Just say no to bogus Messenger invitations

[z3r010]

Windows Live Messenger is both a powerful and fun communications tool for staying in touch with your friends, family and co-workers.  It is a semi-enclosed environment where you can freely interact with the people you know and trust – the people in your network. Unfortunately, over the last couple of months, we've been monitoring an increase in spammers and malware distributors trying to work their way into our customers’ networks of trusted Messenger contacts.

How Messenger spam works

First the spammer identifies potential targets.  They do this by searching for public Spaces, by acquiring lists of valid Hotmail accounts, and by trading with other spammers.  Second, the spammers set up a number of Windows Live ID accounts and use these accounts to send invitations to their potential targets.

A typical invitation looks like this:



If you accept a spammer's invitation, they can then download your list of friends to find new people to target, and send messages to you and your friends trying to attract you to spam, phishing, or malware websites. See my previous blog post on URL reputation to learn about the protections that SmartScreen® provides if you do end up clicking one of these links.

We’re working on delivering several technologies to help us reduce these bogus invitations. In fact, starting this week we are deploying a number of immediate new steps to block and root out these spammers, and to limit the number of invitations they can send. 

Don't let spammers in the door

You can take steps to protect yourself too. One thing you can do is click the View profile link in the invitation, to try to figure out if it is from a spammer or an old friend.  Viewing the profile won’t hurt you or your computer, and it won’t add the spammer to your network, so it is always a good first step.  This is like what you might do at home, if someone came knocking at your door unexpectedly. You'd probably look through the peep hole before deciding whether or not to let them in.

If you still don’t recognize this person, and think they really might be a spammer, then don’t answer the door -- and let us know by clicking the check boxes to block them and report them as spammers.



Better safe than sorry

And don’t worry about reporting abuse. Even if you accidentally report a long lost friend as a spammer, we won’t shut down anyone’s account based on one piece of feedback. In this world, it's better to be safe than sorry. You might also find these 10 tips for safe instant messaging useful.

As with all service abuse scenarios, this is another arms race.  We know abusers are motivated, and will attempt to react every time we add new protections, but we're motivated too. We’re continually working to protect everyone on the network from these types of attacks.

John Scarrow
General Manager - Safety Services

PS. If you think you may have already fallen victim to a phishing scam, check out these tools for removing malware and preventing further issues.

• • Download Microsoft Security Essentials (antivirus, antispyware)
  • Help remove malware with the Microsoft Malicious Software Removal Tool

More...

 

[TGSoldier]

These requests are getting annoying...

 

[chev65]

Yes it's clear that MSN has lost control over blocking these invitations. It's been very annoying lately and it's getting worse by the day. I hope they come up with a better way of blocking these lame invitations because I'm really getting sick of it.

 

[z3r010]

I think if they added an option to only allow people to contact you from country or countries you select, this would make a huge difference in stopping/slowing down this type of spam.

My experience with forum spam is it comes mainly from 2-3 countries and I would suspect that MSN spam will be much the same.

 

[Nem]

Indeed i'm also sick of these, each and every other day i goto open it same old spam e-mail .. First & Last name always random along with 4 random numbers at the end. :S...
finally slowed down though after a few days after i did in screenshot 2, block and report.

 

[Joan Archer]

I don't have it installed and never have, I've always been a bit worried about using it.

 

[mpcrsc562]

I like that--the info you put out.

IMHO, I would like to see that you put info out like that in a way that it is "mandatory" for visitors and members to see on a time basis that you, obviously, would set up.

Let me explain: I own Corsair ram kits for my current build and had some trouble trying to get them to run at the rated speed. So I joined the Corsair forums. I don't go there often, just when I need to. The last time I logged on, I was immediately sent to a page reminding me of the forum rules and showing any changes(s) to the forum rules.

So, for SevenForums, for members who are on daily (24/7), it would be cumbersome to have to forced to go to the forum rules or some message such as this on a daily basis, but once every other week for them? And for visitors and members who log on less frequently, in my opinion, it makes sense to maybe have a message such as this or a reminder of forum rules once a week--obviously depending upon how long it has been since last log on.

I hope I wasn't thoroughly confusing and that you kind of understood what I was trying to state.

Good day!

 

[Zen00]

I really want to compare spammers to viruses.

If they get in, get a foot hold, eventually they multiply to the point where they kill off their host (ie: cause the service to shut down) which kills them as well unless they can move onto another platform, which they kill, ad infinitum.

 

[Lebon14]

I totally HATE those UGH...
It's annoying as hell! I hope they find a good way to prevent those from joining and try to add us.