validity of the email address.

Most email clients allow you to apply rules to filter out unwanted messages. Set the filters to block messages with words or phrases that are typical of spam email such as "Make Cash Fast" or "Sex." There are also many email filtering programs on the market that automatically identify and destroy unwanted messages. The best programs allow you to easily customize your preferences.

Forward spam to Trend Micro's spam collectors at spam@trendmicro.com

Malicious Mobile Code

ActiveXÒ controls and JavaÒ applets are basically programs that run from within browsers like MS Internet Explorer®.  They add functionality to web sites and make them interactive. They are used to provide animation, display images with sound, display scrolling text, and for certain interactive online games on websites. In addition, scripting languages like VBScript and JavaScript provide interactivity and decision-making capabilities to static HTML pages.

Ever applied for anything online?  If you have, then probably you have filled up an online form, that verified the validity of your entries with a database, then prompted you for corrections when you made a wrong entry, listing the errors.  Chances are these validation routines used one of the above technologies embedded within the page, in conjunction with either JavaScript or VBScript.    Used this way, they aid in speeding up the data validation process as well as cutting down on server use. Trend Micro's HouseCall is also an example of an ActiveX application.

Though these technologies enhance the usefulness of web sites, they also increase a potential vandal’s ability to interfere with unprotected systems.  Because ActiveX controls and Java applets require that certain components be downloaded into a user’s PC, activating an applet or control might actually download malicious code.   

The danger from these codes varies greatly. At this point, malicious Java applets are normally more of a nuisance than a real threat to data -- because, by design, Java applets should not be able to read, write, or delete files.    

Examples of pranks that malicious Java applets have caused include:scores of browser windows opening unnecessarily or the volume of a speaker increasing suddenly.

This relatively benign nature, however, may change in time, as Java developers expand the capabilities of the language.  (In 1999 Microsoft released a corrective patch for a vulnerability in Internet Explorer’s virtual machine that gave specially designed malicious Java applets file-handling capabilities)

ActiveX, however, is another matter.  These controls can be used within a variety of MS applications, aside from Internet Explorer, and have control over the computer’s operating system.  An ActiveX component could therefore be made perform a wide variety of malicious things from wiping out data, to damaging the operating system, to stealing passwords.

Inappropriate Web Sites

Web filtering at work

Just as the telephone and photocopying machines were prone to misuse in the pre-Internet era, the PC is now the focus of abuse today.   As more and more companies grant Internet access to their employees, they not only reap the benefits of having an Internet or Intranet savvy work force, but also face its pitfalls.

One IT management headache is Cyber-slacking, loosely defined as the act of surfing the Internet for personal ends, on the job, at the expense of work.

Excessive chatting and downloading of MP3 files, visitation of gambling sites, and the like are just samples of this.  Non-business related use of a company’s resources not only affects productivity, it also reduces available bandwidth for legitimate uses. 

A major offshoot of the above problem is the issue of pornography in the workplace.  Employers are responsible for the maintenance of a wholesome work environment – keeping it porn free forms part of that.

Web filtering at home

In the same manner that some cable or television shows were not meant for children, some web sites are similarly taboo.  Though the standards for determining what is appropriate and what isn’t vary from family to family and from culture to culture, the sites in question generally relate to the following:

• Pornographic material.  Adult sites that show pictures of, or discuss explicit materials.  Some people would consider only those sites that actually show nudity as pornographic, while others include swimsuit editions of fashion magazines in this category

• Hate / Discrimination.  These are sites that advocate discrimination against others based on race, religion, gender, nationality or sexual orientation

• Illegal activity.  These sites promote acts that are generally considered illegal like the use of prohibited drugs, bomb- making, use or sale of pirated software, hacking, suicide or assisted suicide, and murder.

• Violence.  Violent game sites fall in this category.  As do those that show or describe acts of violence or grave injury. 

• Chat sites.  Chat sites seem innocent enough, but when you consider the number of high profile cases involving pedophiles who used chat programs to trick children into meeting them – then it becomes a cause for concern

For further information on harmful content that may be found on the net, you may consider visiting the following site : http://www.getnetwise.org  

PC-cillin allows users to block offensive or inappropriate URLs with its Web Filter, by including them in the Restricted Sites List.