SFX = email scam, anybody's got an explanation?

Posted by krkr on Mon, 02/06/2006 - 08:50SFX.com-related Forum


login or register to post comments | previous forum topic | next forum topic | 5529 reads
Why this spying?
Submitted by Jan Steffen on Wed, 02/08/2006 - 08:37.

Asa confirmed that this mail is genuine, but I still want to know why he send out such a scam-like spy-mail.

  • The mail is lying by hiding its urls: it shows fxflicks.com but is really going to cmail1.com
  • It is spying by counting who clicked on which links. (individualised numbers in the url)
  • It is spyware by using a web-bug (invisible, individualised 1x1px
    image on a remote server) to tell who is reading the mail and when he
    is doing it.

I always thought mozilla is a company/organisation which honors safety and privacy on the net. I have to confess that I am very dissapointed that they are now using such spam/scam-methods.

Asa, could you please explain why do you need to know when and where I read my mail and which links I click.

And Asa, could you please give informations on the privacy statements of sfx, mozilla and cmail1.com? 

I'm damn sure I never ever subscribed to a newsletter from campaignmonitor.com or cmail1.com. Did sfx gave our email addresses to campaignmonitor.com?

Jan

login or register to post comments
Please read Asa's comments
Submitted by on Tue, 02/07/2006 - 16:25.

Please read Asa's comments in this post for the reason for the thunderbird notice.

Again for clarity as there have been some more postings since Asa commented, we can confirm that the email is 100% genuine.

Bottom line, Firefox Flicks is part of a specific Spread Firefox marketing campaign under the direct control of Mozilla so it is logical that all Spread Firefox members should be included in any update news that Mozilla want to inform us about via email.

Moreover, if you think about it; If SFx members were not included "in the loop" I'm sure there would be far more complaints about not being kept up to date ;)

 - Ian


login or register to post comments
Wrong issue
Submitted by Kelson on Tue, 02/07/2006 - 18:12.

The issue isn't whether such a message would or should be sent from SFX.  The issue is whether this message was really sent from SFX -- you and Asa have confirmed that.

More importantly, official, legit SFX mail is being labeled as a likely scam by the default configuration of Mozilla's flagship email client.  That's worrying.  Either the message should have been formatted differently, or the scam detection needs to be refined to reduce the false positive rate.

I think both sides need some work.  From what people have said, it was difficult to verify the source of this message.   That should improve as Asa learns the new mailing list software.  But it also highlights the fact that some of Thunderbird's scam-detection criteria are too broad.

--

Can Firefox users and Opera fans agree on anything?
The Alternative Browser Alliance

login or register to post comments
My 2 cents
Submitted by Ken Saunders on Tue, 02/07/2006 - 15:59.

Well as far as I know there is only one Asa at Mozilla and I did subscribe to the newsletter and so must have all of you who got it. I really don’t see the big deal.
You can read the sender address or just read the text and know that it isn’t a scam.
The email isn’t asking for personal information or asking you to send $, and there’s an unsubscribe notice at the bottom.
Alternatively you can just go to Firefox Flicks Backstage to get the latest on what’s happening behind the scenes.
And Tbird has picked up on actual e-mail scams for me such as PayPal ones.


Spreading Fx Flicks?

login or register to post comments
What Thunderbird Considers a Scam
Submitted by Kelson on Tue, 02/07/2006 - 07:59.

 A couple of months ago I did some research on how Thunderbird's scam detection works.  To quote from my post:

  • Links that only use an IP address, including dotted decimal, octal, hex, dword, or some mixed encoding.
  • Links that claim to go to one site, but actually go to another. (Phishers do this to fool you into going to their site. Legit mailing lists sometimes do this with redirectors for tracking purposes.)
  • Forms embedded in the email. (This explains the LiveJournal notices.)

Personally I think it's overkill, and I've considered disabling it.  I've seen it trip on a lot of stuff I know is legit, and I've never seen it hit an actual scam, but that's partly because my mail server strips out most of the real ones with ClamAV and SpamAssassin, so the sample is biased.

Anyway, as Asa pointed out, the redirector link is the reason this got tagged.

--

Can Firefox users and Opera fans agree on anything?
The Alternative Browser Alliance

login or register to post comments
So is it a scam or not?
Submitted by peacho on Tue, 02/07/2006 - 03:02.

Now I'm terribly confused! Thunderbird didn't say anything to me, but I don't have any spam filters set up (I rarely give out my email address and get little to no spam). It seemed valid and the links did go to the official Firefox flicks website.

So my question is: Is this email valid or not? Thanks in advance.
 

login or register to post comments
It's authentic
Submitted by on Mon, 02/06/2006 - 19:07.

This email is in fact from me.

- Asa

login or register to post comments
cryptografic signature?
Submitted by Jan Steffen on Tue, 02/07/2006 - 16:01.

Hi Asa, why don't you use a electronic signature to sign your mails? I would really like to see that by more of the regular letters I get every day. That would make phishing attempts useless.

It is really a pity, that these possibilities are use so rarely. Even Firefox warns at every extension, that it is not signed. But in fact I never found a signed one. That's poor security management.

CAcert.org gives certificates for free (please fix bug 215243 first) or use Gnupg.

Jan

login or register to post comments
Why did it need the tracking
Submitted by Peng on Mon, 02/06/2006 - 19:26.

Why did it need the tracking and web bug? If it wasn't yelling "I am spam!" so much, I wouldn't have minded it. And if it had been viewable in plain text, since the only use of the HTML is to disguise the tracking links and allow the web bug.

--
Hug Peng
(aka Matt Nordhoff)

login or register to post comments
first time using this service
Submitted by on Mon, 02/06/2006 - 21:10.

I'm using a nice web 2.0 style service to handle mailings since mailman can't do anything I want. I'm new to the software and on this mailing I missed the "send in text as well" option. I'll be sure to get that right next time.

There are other reasons to use HTML, like including images and rich text which I intend to do in several mailings over the next year, but I will be sure to include a plaintext version next time.

- A

login or register to post comments
I got this as well
Submitted by Ant P on Mon, 02/06/2006 - 17:44.

I've set TB to only display the plaintext part of the email, so I got this:


If you are having trouble viewing this email please copy and paste the following URL into your web browser:
http://mozilla.cmail1.com/.aspx/e/28407/16361492/

In fact from looking at the source (ctrl+u), all of the links in the HTML version appear to be going to that server with unique tracking IDs. Even the links labelled as going to a different site. That's not all, it's got a hidden tracking image at the bottom.

If anyone else gets this email after they see this post, make sure you've turned off remote images in TB. This is exactly what it's there for. This email looks like classic spam bait, trying to find out which email accounts get read so the spammer can target them.

...if this is really from Mozilla, I'll be _very_ annoyed. For now I'll give them the benefit of the doubt.

login or register to post comments
Take the tinfoil off
Submitted by cheshirelaw on Tue, 06/27/2006 - 00:11.

The service used, campaignmonitor.com, is not an evil empire. Go to their website and take a look. Like mailchimp.com, it's a service that allows web-savvy people to send out email, manage opt-ins and opt-outs, and track whether it actually makes it to the person they sent it to.

Most of this is good for the receiver, because automated opt-outs (and hard-bounce tracking) is good.

Do you think they should manage a list of 1000s of people in Thunderbird, and then send it from their ISP? That's crazy.

Once your lists reach a certain size, and if you're going to offer HTML (this is 2006, after all! and I know for a fact Campaign Monitor suggests a text version), you're going to look at hosted email services.

I understand spammers have us on edge, but let's educate ourselves before reaching for the pitchforks and torches.

I've been researching this because I'm on the board of a nonprofit that needs better newsletter and event list services.

login or register to post comments
From address mismatch
Submitted by Mook on Mon, 02/06/2006 - 17:29.

You forgot the bit about the mail having From: and Reply-To: headers to Asa, but actually being sent by a third-party server (campaignmonitor.com).

 ... Actually, now that I think about it, for all I know they were the people who previously hacked spreadfirefox, got the mailing list, and now are masquerading...  Complete with tracking to figure out which addresses are live (the unsubscribe link uses the same tracking mechanism).
 

login or register to post comments
scroll
Submitted by Up North on Mon, 02/06/2006 - 09:55.

Also if you look at you picture  (above message pane; right) and you look at firefox flicks for preparation you see that all the other (blurred) subjects start to scroll! What is up with that?

Thundebird is cautious because it seems like a mailing list.

Marco

 

-- room for rent --

login or register to post comments
ok, I can understand what TB
Submitted by krkr on Mon, 02/06/2006 - 10:09.

ok, I can understand that TB would label mail from mailinglists as spam, but I was surprised to see it labeled as a possible scam. Seems there need to be some work on the preseting if the filters (isn't there a whitelist or something like that?)

login or register to post comments
The "scam" message appears
Submitted by michaell on Mon, 02/06/2006 - 20:34.

The "scam" message appears because the message has a link which says "www.firefoxflicks.com" but actually takes you to the mailing list's server which then redirects.  Quite a lot of mailing lists do stuff like that, and also get flagged by TB.  That's why it says it "might" be an email scam - it's just a guess really.

login or register to post comments
email scam
Submitted by SrWilliam on Wed, 02/08/2006 - 12:51.

 It must take people all day to check their Email. Don't worry, be happy.

(SW)

login or register to post comments