Anti-Spammers Wage E-War

ncstockguy writes "To its credit the Hartford Courant followed up with a second article this time from the perspective of an anti-spammer." The first story was about the life and times of a spam king.

Comments

Never actually noticed....

[theRhinoceros]

From the article:

"They are every fly-by-night artist that ever wanted to place a tiny little ad in the newspaper and get away with it," Frederick said. "I have yet to see one legitimate product advertised in an e-mail that I didn't ask for."

Never thought about it before until now, but I don't recall ever having ever seen one either...

Re:Never actually noticed....

[invenustus]

In my experience, Orbitz only lets you know what's available from the airlines. So I surf around Orbitz figuring out the fastest/cheapest route, and then I hit the airlines' own web pages and book the tickets - minus Orbitz's fee.

Your experience could have been different - were you flying on multiple airlines?

Re:Never actually noticed....

[pmz]

One other thing to look our for is HTML email (gack!) with loads an image from the spammer's site. There's usually some id tag sent with the image request so that the spammer gets confirmation on your email address just by reading the email.


Ugh. This is the absolutely worst aspect of HTML e-mail. Just by sending you an unsolicited HTML e-mail, a company can get your browser model and version, whether JavaScript and Java are enabled, your IP address and hostname, the operating system, and roughly where you are located in the world (sometimes down to the city). First, they know you check your e-mail; second, in one click, you just provided a wealth of marketing information; and, third, they can tailor their future e-mail to your system's security vulnerabilities.

Does anyone know of cases, where e-mail was used to install spyware on the client?

Whoever first concieved of HTML-based e-mail should cower in shame for lack of foresight. And all those who chose to implement HTML-based e-mail clients should also cower in shame. HTML-based e-mail is simply irresponsible. I'm simply tired of people who insist in making their e-mail pretty, while unknowingly sacrificing their privacy and security.

Re:Never actually noticed....

[lightcycler]

(re: unsubscribe links)

-- many times, you can have some fun with unsubscribe links: They fall into one of three categories:

(1) a page which takes an email address, checks if it's on their database, and if so, tells you it's been removed.

(2) a page which takes an email address, and displays "Your email: <WHATEVERS_IN_THE_QUERY> has been removed from our database" - you can check this by entering something which isn't an email address into the query.

(3) Same as (2), but it writes down the email you want unsubscribed, and makes it available to the spammer.

Option 3 is the most fun, because you can feed it your own set of email addresses. They probably filter all the microsoft ones, but I'm sure hollings@senate.gov is starting to see how internet marketing works...

Similarly, I'm sure they filter uce@ftc.gov out of their lists, but if you know the sales@company.com email addresses of people who advertise through bulk email, this can be a good time to mention them.

After all, you're only removing these peoples' names, right?

Re:Never actually noticed....

[letxa2000]

What I hate the worst is that most of the spam I get has some lines that say it's not spam

I used to hate that. Now I love it.

I modified my SMTP server to look for certain text that is a dead give away for spam.

My SMTP server now hangs up on the INCOMING CONNECTIOIN as soon as:

1. Any mention is made of that bogus "spam law" never passed by Congress.

2. Mention is made to "this mail not being spam," or any of a dozen permutations of that disclaimer.

3. A list of 100+ (and growing) websites or companies are mentioned in the incoming message.

4. A list of a number of contact phone numbers or addresses are detected.

5. Any word sequences that would only be used by spam are detected.

The cool thing is that I have my SMTP server HANG UP the connection before the mail is even completely delivered. My opinion is if they succeed at dumping their load and disconnecting, they've already won even if I filter it out later. I want to detect it when it's coming in and hang up the phone right away.

It's fun looking at the sendmail log and seeing dumb spammers trying again and again to deliver their BS, only to get hung up on again and again.

My spam has gone from about 30-50 per day down to around 5. And every time a new one makes it through, I analyze it and it gets added to the sendmail spam filters, never to get through again.

Life is good.

I feel so used...

[ackthpt]

Someone used my email address (I live in California) to spam people, I received a number of bounces in my mail box. The spammer's phone number is in Washington state and I did a little review of the Washington state law (a helpful link, but not sure it helps me. Further, the Washington AG's site isn't currently accepting complaints due some vulnerability (guess who probably took a crack at exploiting that?)

Sign me up for the war, want revenge for this, feel free to advise.

How to Stop Spam

[fortiter1]

Yes, most ISPs terms say that you can't send spam. That's not enough. The terms should mandate a fee of $1 for every email address you send to if it is determined you sent spam. That way, if they want to send out spam their credit card would automatically get charged. Make the spammers pay for sending out their junk.

Some of us go to great lengths

[SkyLeach]

to stop spammers.

I have an account I purchased from spamcop.net. I never used the email address onything (i've never even checked it) and it's bounsing spam every day.

Spammers hack systems to get accounts, they harvest them, they buy them (illegally) from state agencies. These people are scum and I consider it my right, duty and priviledge to take them out whenever and wherever I can find them.

I am in the process of building a snort utility specifically designed to track down the home IPs of spammers (in the US at first).

I won't go into details on what I plan to do when I get some, but rest assured it will be neither pretty nor legal.

How to stop spam?

[the_Bionic_lemming]

All an ISP has to do is inform their customers that any e-mailings of over 50 addresses will be reviewed and placed on hold for the customer to acknowledge that it is indeed their e-mail going out. After it is acknowledged, if it is an advertisement or spam, that e-mail will cost 1 or 2 cents for each address it's being sent to.

Unfortunately, this doesn't address the torrent of spam from China, nor the Nigerean Millions waiting for a bank acount spam, But at least it would be a start.

Legitimate products through spam

[NotesSauceBoss]

Though famous for being an industry of fly-by-night operators, mystery shopping (also known as secret shopping) is an example of an industry in which users are spammed on a fairly broad basis with legitimate opportunities.

I used to work in the industry, and while we'd never send mail on the 80-million-a-day scale that some of these guys do, we'd certainly send half-a-million in a given day, to broadly scattered email addresses. We always made a specific point of keeping the email small (under 1K) and it was *very* clear who the source of the message was (never luv384j6@h0tmail.com).

The mail itself invited the recipient to sign up as a mystery shopper, which would give them the opportunity to get paid to evaluate services in their local neighborhood.

Unfortunately, in a world of snake-oil salesmen, we took a lot of grief for the approach, even though it still paid for us to do it. Because the offered product (which was really a part time job offer) was legitimate, we never attempted to disguise the identity of the source. Bounced mails were automatically flushed from the database. Removal requests were honored. The advertising business was tracable. (Our address, phone number, president's name and industry association registration was on the first web page link in the message.) But because of all the charlatans out there, we were taken to be just one more instance of spam -- which in some sense we were, but with at most a tiny fraction of the rudeness which permeates the practice.

Why bother fighting? Here's why

[zaren]

"It's really theft of services. It uses my connection, my equipment and my in-box, which I pay for," Roth said. "With postal mail, the sender pays for it. With spam e-mail, the receiver pays for it. Big difference."

People will say that spam is the same as junk snail mail, but it's not. "Legitimate" junk snail mailers will happily bear the cost of sending their messages, knowing that they are advertising a legitimate product or service. Spammers push that expense off on the people receiving their message.

To further the theft of services concept, an overwhelming majority of spam is sent through open or unsecured mail relays. This means that people who have no legal right to use those services are using them, much like someone who splices into an apartments building's cable tv system to get free cable. And as I always point out in my spam complaints, there's always this little gem:

Advertising via unsolicited e-mail is trespass to chattel and theft by
conversion. That was established in Federal court in 1996/97 in Compuserve
vs. Cyberpromo, heard in US District Court in Ohio by one Judge Graham.
Spammers routinely also use third-party relay, which is outright theft of
services and a violation of the Federal Computer Crimes Act, to wit,
unauthorized access to a computer system.

-----
Darwin is an evolutionary OS...
--
Apple hardware still too expensive for you? How about a raffle ticket?

Re:Valuable Products?

[Foggy Tristan]

Yes. They do.

Scott Adams in the Dilbert Future actually hit the nail on the head on this topic.

Suppose you spam 1,000,000 e-mail addresses, and 1/2% are stupid enough to fall for it. That's 5,000 responses, from people willing to fork over money for your bogus or not-bogus product.

Given the cost of spam, it's no surprise it's so prevalent.

Spam-fighting hiatus to raise awareness

[andyNola]

> "People are going out there and
> tracking it back down to the source,"
> Mozena said. "Without that constant
> fight, things would be a lot, lot,
> lot worse."

Does anti-spamming really work? The administrators and users of SpamCop, SpamAssassin, etc. should back off for one 24-hour period. Let the spam roll in. If it truly would be a "lot, lot, lot worse" without spam-fighters, the happy fallout will be that thousands of indifferent users who respond to spam with "JHD" (Just Hit Delete) will see how bad it's become. Maybe they'll join the spam-fighting ranks, or at least demand a solution.

The answer

[Technician]

Due to the massive abuse, e-mail may simply become a thing of the past. I am gradulaly moving to a web form and dropping e-mail. To write me, visit my page and fill in the online form. I'll soon no longer have an inbox.
As inconvienient as that is, it fixes most of the problems of the e-mail system. Mostly it will not accept any bulk mail from anybody.

I just can't do that

[Sycraft-fu]

Unfortunately I can't afford to be quite so idealistic. I've had people call/mail me that are offering services that I someday want to use. I wouldn't have internet accesses if I went by that motto since the cable company, the phone company and Sprint (they do wirless internet here) have called me to try and sell me stuff. Unlike SPAM, I find that people are actually offering me (or at least are companies that have offerings) something that I want. I don't think I've ever bought from a sales call, but I've bought form companies that make them.

However I find SPAM very different from telemarketing/bulk mailing for several reasons:

1) The telemarketers/mailers are 99.9% of the time legit bussinesses offering legit products. When Cox calls to sell my high speed internet access, they aren't playing around, they can and will make good if I want. When I get a book of coupons in the mail, I can really go and use those for the products on them. SPAM is fradulant so often it's not even funny.

2) Also, with classic methods, the sender pays. The company calling me is paying for the long distance time, the mailer pays postage. It doesn't cost me anything other than wasted time (and there is plenty of stuff that does that). SPAM costs me money, which makes me angry.

3) However BY FAR the most imporant reason in my mind is that when you ask a telemarketer/bulk mailer to quit, THEY WILL. Since they are real, legit bussinesses and DON'T want to get sued, they'll obey they laws and stop contacting you if you tell them they have to. When a telemarketer calls you, ask to be placed on their do not call list, they have to maintain one and you can sue tehm if tehy call you again (unless you buy something from you, then you have a bussiness relationship so they can contact you if they like). Also a lot of companies get your address from teh credit reporting beuarues. SO call up Equifax and ask them to stop giving it out. They'll tell you what you need to do (submit a request in writing I think) and then they will, and pass it along to the other two.

It really is the unrelenting, fradulant nature of many spammers that gets me. For the longest time I got a ton of spam from a place that wanted to allow my bussiness to acept credit cards. Well the thing is I don't HAVE a bussiness, and I already have service to accept cerdit cards anyhow. No matter, these assholes spammed me 2-6 times PER DAY. And of course they didn't say who they were or anything, just asked you to e-mail them (to a yahoo address) with a name and phone number to call.

Stuff like that really pissess me off, I eventually had to resort to a technical solution to make them stop. However when AT&T long distance was pestering me (about 1 call every 2 weeks) I just told them to put me on a DNC list and I've never heard form them since.

Re:I just can't do that

[BrokenHalo]

I used to get (until I changed my primary email address) an awful lot of spam directed through Sprint. I found that when I complained to Sprint about their delinquent users or open relays, my only response was more spam.

Since I am in Australia, and no-one I know uses Sprint, I now have a permanent filter to blackhole any mail originating from a Sprint domain.

Blocking spam is one thing...

[Neph]

I've started to have a much more aggravating problem -- spammers using the email address of an old account of mine for the From: of their spam! I know because undeliverable mails are being returned to me. Is it just me, or is this a new low even by spammer standards?
I'm in the middle of dredging through the headers trying to figure out what the company ultimately responsible is, but even if I manage to find out, I'm not sure what to do with the information. I want blood.
Any suggestions?

ban junk mail as well

[sugrshack]

actually I'd like to add junk mail to the mix; I have to pay for garbage disposal, and it actually costs almost as much as server space to get rid of, not to mention the damage it does to the environment.

don't think it's a problem? just try joining your local chamber of commerce and see how much junk mail you'll receive every day! Even if you quit, it keeps coming in. My house is a mess.

Re:problem with opt-in

[Nonesuch]

sugrshack writes:

ndeed this sounds like a noble and fair approach, but it's much more of an ideal-typical fantasy; one of the big problem of the so-called "opt-in" lists is that once you are on one, you can never get off; largely because the "companies" (read: spammers) that gather these addresses, sell them to others. This is why they do it in the first place.

My solution

Get your own domain 'sugrshack.org', and set up an MX record for 'lists.sugrshack.org' pointing to some static-IP Unix-like machine where you can set up a virtual SMTP domain (e.g. Qmail).

When you visit ZDNet and subscribe to their mailing list, you subscribe as 'zdnet@lists.sugrshack.org'. When a mailing list starts selling your address and refusing to honor unsubscribe requests, you simply stop accepting email for the one address 'zdnet@lists.sugrshack.org', and the problem is solved.

There are a few complications to this approach. The biggest hassle I have is that I do need to post to several lists that restrict posting to 'members only', which means I need to adjust the 'From' address on outgoing messages to reflect the address with which I subscribed.

I don't have to worry about forgetting what address I used when subscribing, as Qmail will included a 'Delivered-To:' header for each message received to a virtualhost/alias.

Another drawback is that I get even more spam than before (identical spam runs addressed to each of many aliases). However, spam sent to 'expired' aliases is easily filtered out and discarded.

Spam Interceptor vs. Spam Wrangler

[Ace905]

The article talks about a SPAM Swat team ; and the concept of that is absolutely rediculous. When it takes teams of people to shut down spammers, the Spammers have won. That might work for the time it takes to do the article - but it is not a 'sustainable' activity. These SPAM swat teams aren't going to exist forever.

What needs to happen is the Email protocol needs to be re-written. It was originally developed in RFC822 to be an open standard that could take on many forms and purposes.

Today, we know how Email is used intricately, and the protocol can easily be re-written to *ENSURE* Spammers do not have the ability to automate spamming.

My company is re-writing the protocol over the next year or so ; and our changes will made available to the world.