Slashdot Mirror
The Measured Effectiveness of Blocking Asian Spam
fadden writes: "I recently started blocking IP addresses in China and Korea that were sending me spam. Instead of a blanket ban, I only blocked the subnets from which spam was being sent. After my first week of scanning and banning, I wrote up
a report on the effectiveness of the blocks." In related news, SSKennel adds that: "The U.S. Federal Trade Commission has discovered (prepare to be amazed!) that revealing your email address in chat rooms can get you spammed. It claims to have taken action against spammers who harvest email addresses and use them to send fraudulent spam." Shocker!
A resounding DUH arrises from the competent computer users of the world.
that Canada is indeed just above us on a map.
about you know how shocking it is that revealing your e-mail address in a chat room will get you spammed. But I think the poster already kinda did that. /me ponders getting a job at the FTC telling them all sorts of things they don't know. Like how signing guest books with your real e-mail address will get you spammed, using AOL will get you spammed, using hotmail....
The GeekNights podcast is going strong. Listen!
Subject says it all. I block so much spam by using spews.
On the other hand, 15 or so spams a day (in a language I don't even understand) every day is a major waste of bandwidth, and as irritating as hell.
What can we do about this nusiance?
-- And when Justice is gone, there is always... Force. --Laurie Anderson, "Oh Superman"
I prefer Group Spam and Teen Spam with the occasional Anal Spam. To Be honest, I am kinda sick of the Asian Spam.
And AS for effectiveness! That stuff works all the TIME.
I'd just like to know if it's still safe to post your email address on Usenet?
sig:- (wit >= sarcasm)
We've had to block a number of Korean & China-based IP's in recent months (especially during the Summer). In addition to blocking a number of temporary (PPPOE and such) IP's by domestic service providers, (read: Comcast), the foreign IP's seem to be more static, but also offer a higher quantity of spam. (Are a number of these just open relays?) Though, in our case, it's usually short-lived. Except for Klez, which is the devil.
Good point about the pig singing. While Comcast is extremely unhelpful (bordering on incompetent), foreign ISP's don't face any accountability. There's no decent legal recourse. So blocking the IP is the simplest route.
Has anyone else seen a significant amount of spam from Brazil? Where is the onslaught of OSS Bayesian filters?
Those who would give up Essential Liberty to purchase a little Temporary Safety, deserve neither Liberty nor Safety
I started blocking off all Asian Pacific networks about 6 months ago. I wrote a quick Sendmail tutorial about it right here.
How well does this work? Extremely well. I've gone from receiving 20 pieces of SPAM a day to only 1 or 2 (which Spamassassin typically catches. I realize that this method won't work for everyone, but it has worked out quite well for me.
--It's Pimptastic!--
"The U.S. Federal Trade Commission has discovered (prepare to be amazed!) that revealing your email address in chat rooms can get you spammed. It claims to have taken action against spammers who harvest email addresses and use them to send fraudulent spam." Shocker! "
Revealing your email address on Slashdot can get you spammed. You may have noticed my sig says "Sig: I'm performing an experiment on the origination of SPAM, don't email me.". What I did was I set up a junkmail box and pointed my Slashdot email address at it. The only place this address has ever been made available is in my user address that is displayed whenever I comment. When this address is e-mailed, it automatically responds with "thanks for the unsolicited mail!" I don't read the messages unless somebody responds to it.
What prompted me to do this was the 'armor plate your email address' feature in my user settings here on Slashdot. It made me curious if having my e-mail address viewable in the comments I make would mean I'd recieve lots of Spam. My curiosity is satisfied: You can get a good deal of SPAM if you don't use the 'armor plating'.
You know what? They don't just look for e-mail addresses to send mail to. They also use the e-mail addresses as reply-to addresses. I found this out when I got an email from a guy who was puzzled by my auto-responder emailing him. It turns out that somebody sent a message to me and used his address as a reply-to address. Weird, Iddn't it? Fortunately he was very nice and we got that all settled, but it is a little disconcerting that the addresses are used in ways like that.
When I first started this experiment, I responded to the messages I got. I accused one guy of harvesting my address without really reading what the message said. Turns out, the guy ran a mailing list for local (to him) volunteer firefighters announcing a meeting. This wasn't the type of event that somebody would 'direct market'. Heh. Evidentally, somebody volunteered my user address only displayed on Slashdot to his list. How weird is that?
I am extremely curious if anybody has any insight into the motivations of people who'd use email addresses in these ways. I can understand somebody using my email addie as a reply to address, but I have no explanation for why somebody'd volunteer me for a volunteer firefighter's list.
If you're running Outlook 2000 or XP - Cloudmark is a nearly PERFECT solution to Spam - and IT'S FREE (for now, at least).
And probably lots of legit mail too, unless you have a tiny mail server. SPEWS is an awful choice for large commercial services, they subscribe to the "throw the baby our with the bathwater" theory. They are ever more clumsy and heavyhanded than ORBS was.
perl -e 'print $i=pack(c5, (41*2), sqrt(7056), (unpack(c,H)-2), oct(115), 10)'
I've invested significant money some years back in a domain name so that I could give my clients and friends an easy to remember, unique email address. I consider it a significant investment, because it looks good on a CV, business card, or letterhead, is easy to remember, and it cost me time and money to establish it.
However, a number of spam companies have picked up on my email addresses at that domain, and have distributed it on a number of those unpteen-million address CDs sold to other spammers. I recieve over 100 unsolicited emails a day. Now, I try to filter them with software filters, but due to the hit-and-miss nature of heuristic filters, legitimate mail is deleted on occasion.
The way I see it, my unique and expensive email address has been devalued by these spam companies, because the whole point of buying that domain name was so that I could use it publically. If I have to keep it a secret to avoid spammers, it is worthless! I can't even use it as an example while writing this article, because it would be picked up by yet more spammers.
I wonder why nobody has tried suing along these grounds. Think about it: If some company had invested time, money, and effort into setting up a toll-free hotline for their customers and/or clients, but had the service ruined by telemarketers jamming the system with 100x more junk calls than the real calls the company recieves, the next outgoing call would be to a lawyer!
The /. crowd always seems to be talking about how huge the Asian spam problem is. So as an experiment, I've been keeping my spam in a separate folder for a few months, and less than 3% of it is Asian in origin (counted by relay server used AND the spammer itself). Over 70% of it, originates in the USA, and are mostly USA cons/scams/pseudo-products etc (diplomas, anti-spam software, spam software, porn sites, "hot strock investment advice newsletters", "work at home", MLM etc, "lose weight", search engine 'promote your website' offers etc).
Why the discrepancy, am I just an outlier, or are slashdotters exaggerating the non-US-originating spam problem in relation to the US-originating spam problem?
Worse - How in the hell did they find out about my childhood family orgies?!?
----------------------------
Esobofh - Currently drinking fresh mango juice.
Yes, there is a difference between regular spam and the fraudulent variety. Normal spam is sent by well known "bulk mailers" (as they call themselves, in a pitiful attempt to legitimize their business) on a contract-for-hire basis.
They send email directly from their own systems to your mailbox. They do not fake their headers, use open relays, hijacked proxies or root'ed boxes of other people to send out their messages. They generally have contracts with their ISPs to not cancel their connectivity as long as they have some type of proof, no matter how vague, that the mail *might* be considered opt-in (and as long as the complaints aren't too frequent. These people do listwash their own lists, if only to stop spamming people who actually complain about it, and also to show to their ISPs that they have an effective opt-out system. Their spam is annoying, but currently legal.
Fraudulent spam, on the other hand, is completely different. These are the people that hijack other people's machines to do the dirty work, rape open relays and consume all of their bandwidth during spam runs, actively probe for open relays and proxies, forge everything they can in the headers, study SpamAssassin and other filters in an attempt to craft messages that don't "look" like spam. These are the people that use their opt-out lists as a source of revenue (by selling the names to other spammers), and will frequently joe-job spam activists and others who complain too loudly and to the wrong people...
The first type of spammer sends out insurance offers, cell phones ads, inkjet ads and such. The second type sends out virus/trojan laden messages, porno by the bucketload, ads for illegal drugs, etc.
Both types of spam are annoying, but the "fraudulent" type is much more so because of its immoral content (and anyone who thinks that sending pornographic images to children isn't immoral should quietly remove themselves from the gene pool) and also because of the theft of services (bandwidth, hard drive space, etc.) from the relays and proxies that they abuse.
Oh Marge, anyone can miss Canada on a map, all tucked away down there.
--Homer
--
"Outlook not so good." That magic 8-ball knows everything! I'll ask about Exchange Server next.
...does it help to suggest that the spam in question is perhaps not originating from Asia, and is more the result of lax relays?
The spammers are outside of Asia, and simply target open relays where ever they find them.
The stats by the submitter show that most of not all the mail is in English. That should tell something about the true origin of the spam.
If the open relays were closed, the spammers would move to other hotbeds. Let's work to educate the admins in Asia, and force the spammers to back off using open relays.
I know that Spam Assassin is a bit resource hungry, and isn't practical for large scale operations
Au contraire, if you're clever about it, SpamAssassin works great in large-scale operations. In conjunction with MIMEDefang, people use SpamAssassin to scan a lot of mail -- over 1 million messages/day in two sites I know of.
I hate spews. spews is everything that is wrong with anti-spam work.
There is no way to get off of the SPEWS blacklist, and if they black your entire NSP for one of the NSP's customers... tough luck for you. You can post to a usenet group and beg, and they wont do anything other than tell you to break your legal contract and go elsewhere. 20 people will harass you, and you can't even know which one to listen to.
SPEWS can rot in hell. A properly configured SpamAssassin will block 98% of spam and have 0.01% false positives (I haven't gotten one false positive in a year, but I will someday).
SPEWS is NOT how one prevents spam. SPEWS is how one pisses off the people trying to mail them.
I can't stress enough how much I hate SPEWS and how much it should die.
Please, please don't support SPEWS. I beg you.
One person's "Duh!" is another person's "Huh?"/
Since a few people are posting about anti-spam methods, I thought I'd go over my idea to counter spam. Currently I am not actually using this procedure, I have just been pondering it for awhile.
/dev/null. Ahh, a life of no spam!
First off, the core of this system relies on whitelist-confirmation. This means that first time senders are given an auto-response email which must be "confirmed" in order for their message to deliver. Once they have done this, they are whitelisted, and all email from them passes through. TMDA is what I use for this job. I leave my email address "unarmored", because no spam can get through. When I check my mail in KMail, there is no spam.
However, all is not perfect. After many many months of using TMDA, I still find myself sifting through the "pending" folder on my mail server, which keeps hold of all the mails from unconfirmed senders. I generally do this every couple of weeks, and there are often at least one or two legitimate emails that were never confirmed. There are many possible reasons: 1) they thought the confirmation request was spam, so they deleted it (either manually or through an anti-spam filter). 2) they don't like the idea of having to do a stupid confirm (although no one has actually brought this up to me yet). 3) Maybe they use a reply-to or something weird that trips up TMDA (perhaps fixable or not..)
Anyway, the point is that legit emails aren't 100% getting through. The next consideration then, is to use a word-filter (and who knows, maybe TMDA does this too), to see if legit mails can be detected by their content. Maybe this could be done using a bayesian (sp?) filter, as recently discussed here, or perhaps SpamAssassin. Emails detected as legit would be delivered directly, and the sender would be auto-whitelisted. Ambiguous emails would go through the usual whitelist-confirmation procedure. This way, the word-filter never actually throws email away. It gives the sender a second chance, by sending it through the whitelist system.
This, I think, would solve the problem completely for me, as all of the legit mails that wind up unconfirmed would very much pass the legitimacy test (they mention a software project of mine, or something else very obvious). If this were in place, I could send my pending bin to
Regards,
joe
P.S. Add your friends to the list also! You don't want them missing out too, do you?
I also have a catchall so anytime I order something or fill out any other online form I use "the domain I'm browsing"@mydomain.com, that way if they give it out I can tell.
I like to use the form me@"the domain I'm browsing".mydomain.com. That way if the address ever gets too inundated with spam, I can delete the DNS record for it and not even have to see the postmaster notifies for it. It also wastes a minumum of my bandwidth (1 DNS NACK packet vs. an entire SMTP conversation).
t's our servers, we can block *.* if we want to.
I do this and I have found it to be extremely sucessful.
Since I did this I haven't got a single spam email.
It also stops annoying people who have my email address from contacting me.
A lof of spammers *do* use these HTML mail tricks. However, a lot of plain users send HTML mail, often without knowing it, because Microsoft mail programs send HTML by default. So if you want to read HTML mail safely, do this: block your network connection while opening it. You can unplug the cable, take the mail program "offline", hit the "stop" button on ZoneAlarm, whatever. This won't cause problems with legit HTML mail, because the HTML is usually just for fonts and stuff. But it keeps the spam messages from "phoning home" successfully to get their graphics.
...even if you've naively left your e-mail address listed as the owner contact for your domain for years like I did. A three-pronged approach:
;-) manages to sneak through.
1) IP-level blackholing of certain large subnets, as I like many others virtually never get any legitimate email from China or Korea, and many of the craftiest fake headers ride on brand new Chinese and Korean open relays. In case of emergency, people there can always use Yahoo or the likes - and I suspect many Chinese and Koreans who communicate with people abroad are already used to doing just that, as blackholing is becoming more and more widespread.
2) RBL's. I personally use bl.spamcop.net and relays.osirusoft.com. These catch 99.2% of "quasi-legitimate" spam, and about 65% of the open-relay spam not caught above.
3) Heuristic tagging via Spam Assassin/procmail/filters/etc as a last line of defense. I personally use a filter file that I edit pretty much every time a POS (piece of spam
This is obviously more aggressive than many people can afford to be, but it's a viable solution for someone with a low signal-to-noise ratio and a high irritability ratio.
A few months ago my spam level reached the point that made me do something about it. After looking carefully at all the headers, I concluded that about 80% of the junk (mostly from Asia) came from IP addresses with no reverse DNS database entry. (The IP did not resolve back into a hostname.) Just about all reputable mail exchangers have a reverse DNS entry. (The ones who don't are run by the clueless.)
/etc/hosts.deny /etc/hosts.allow file with "sendmail: KNOWN". (Make sure "sendmail" equates to 25 in your /etc/services file.)
/etc/hosts.allow file. (e.g. "sendmail:66.187.232." will allow mail from RedHat.)
I decided to use this to my advantage. You can too.
If your sendmail daemon uses the tcpwrappers library, you can create a
file with "sendmail: ALL" and a
Doing the above will cause your mail exchanger to refuse incoming mail connections from any host with an unresolvable IP address. It will cut up to 80% of your spam.
For the clueless ISPs, you can add exceptions to your
I wish more people would do this.
I did some math on my spam before and after. Now the average promised penis enlargement is 326% instead of the usual 509%
Table-ized A.I.
So do you add another DNS record for every site you visit?
Seems like a big hassle on the management end.
The man who trades freedom for security does not deserve nor will he ever receive either. - Benjamin Franklin
If you run SpamAssassin after the MTA, sure, the cows are out. Better to run SpamAssassin integrated with your MTA if possible, which can be done with Exim, Sendmail, and possibly others. Doing spam checks at the MTA level also lets you look at the mail envelope data and similar that SA cannot check on.
Granted, you tend to have to run your own mail server to do this, but hey...