Posted on behalf of Matt Sergeant, Senior Anti-spam Technologist, Symantec Hosted Services

As of this week, Canada joins the rest of the G8 countries with its very own anti-spam law. Until now, Canada has been the only G8 country without anti-spam legislation. Bill C-28, the new Fighting Internet and Wireless Spam Act, will require businesses to follow best practices and aims to prevent unsolicited commercial e-mail distribution in Canada

First introduced in 2009 as Bill C-27, the Electronic Commerce Protection Act died when parliament was prorogued in December 2009 but was reintroduced earlier this year as Bill C-28. After much debate, it was finally approved by the Senate on December 15, 2010.

This legislation differs from the CAN SPAM Act in the U.S., which requires opt-out protocol. Canada’s powerful spam law requires businesses to obtain opt-in consent from recipients before sending commercial emails and other electronic...

Posted on behalf of Nicholas Johnston, Senior Software Engineer, Symantec Hosted Services

Spammers abusing free hosting sites by using them for hosting spam-related content is nothing new, but this abuse has turned into much more sophisticated, multi-layer abuse.

Instead of just including a link to a free hosting site, and hosting spam-related content there, spammers are increasingly using URL shortening services. These services allow spammers to create an almost unlimited number of links, allowing each individual spam message sent to contain a new link. Increasingly, these links do not point directly to a spam-related site. Instead, they point to a free hosting site, often with extra randomized "junk" parameters added to the end of the URL like this:

 http://fipxmdmzp.REDACTED.com/?iyzdm=yngqsa
...

Tomorrow (December 7) we will release our MessageLabs Intelligence 2010 Annual Security Report looking back at the changes in the threat landscape during 2010. We also use the opportunity to look ahead at potential trends for next year. In the days leading up to the publication of the report we have shared a number of these trends. This trend is the final in this series of posts:

Cybercriminals Usurp URL Shortening Services

URL Shortening services are becoming critical to the operation of social networks, particularly those that apply a character limit to user updates. In 2010 we saw a number of exploits using URL shortening services that lead to compromised sites.

In 2011 we expect to see more sophisticated attacks using URL shortening services either by a criminal enterprise gaining control of a significant URL shortening service or one of these groups setting up a service which appears legitimate, and operates in a legitimate...

On December 7 we will release our MessageLabs Intelligence 2010 Annual Security Report looking back at the changes in the threat landscape during 2010. We also use the opportunity to look ahead at potential trends for next year. In the days leading up to the publication of the report we will share a few of these trends.

Rogue Marketplace Vendors Exploit Online Digital Currencies
In 2011 social networking sites and online marketplaces will roll-out their own in-house digital virtual currencies. As an example one site already has a system in place that uses “Credits.” Attacks will soon be designed to seek to exploit these new areas for financial fraud, including specialized malware, rogue applications and phishing attacks.

We expect more social networking environments and online marketplaces will move towards adopting this approach, and that these systems will come under prolonged attack and a weakness in one will be identified as the...