1. Keep your name and face off the most vicious attacks. The Bushes maintained credible distance and deniability about the Willie Horton attacks against Dukakis and the Swift Boat attacks on John Kerry. But McCain's name is all over the attack ads on Obama, like the one claiming that he supported sex education for kindergartners. That deadly disclaimer "I'm John McCain and I approve this message" was of course added by virtue of the campaign-finance law that is McCain's one notable accomplishment.
2. Establish your positive message before going hard-negative. Is there a McCain governing message? On foreign policy, it's war. On the economy, who knows?
3. Attacks don't have to be true, or even have a grain of truth, but they have to resonate with something people already associate with the target, and have enough proximity to the truth that the media will echo them, at least as a possibility. McCain's ads calling Obama a vacuous celebrity met that low bar; "palling around with terrorists" doesn't.
http://www.prospect.org/cs/articles?article=sympathy_for_mccain