Spammers dive into Google's lucky dip Google's "I'm feeling lucky" button was designed to save web searchers time by automatically opening the first page of a query. It turns out the feature, and similar ones from other search engines, are increasingly helping junk mailers get around anti-spam products. That's one of the findings from a January Intelligence report …
Block all URLs in emails that contain a Google search string.
If you want to show someone a site, send them the site URL. If you want to show a humorous Google search (French military victories, miserable failure, whatever the fad of the month is), just send the words and tell them to Google it.
Easy.
My bank account is empty, I have hundreds of useless shares that are quickly losing value, I also have hundreds of little blue pills and my PC sends out thousands of emails a day, to where I do not know. I have heard nothing from the nice African prince who's fortune I helped to recover for a mere £5,000 whilst promising me £50,000 in return, on top of that my new gold Rolex is gettting rusty. On the plus side I am now hung like a horse.
Anyone who clicks on any link from an unsolicited email gets exactly what they deserve, regardless of the clarity of url.
Seriously, always use a web based provider for those sites that want an email address to send a password to before allowing one to access content. And set the filters on your proper mailbox to automatically delete all messages that hit your proper mailbox which do not have your correct name before the @. I find nearly all spam contains the correct domain name for the email account but the part before the @ is usually ascii nonsense. I just don't get spam emails in the inbox of my ISP account. My trash folder however usually gets a hundred plus emails a week, which is emptied regularly without me looking into the contents.
I guess I am teaching grannies to suck eggs with the above paragraph seeing as the majority who visit the Reg are IT professionals. Still, I leave it in, just in case there are some "paper professionals" out there.
Block links to the 'i'm feeling lucky' redirect unless the HTTP_REFERER is google.
Paraonid people who block referrer information might not be able to use the button then. I'm so sad for you all!
Jolyon
ps. Oh alright, if you really do insist on being paranoid, Google could instead randomize the name/id of the button and have some way of checking this on the referrer page, but that would be a right bloody pain to implement reliably.
Or make the spam engine query the page, and if it gets a redirect, use *that* URL against the spam db.
But then you're making the spam engine "hit" every page that goes through the engine, and if you've got your company URL in your sig, that's a hit on your website every time someone sends a mail or receives a reply.
Above is easy, but relies upon all antivirus / malware vendors making the change. I'd hazard a guess that there are still enough unprotected PCs out there for the tactic to still be worthwhile persisting with.
Far simpler (for the public anyway) way is to Include a simple random-number key that is generated at the time the google home page is opened, and store it in a server session variable. Have it submitted with the search form as a hidden form field, then compare the two values on the server.
If the two values match, then the "I'm feeling lucky" button will go to the normal place, but if the two values don't match (i.e. they hadn't visited the google home page first), then display an error page instead.
A simple way of ensuring that your browser HAS to have gone to the google home page in the same session before the button will work!
"Seriously, always use a web based provider for those sites that want an email address to send a password to before allowing one to access content. And set the filters on your proper mailbox to automatically delete all messages that hit your proper mailbox which do not have your correct name before the @."
All good advice until your ISP gives away the entire contents of their email database containing every email address you've ever sent mail to or received mail into.
I was spam-free for years until Plusnet kindly pulled my trousers down, bent me over and gave me a good seeing to by giving away my own domain name email addresses in addition to the plusnet-based ones.
You can look after yourself only so far. When other idiots give your details away, there's not a lot you can do.
Send the police to catch the scum that do the spamming... instead of having them harrass motorists...
The govt has billions spare to spend of ID cards and CCTV cameras etc, but nothing to spend on catching, prosecuting, convicting REAL criminals...
Even Paris could work that out.
'I am feeling lucky' is not really a lucky dip - it just goes to the top ranked site for that search.
The spammer has got to find a rare word combination, normally some gibberish and then make a site with those words on it. Google will know this is spam, as the numbers of people searching for the gibberish spike, are using I am feeling lucky, and there are very few results for the search.
'The Register' example was a bit off, as www.theregister.co.uk tends to get searches for 'the register' as number one, though feasibly someone could aim for the big domains it would take a lot of effort to usurp them.
I am fairly sure they are working on it now, it is not really a clever scam, as it brings the Google trademark into disrepute and Google are the ones who can identify which domains they are, through quite a few channels actually, when you bear in mind they have gmail.
Google is multi national, so can probably sue for abuse of service and abuse of their trademark wherever the spammers maybe, I think a lot of spammers are going to get a rude awakening with this ill thought out approach.
I have had the same ISP for around 6 years, OK so far. But I do understand what you are saying. One has to place at least a modicum of trust somewhere, thing is I can place anything in front of the @. it will still reach me if I set the address up in my mail account and Thunderbird. If I ever get spammed using my current name I will just change it, inform those in my address book and set the old name for deletion.
If your trousers were pulled down after the 30th of Jan 2007, it was BT that did it after purchasing PlusNet and sacking the CEO and Finance officer.
It gives me a warm feeling that I'm using Google's service, but without looking at any of their ads (where did I read recently that it was estimated they lose tens of millions $/year in potentials ads?).
It's mostly for Gmail - my home page is Google so I type those 5 characters, tab twice, enter and it takes me there. It's just the habit I've got into; I'm sure I'll get 101 suggestions of how a Firefox extension could do it better.
>>"All good advice until your ISP gives away the entire contents of their email database containing every email address you've ever sent mail to or received mail into."
My old ISP (Freeola) merely gave away all my email addresses, including addresses that had never actually been used for sending or receiving anything other than a test mail from me.
Of course, their slithering excuse for tech/customer support denied it could possibly be them, but that wasn't exactly convincing, since other customers I knew of theirs had the same thing happen at exactly the same time (same peculiar spam started arriving at every single email address).
Google is definitely a spam-friendly corporation because they seem to pride themselves on not having live customer support. Their published abuse contacts of abuse@gmail.com, abuse@google.com, and groups-abuse@google.com are not read. I've sent Google hundreds of complaints about criminal Usenet spammers using Google Groups. The criminals are still flooding Usenet a year later. I've sent dozens of GMail complaints to Google. Google auto-replied saying that GMail wasn't the spam source because it can't spam. Getting spammed for Google's Blogspot? Good luck with that.
Lets see how bad it gets when Google owns some wireless bandwidth. I'd be impressed if they can keep the level of legitimate traffic above 5%.
"Not clicking on links in email" is only possible to those who do not use Outlook, or who do not allow Outlook (or Outlook Express) to use its preview pane.
As for trust, Adobe shared my "registration" spam-trap email address with a porn-spammer within 30 minutes, so I have to presume it is an automated process.
(N.B. there is/was apparently no abuse@adobe.com. You have to send registered physical mail to a law-office behind an P.O.Box in Los Angeles to complain. Or that was the case when this happened. Dunno if it is still that way because I will certainly never buy another Adobe product.)
"It's mostly for Gmail - my home page is Google so I type those 5 characters, tab twice, enter and it takes me there. It's just the habit I've got into; I'm sure I'll get 101 suggestions of how a Firefox extension could do it better."
Aside from the obvious use-a-bookmark (which I assume you've tried and rejected), you could always try Launchy: http://www.launchy.net/
I can get to gmail in 5 keystrokes (without necessarily having my browser-of-choice open): Alt+Space, gm, Enter
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
