Slashdot Mirror
Dictionary Spammer Fined $55,000 for Spam Attack
Lawrence_Bird writes "In a first, a Japanese district court has ordered
a spammer to pay restitution to NTT DoCoMo for abuse of their imode system. 'The damage caused by large amounts of e-mail not reaching their destinations should be covered by the sender,' said the judge. The fine is about $55,000 and was based on an estimated cost to NTT of 1.2 yen per undelivered spam ($0.01) for the 4 million spams that were undeliverable. What is most startling is NTT DoCoMo assertion that of the 950 million emails
they receive each day, 880 million are not deliverable!"
n/t
here
Just think - becuase of one person, 880 million people didn't get their daily dose of heniti (sp)!
If only there were more rulings like this one, maybe it would make spammers think twice if they knew they could be fined.
I want to see this guy fined per DELIVERABLE message aswell though.
Last.fm - join the social music revolution
First bit of spam in this forum for you.
There definately needs to be more rulings like this.
that's even better than dumping tons of junk snail mail on him!
I think that it should be clearer that those 880 million are sent to *non-existant* addresses. The slashdot article makes it looks like that their infrastructure can't cope...
Rus
Cheap UK and US VPS
They tried to email the judgement to him but for some reason thiscouldbeyou@riches.await.com kept bouncing...
Be you Admins? nay, we are but lusers!
At last, a profitable business model for AOL!
as someone who recently had an email server relay raped (we didn't think it was accessible to the open, turns out someone had misconfigured it), and knowing full well the time and stress I had to sort it out, this is great news. Although, i'd have preferred five minutes in a sound proof room with a baseball bat, but hey... It's about time people realise that stuff like this has very real consequences...
A great ruling!
Basically the spammer was trying to send large amounts of spam to Docomo's mobile phone users. Mobile phone users are charged for receiving emails. Since 1) many of the spammed users don't exist and 2) it was unsolicited commercial email, it only makes sense for the spammer to pay!
I say we should send these morons a one-way ticket to Iraa muahahahaha!!
eTrade SUCKS
That's why all my emails to goatse.cx aren't getting there!
There's a growing sense that even if The Future comes,
most of us won't be able to afford it.
-- Lemmy
Now if only more countries would do this kind of thing - recognizing that spam has a financial impact on ISPs and on the end consumer, and that especially mass "dictionary" based attacks to randomly find accounts are the internet equivilent of dropping millions of leaflets from an airplane for advertising purposes. (In which case they'd be rightly charged with littering and other offences.)
Plus they got zapped for undelivered email - avoids the whole "opt in/opt out" argument (difficult to prove always that someone didn't accidentally "opt in" at SOME point and you KNOW the spammer is going to claim that they did) AND it also is likely far more costly than targetted spam attacks. (If you send to a 90 percent valid email list chances are you are sending to a few hundred thousand addresses. You do a dictionary attack you are sending to MILLIONS of addresses... which would you rather see them get charged cash for?)
It's a good start if you ask me (though of course part of me thinks that locking them in a small room with one angry ferret per 1000 emails would be a good way too... but that might be going too far. Probably. I mean, think of the poor ferrets?)
Bvardi
I have heard about people suggesting of putting a price per email for sending, However, It seams that it would be better to just charge for undeleverable email, Which is rare for a casual user to have undeleverable mail anyway.
Assmunch.
Of the dozens of spam messages I get every day, at least 20% of them are unreadable. I'm not counting the ones that are in languages that I don't know. I'm talking about the ones that are sent in an encoding that isn't properly reflected in the headers. Then there are the ones that are in such poorly formatted HTML that they just won't display.
The net will not be what we demand, but what we make it. Build it well.
The "spammer" has a legitimate business activity. You may not like it, but he has a right to advertise. If you don't want to receive his advertisements, then stop being so tight fisted and get some blocking software.
All this company had to do was publically list all valid email addresses. Then the spammer would be able to read that, and only send to names on the list. This would benefit both parties, due to there being fewer lost emails for DoCoMo, and the advertiser would be sure that every one of his messages went to a valid account. This way everyone wins.
I long for the day those fines are so common they don't even make it to /.
That has a nice ring to it here in the states.. It makes perfect sense. I wished I had thought of it first...
Let the lawsuits begin!
-ProzacGod
I have to pay for someone elses shit showing up on my cell phone ($.02/message), or have to pay for bandwidth download messages ($1.50/min via satellite phone connection). So fuck the SPAMMER, he can send me all the advertising me wants as long as he reimburses me for bandwidth, time, wear-and-tear, etc. costs. People like you are fuckwits and should be shot for those ideas.
father?
>
Blocking software for a mobile phone?
You are aware, I trust, that the email clients for these phones are built in, and cannot really be user modified, right?
>
You mean, like, the phone book?
I can't live without seeing my daily share of tentacle rape! Whatever will I do?
To make laws that man cannot, and will not obey, serves to bring all law into contempt.
--E.C. Stanton
yeah, moderators have a right to exist, BITCH!
This kind of mass mailing should be treated the same as a deliberate denial of service attack. Dictionary spammers tie up target servers without any reasonable expectation that most messages will reach an actual user. It is a consciously malicious act, and should result in criminal penalties, including prison time.
When all you have is an axe, everything looks like a grindstone.
DoCoMo investigations found that about 950 million e-mails are sent to i-mode users each day, but about 880 million of these are sent to addresses that do not exist.
[lounge]
Now that's what I call a lazy database admin!
*rimshot*
[/lounge]
"I only speak the truth"
Karma: null(Mostly affected by an unassigned variable)
Japan has sued the peoples republic of china for 10 trillion dollars - the chineese government says that they were just pursuing japaneese ad makers
I choose whether or not to receive messages. The choice is all or nothing, but I have that choice. If I want to receive messages I want I have to get messages I don't. The company provides the service if and only if I ask for it. If I ask for it, I pay for it.
The "spammer" has a legitimate business activity. You may not like it, but he has a right to advertise.
If that's how you feel, then I'm going to advertise my auto glass service by tying an ad to a brick and throwing it through your car's windshield.
If you don't want to receive his advertisements, then stop being so tight fisted and get some blocking software.
If you don't want to receive my ad-bricks, then quit being so tight fisted and get a garage.
All this company had to do was publically list all valid email addresses. Then the spammer would be able to read that, and only send to names on the list. This would benefit both parties, due to there being fewer lost emails for DoCoMo, and the advertiser would be sure that every one of his messages went to a valid account. This way everyone wins.
Just how does some guy "win" when his cell phone is spammed? How does he win when it wakes him up at 2:30AM to tell him about herbal viagra, multi-level marketing schemes, or "miracle" diets? How does he win when he is billed several dollars a month to receive the ads? How does he win when he can't have his phone turned on because it announces a new spam ever 26.3 seconds?
What a fucktard you are.
It's about time someone set a precedent in determining the cost of spam. Not just in terms of denial of service, but also the amount of time it takes people to deal with it.
Many people don't realize what a hassle spam can be, until you try to put a monetary cost on it. Let's forget about the resources it uses and just look at how much time it consumes to delete... For the sake of using round numbers, let's say it takes someone 5 seconds to identify a message as spam and delete it. That means in an hour they can theoretically delete 720 pieces of spam. I don't know about the rest of you, but I regularly receive about 100 pieces of spam on a typical day. That means that about 2.6% of your paycheck goes towards you deleting spam. For an employee that makes $50k/year, this comes out to approximately 3.5 cents per piece of spam received, or $1277/year...
If their mail servers are swamped with 880,000,000 emails daily from dictionary attack, I'd think the easiest solution would be to throttle the mail servers. "Oh, I got an invalid recipient, I'll pause 5 seconds before I respond." (Adjust 5 seconds to whatever makes most sense) For most legit users, that shouldn't be a problem. For the spammers, it means they can make at most 17280 attempts per day per MTA.
trollllllllllllllllll ... you should wake up and realize you are a troll and everyone hates your pasty white ass. BITCH
Anybody have a link on how to configure sendmail to not log/respond to email destined for addresses that are not on your server?
Maybe i'll move to Japan when things get too ugly under the Ashcroft regime! Guess i'd better learn Japanese just in case - time to watch more anime!
The only thing necessary for the triumph of evil is that good men do nothing.
could dictionaly spamming count as a denial of service attack? (even if it isn't big enough to actually take down the service)
From the /. post:
... each day, 880 million are not deliverable!
The fine is about $55,000 and was based on an estimated cost to NTT of 1.2 yen per undelivered spam ($0.01) for the 4 million spams that were undeliverable. What is most startling is NTT DoCoMo assertion that
If this is true, doesn't that make the cost of spam to NTT DoCoMo around $12M per day, or $4.4Billon per year.
This seems a bit much, although I agree with the size of the fine - I'm just questioning the way it is rationalized.
- Brian.
I like the verdict and think that the fine is appropriate, but I don't like how it was calculated. Maybe the article misrepresented it, but charging $0.01 per spam seems excessive.
The article says 880 million undeliverable emails are sent every day. At a penny a piece, that's USD$8.8million / day, or $3.2 billion/year. The company does $42 billion in sales per year, I doubt that they spend 7.6% of their income on spam. Or, for that matter, give me $3b/yr and I'll provide the equipment to totally filter all of their undeliverable mail -- they'll save their shareholders $200 million!.
I just wish they said "it cost us 1 man-year of work to stop this guy" and cost it that way instead of making up numbers per message. It's this kind of unjustified damage estimate that "cost" sun $80 million of money that was good enough to tell a judge under oath, but too bogus to tell their shareholders. A doubt NTT has a $3.2b line-item on their annual report.
(and, as others have pointed out, this 880milMsg/day is misaddressed mail - trivial to filter out and it never consume any expensive RF bandwidth)
HIV Crosses Species Barrier... into Muppets
On a somewhat related note, while we may not see opt-in mandated for a while, I'm sure companies will be quick to adapt:
By signing up for our free Britney Spears subscription service, you ackwnoledge you have agreed to our draconian privacy policy which allows us to sell your personal data to anybody we want and spam you from now 'till doomsday. To activate your account, we will send you an e-mail shortly. The spamming will begin soon thereafter.
This is one of the reasons why legislating a technical problem won't make it go away--there's always a loophole; and it takes longer to fix a legal loophole than it does for Microsoft to fix their bugs.
!#@%*)anks for hanging up the phone, dear.
Lawrence_Bird writes...
Who would have thought that Larry Bird would be spending his retirement years posting on Slashdot...
__ Someday, but not this morning, I'll finally learn to use the preview button.
DoCoMo has the right idea we need money from spammers
... Thats where I want to go ...
way down in Do Co Mo
(with apologies, but not royalties to the Beach Boys)
Use your head, can't you, use your head,
You're on earth, there's no cure for that - S. Beckett
Yes?
You may note thst DoCoMo was quite happy to deliver this spam to their end users and profit from it.
:-(
Had the spammer used valid email addresses I'm sure this would not have ended up in court.
That I am liable for all those calls to women in bars who gave me incorrect phone numbers?
Spam suxxor, but since I stopped forwarding my "spam" emails to my maim email account, I have got none. I was getting about 20 per day, and all of them from usenet posts to wpg.forsale.computers (I'm from wpg). So a good short-term solution may be not to enter your main email address in web-forms or news posts. (flame suit on)
I'm not defending spammers. I think the use of open relays, bogus return addresses, joe job return addresses, and the like show simple laws don't work. In an international community the cover of obscurity provides a great place to hide from proscution. Facing that fact, I don't think a simple law in some single country will ever fix the problem. A technical encumberment could be employed to severly limit the effectiveness of a dictionary attack. Think about it. If you had a mailserver or hundreds with only 5K users each and someone started a dictionary attack, It would be simple to have the server purge all mail to all users that matched most of the body of the mail as well as automaticaly real time blacklisting the source IP. Any bulk mailing with a greater than 50% failure rate could block the incomming mail for say 15 days and purge all matching mail from all inboxes. (the way I view it is too much spam makes the server sick and it then vomits the spam overdose and refuses any more un-tasty morsels) If widely implemented, it would be instant death to dictionary attacks.
You would need a serious validated mail list to do anykind of bulk mailing. Subscription lists would have to be regulary purged of stale addresses. Failure to do so would trigger blocks. Most mail lists should be opt in and renewed at least annualy. That would auto purge those who had a troublemaker sign up to a list where you can't unsubscribe.
The truth shall set you free!
First, great idea.
"I don't think a simple law in some single country will ever fix the problem."
You are correct but if something like this (spam marking) were implemented in the US (hopefully other countries too) it should alleviate some of the problem. This, in addition to your idea would put a huge dent in the spam business.
Indecision is the key to flexibility.
True enough. But one may logically ask the question whether the ultimate receiver of the said SPAM could turn around and send a bill to the spammer for wasted bandwidth, lost productivity in having to deal with SPAM and even an accounting charge for the CPU time and disk storage necessary for your system to accept, process, filter (if you have one) and ultimately deliver it.
Might be worth thinking about. In fact, SPAM filters might be fitted with routines to do this sort of accounting. Finally, a group of SPAM victims could then get together and launch a class action suit against those individuals and organizations involved in SPAMming.
Then your mailserver must keep a connection open for 5 more seconds than required. Each connection consumes system resources (which resources depends on your OS, but likely candidates are RAM, INODEs, extra connections that count toward the limits set at the OS or MTA level, you get the idea), so you would effectively be hurting your own server.
:-)
This is why some busy websites choose to disable keepalives or set the keepalive timeout to something short like 1 second. If the webserver keeps that connection open while waiting on the user, the resources consumed are more than the resources of creating and destroying that conection. Better to get that connection closed ASAP.
Or did you assume that the spammer would be nice and wait for one attempt to fail before starting the next?
"Avoid employing unlucky people - throw half of the pile of CVs in the bin without reading them." -- David Brent
When i no longer have hope that things can be fixed, then that's when i'll know it's time to leave. I'm discouraged now, but not yet ready to give up. I think that far too many Americans love "America", but don't really hold to heart the ideals upon which this nation was founded. If only they could understand . . . then their patriotism would be more than callous tribalism.
I just got back from a trip to NYC. I went to Liberty Island and remembered that it was recently-reviled France who gave us our most-cherished monument. I have never felt so patriotic as i did while visiting Ellis Island. To see the many different faces, stories, and cultures that are integral to America, that was inspiring. They came not because they loved the material America - the plains and mountains, rivers and forests. Though they saw possibilities there, they came because they loved the idea of America.
That idea has been lost to so many - those who love what they have - the comforts and artifacts of their lives. They want to preserve these things and try to keep them just as they are, not realizing that unless America is constantly growing and adapting in response to the ever-growing and ever-changing world, it is dying.
I do not love the flag. I do not love the President. I do not love the power we wield. I love America - its ideals, its dreams and hopes for itself, and the promise of what it could be.
The only thing necessary for the triumph of evil is that good men do nothing.
I say pahtuey (sp?)
x--
You can solve the problem by rigorously enforcing spam traps. If a host mails a spam trap address, quarantine it until a human can review the situation. If you see a bunch of obvious dictionary-type attempts while inspecting the logs, keep the block in place.
Taken to its logical extreme, the dictionary attack lusers will have to spread out their actions across a wide base of hosts - open proxies and such. There are only so many open proxies around, and eventually you will have a good number of them on your quarantine list.
This also works well to stop the situation where spam is sent with a forged address to a never-valid address through a secondary mail exchanger. Normally it would double-bounce to the admin, but this stops it at the border.
Let's face it - most of our MTAs are dumb. They blindly accept things they probably shouldn't. The good news is that some of them support helper programs (like sendmail's milter) that can be used to give it some teeth.