Sanford "thpammy" Wallace Fined 4 Million Over Spyware

[giza]

This is no big surprise, but:

http://www.theregister.co.uk/2006/05/05/ftc_spyware_lawsuits/

Sanford 'Spamford' Wallace has been fined $4m and ordered to restrict the deceptive spyware practices of his company, Smartbot.Net, after losing a lawsuit brought by the US Federal Trade Commission.

The FTC alleged that Wallace's software takes advantage of well-known IE vulnerabilities to infiltrate PC and secretly change user's settings and hijack their search engines, before serving up a barrage of pop-up ads. The ads try to bully users into buying anti-spyware products, Spy Wiper or Spy Deleter, for $30 a throw. Worse still, the products fail to clean up systems, the FTC says.

A default judgment against Wallace and Smartbot.Net orders them to give up $4m of their ill-gotten gains. The order also bars Wallace and Smartbot.Net from downloading spyware onto consumers' computers or distributing software that changes users PC settings without their consent. Jared Lansky, an ad broker who disseminated ads containing Wallace’s spyware via OptinTrade, was fined $227,000 in the same judgement.

The case against Wallace represents the first federal prosecution of a spyware case, although individual states such as Utah have targeted alleged spyware operations. Wallace claims he is being targeted because of his past as a notorious bulk mailer. His firm Cyber Promotions sent millions of spam emails a day before lawsuits from AOL and Compuserve prompted Wallace to leave the company and "abandon spamming".

Actually, Wallace didn't "leave the company" so much as he went out of business because nobody would sell him bandwidth.

Also, Wallace was the primary person responsible for the Junk Fax Law, also known as 47 USC 227. That's right, before Thpammy got into spamming, he used to run a company called "Promo Enterprises" and send out junk faxes. He stole others' resources and refused to stop when businessed asked him to.

So, in short, the guy is a thief in 3 different ways over a period exceeding 10 years. I'd really like to see him land prison time someday.

Comments

[furahi.livejournal.com]

Awesome! I hope 4 mil is enough for him to change his ways...

OK, I'm not THAT naive =P

[giza.livejournal.com]

It took a $2 Million permanent injunction to get him out the spam business.

(i.e., he was told that if he sent spam again, he'd get fined $2 Million)

[furahi.livejournal.com]

I wonder what he finds so appealing of that line of businesses...
I mean, if you look at the 3 felonies he's commited, they're all tightly related

Sheesh, get a decent job already =P

[giza.livejournal.com]

The Money

[greenreaper.livejournal.com]

I like the way they wouldn't have cared so much if they had actually cleaned up the systems. :-)

Awesome!

[ionotter.livejournal.com]

Cool! Put his ass in a hole so deep, they gotta send him his beans with a shotgun!

Hmmmm. A few questions? You're far more into the workings of the networks than I am, so you're in a better position to explain something to me. I've got a lot of background in radio comms, but not in networking, so I need help with something.

I'm seriously having a very hard time understanding why some people are opposed to the tactics used by BlueSecurity?

• They aren't attacking the source computers-which may be compromised zombies or something-they're attacking the advertisers that use people like Wallace to sell their stuff.


• They give a business several chances to stop spamming their do-not-intrude list. If they stop, they don't even get attacked. If they don't stop, they get hit until they stop.


• They aren't using a broadcast DDoS, it's very precisely focused on precise targets.

What am I missing? Is this putting a strain on the networks? Is it borking someone's system downstream somehow? Is there a technical problem, of some kind, somewhere, that I'm not seeing?

I don't think you and I agree on BlueSecurity's tactics, but I really need some insight, here. I like em, but I want to know why others don't, so I don't piss people off.

Re: Awesome!

[giza.livejournal.com]

I was going to go into a bit of an explanation about how I don't know enough details about their technology. But, their site seems to be up, and I found these awesome documents:

http://www.bluesecurity.com/blue-frog/wp/solution_overview_wp.pdf
http://www.bluesecurity.com/blue-frog/wp/blue-security-overview-mjr.pdf

The stuff explained therein puts to rest a lot of the concerns that I had. For one thing, it's not a DDoS at all. A user's system sends a complaint to the spammer if and only if they receive any more spam /after/ the spammer has been given a 10 day "grace period" since Bluesecurity initially contacts them. Also, the total number of complaints sent is less than or equal to the number of spams that are sent after the grace period.

They also made a very important point about "remove lists" which is that they have not worked in the past because there is no enforcement mechanism. Now there is.

I'm gonna download their plugin and give it a try.

Re: Awesome!

[ionotter.livejournal.com]

That's what I thought the problem was.

Everyone seems to think that their system is using a DDoS!!!

I'm seeing this time and time again, over and over again, everywhere I look. It's as if sysadmins are so mind-numbingly, pants-shittingly terrified of the DDoS word, that they'll nuke anything that even has the letters "at" from "attack" in any action taken against another site.

I think BlueSecurity really needs some better PR people...

[unclekage.livejournal.com]

You have to wonder what this guy's major malfunction is.

When Giza was working at Turntide, I went to visit him. I could not resist introducing myself at the receptionist's desk as "Sanford Wallace." Word spread like wildfire and people were popping up out of their cubicles like panicked prairie dogs. *heeheehee*

[thraxarious.livejournal.com]

Ahh... 4 million... what a small pittance, hell, his advertising buddies could loan him that much from pocket change I wager. $220k for the advertisers? sheesh... Thats a tiny limp wristed slap on the wrist. wow.

I'm all for that law that says Spam mailers get fined $x per email... Are companies allowed to enter bankruptcy protection if they are found to be using illegal activities? Gods I hope not...