Slashdot Mirror
DOS Attack Via US Postal Service
Phronesis writes "Bruce Schneier reports in Crypto-Gram about the slashdot-inspired Post-office DOS attack on SPAM-king Alan Ralsky. More interesting, Schneier writes, is a recent paper on Defending against an internet-based attack on the physical world, which generalizes this attack and discusses how it could be automated and how one might defend against it (you can't stop it, but you could make it harder to effect). From the abstract of the article: 'The attack is, to some degree,
a consequence of the availability of private information on the Web, and the increase in the amount of personal information that users must reveal to obtain Web services.'"
What if people started doing this to political parties donation mailing addresses. They would not be able to sort it out to get their money effectivly shutting them down.
"It is not how things are in the world that is mystical, but that it exists." -Ludwig Wittgenstein
The attack on the SpamKing is definitely funny. But the paper seems like an overly windy article describing how to perpetrate the old misdirected pizza/taxi cab gag on the information superhighway. While mischeiveious and a nuisance it can hardly be described as a denial of service attack now can it ? The victim ends up with a stuffed mailbox and the post office makes bank with all the additional traffic.
:)
Also this seems a little extreme 'The attack is, to some degree, a consequence of the availability of private information on the Web, and the increase in the amount of personal information that users must reveal to obtain Web services.'
Considering the webservices the article is talking about is requesting a catalog
Wasn't the last DOS attack through postal service using anthrax?
http://ebgp.net/ccc/
It's like an executive summary of all the above links.
I could go to any bookstore's magazine section, get out the subscription cards (they aren't even physically bound to the magazine), send them off to the publishers, and check "Bill me later."
There is absolutely no way for a person to prevent against this right now.
The analog solution from the electronic world would be for the publishers send them an confirmation letter or something asking whether they really subscribed.
George W. Bush
President, United States of America
here
http://starboard.flowtheory.net/
Wasn't the last DOS attack through postal service using anthrax?
would that be the physical incarnation of the "ping of death" attack?
Photos.
quick, if we slashdot the IRS via the usps, they might never get to my taxes!
some users of my website have gotten pissed when they lose the game and signed up the webmaster account for tons of email offers... it is basically harassment, but easy to turn off.
yesterday as i went through *35* pieces of junk mail from 3 days i was wondering if the USPS had an opt out from certain mailers form? i doubt it because spam is how they make most of their money.
any input here?
MARIJUANA, SHROOMS, X: ONLINE?! - E
Getting SPAM lately! Try DOS
oh well
So wait, whenever we the people get nailed by 2 tons of junk mail, spam mail, and get our ear talked off by telemarketers, have bill board ads vying for our eye site, and our television sets screaming at us not to mention pop up ads all over the place (unless you have a popup eliminator or use an alternative web browser, long live opera). These things are all "good" but whenever we all collectively get together and nail the hell out of spammers with the pent up rage of 2 million people who can sighn them up for nail mail garbage, it's considered wrong? I think it's nothing more than a reaction from the masses and that it should be expected, after all if they can dish it, they should be able to take it. Side note; while I know that the article doesn't neccessarily refer to the attack against spammers by the slashdot crowd, there hasn't been any other successful campaign of this type that i've ever heard of on such a scale. Time to smack them with a rolled up magazine like the bad doggies they've been
Like the usenet spammer/advertiser I saw today that had a VALID but obfuscated email address set (for the company he was advertising). Amateurs.
Ralsky got what he deserved, and hopefully moving 'on the quiet', if he did move, cost him alot of money. I read this article earlier today (didnt think of submitting it myself) and it made alot of sense. It IS all too easy to get yourself on these lists and your life is made difficult getting off them (digging about for phone numbers listed in a 500 page catalogue's small print...) - if you were subscribed to even 100 of these you would have a mammoth task to get rid of them all.
If you type the following search string into Google -- "request catalog name address city state zip" -- you'll get links to over 250,000 (the exact number varies) Web forms where you can type in your information and receive a catalog in the mail. Or, if you follow where this is going, you can type in the information of anyone you want. If you're a little bit clever with Perl (or any other scripting language), you can write a script that will automatically harvest the pages and fill in someone's information on all 250,000 forms.
What's the chance of setting up a perl script to automatically find Junk Mail Kings and sign them up for the service? I'm sure many of these 250,000 would be junk mail kings. Just set them on each other!
Though environmentally bad in the short term, if it shuts them down in the long term, it would save a heck of a lot of trees!
You forgot to log off of your terminal, and Taco came in and posted a repost under your name.
In the case of signing up a spammer or other unscrupulous individiual to catalogs and other physical mail, the companies that are sending these items are directly bearing the cost of your DoS. Sure, Sears can probably afford to send out one more letter, but catalogs are more expensive to print and mail. All these companies are getting screwed out of real money, not some potentially (and oft inflated) accounting of how much time/cost an ISP has for DoS countermeasures.
Sure, I think it's great to spam the spammers, but in doing so you harm legitimate companies more than in the Internet world.
I know it isa bit off topic but does anyone know of any pictures of the quanity of mail that Ralsky gets?
Although this is kinda funny in one isolated case, what also has to be considered is the effect on the Postal Service. Sure, they get paid to deliver this mail, but it's not that easy.
Catalogs and Magazine subscriptions ship at cheaper rates. The rural carriers that deliver mail to people's homes aren't set up to carry mass amounts of this type of mail to people; economically, the post office is set up to run with a balance of junk and first class mail on any given route.
Overload this with a hugh amount of bulk-rate junk mail, and you're putting a burden on the capacity of the carrier routes, which in turn will force the Postal Service to modify fees and/or service.
I would be highly suprised if they pass this charge on to the business customers that generate the bulk mail; this would meet with too much resistance and put pressure on the business relationship. Instead, I wager we'll see the fees passed along to first class, consumer mail either through an increase in postage fees and/or fees for home delivery of mail.
In short - The Postal Service is not the Internet. It is one orginization that can and will respond to this type of abuse, and the end result will be less service / increased cost.
Sure, the Ralsky attack is funny and ironic and all, but imagine if it happened to you. This wouldn't be a pizza delivery or Playgirl subscription every now and then, we're talking *pounds* of mail every day from many, many sources (God! your mailman would *hate* you). Easy to initiate, not easy to trace and really hard to stop.
Also, you can't write filters to automatically route or categorize snail mail. You have to go through it all to find the non-spam. If this kind of attack catches on, watch out.
I'm interested, is there anyone out there that works for the Postal Service? How can victims deal with this sort of thing?
Four fifths of all our troubles in this life would disappear if we would just sit down and keep still. -C. Coolidge
I'm going to get back at my former boss (major asshole too) now. :)
"Denial of Service", is the flooding of a server so that it stops functioning.
"Disk Operating System", is an OS like Windows that bases its structure upon drives rather than directories like UNIX/Linux or Mac OS do. Windows NT is still a DOS even if it (supposedly) doesn't contain MS-DOS derived code.
On a side note, DOSes seem to contribute more to server malfunctions than DoSes.
You can't judge a book by the way it wears its hair.
Automated Denial-of-Service Attack Using the U.S. Post Office
In December 2002, the notorious spam king Alan Ralsky gave an interview. Aside from his usual comments that antagonized spam-hating e-mail users, he mentioned his new home in West Bloomfield, Michigan. The interview was posted on Slashdot, and some enterprising reader found his address in some database. Egging each other on, the Slashdot readership subscribed him to thousands of catalogs, mailing lists, information requests, etc. The results were devastating: within weeks he was getting hundreds of pounds of junk mail per day and was unable to find his real mail amongst the deluge.
Ironic, definitely. But more interesting is the related paper by security researchers Simon Byers, Avi Rubin and Dave Kormann, who have demonstrated how to automate this attack.
If you type the following search string into Google -- request catalog name address city state zip -- you'll get links to over 250,000 (the exact number varies) Web forms where you can type in your information and receive a catalog in the mail. Or, if you follow where this is going, you can type in the information of anyone you want. If you're a little bit clever with Perl (or any other scripting language), you can write a script that will automatically harvest the pages and fill in someone's information on all 250,000 forms. You'll have to do some parsing of the forms, but it's not too difficult. (There are actually a few more problems to solve. For example, the search engines normally don't return more than 1,000 actual hits per query.) When you're done, voila! It's Slashdot's attack, fully automated and dutifully executed by the U.S. Postal Service.
If this were just a nasty way to harass people you don't like, it wouldn't be worth writing about. What's interesting about this attack is that it exploits the boundary between cyberspace and the real world. The reason spamming normally doesn't work with physical mail is that sending a piece of mail costs money, and it's just too expensive to bury someone's house in mail. Subscribing someone to magazines and signing them up for embarrassing catalogs is an old trick, but it has limitations because it's physically difficult to do it on a large scale. But this attack exploits the automation properties of the Internet, the Web availability of catalog request forms, and the paper world of the Post Office and catalog mailings. All the pieces are required for the attack to work.
And there's no easy defense. Companies want to make it easy for someone to request a catalog. If the attacker used an anonymous connection to launch his attack -- one of the zillions of open wireless networks would be a good choice -- I don't see how he would ever get caught. Even worse, it could take years for the victim to get his name off all of the mailing lists -- if he ever could.
Individual catalog companies can protect themselves by adding a human test to their sign-up form. The idea is to add a step that a person can easily do, but a machine can't. The most common technique is to produce a text image that OCR technology can't understand but the human eye can, and to require that the text be typed into the form. These have been popping up on Web sites to prevent automatic registration; I've seen them on Yahoo and PayPal, for example.
If everyone used this sort of thing, the attack wouldn't work. But the economics of the situation means that this won't happen. The attack works in aggregate; each individual catalog mailer only participates to a small degree. There would have to be a lot of fraud for it to be worth the money for a single catalog mailer to install the countermeasure. (Making it illegal to send a catalog to someone who didn't request it could change the economics.)
Attacks like this abound. They arise when an old physical process is moved onto the Internet, and is then automated in some unanticipated way. They're emergent proper
not actually the mail, but the spam himself:
http://images.google.com/images?hl=en&lr=&ie=UT
It just goes to show that people should be very careful with their personal information.
Sincerely,
Guy LeBarge
186 Rideau St.
Ottawa, ON
K1A 25U
using System.Awesome;
Anyone except me that see the irony in the fact that those who wrote the paper Defending against an internet-based attack on the physical world displays their physichal world location on the top of the paper?
Melius mori in libertate quam vivere in servitute.
"...and the punishment of vice, often in an especially appropriate or ironic manner. "
So you see, this is poetic justice, not irony. That said, I'm not mad about this happening to him, is anyone else?
Comment forecast: Bits of genius surrounded by a sea of mediocrity.
Not only doing the junk mail signup, also, try calling his local pizza place, and order several... =) btw: either use caller id blocking, or claim ur one a cell phone hehe
-------
"In times of universal deceit, telling the truth becomes a revolutionary act."
-- George Orwell
They didn't call this spam counterattack "bad" although it is certainly illegal. But it is an attack, and these guys are security geeks, so it's their job to investigate and propose countermeasures to things like this.
I hereby place the above post in the public domain.
He suggests that you type "request catalog name address city state zip" into Google whereupon Google will kick back some 250,000 pages with online web forms to fill out.
Google now kicks back one hit - the article itself...
You really have to strip your search down before it starts returning anything.
What kind of giddy moral superiority to you get from seeing anyone hurt?
The best kind!
You think that I'm crazy, you should see this guy!
Nothing says "loving" like a box of dryer lint with no return address.
Boobies never hurt anyone. - Sherry Glaser.
That worked well because where we lived, enveloppes without a return address and without stamps were delivered allright, and had to be paid in full by the receiving party for the cost of shipping plus a penalty fee for not stamping the mail in the first place.
I doubt that he's ever made someone loose great amounts of money, but that must have annoyed the hell out of those people receiving junk and having to pay for it !
This is a joke, right? Morally bankrupt my ass. I say rape the rapist. Murder the murderers. And SPAM THE FUCK OUT OF THE SPAMMERS!
Lots, actually.
People enjoy hurting other people. It makes them feel, as you said, superior.
And you can say "That's just sick and wrong" all you want, but ask yourself, first: What can you do to stop it?
And if you can't do anything to stop it, what possible difference does how you feel about it make?
And if you CAN do something to stop it, and you DO something to stop it, you're just propogating "might makes right" - after all, you just used your power to stop it (might) to enforce your belief that it should be stopped (right).
-Hentai [in vita non pacem est]
bull$hit. just did the search and it worked fine.
i think he meant to search all of the words, not the phrase. leave out the quotation marks and the search yields 263,000 hits...
Try taking the quotes off your search.
263K hits last time i tried it.
Too bad you are AC. Hope you are keeping an eye on this note.
You make numerous statements without backing. Examples: "We can't live in a world without judgement." "It can't deal with the complexities of the modern legal order," "Lex Talionis, the principle of an eye for an eye, is a morally bankrupt code of law"
Perhaps in some circumstance, this is the case. However, most people are too stupid to understand anything more complex than 'eye for an eye'.
I'd post more, but I'd probably be shouting at the wall.
Jesus was all right but his disciples were thick and ordinary. -John Lennon
...when they understand the real-world equivalent. He's one man being DDoS'd, online almost everybody with a reasonably public email address is DDoS'd. I've got a university account, that has never been posted to mailing-lists, usenet, forums but is fairly accessible from the university homepage (student cataloges etc.) SPAM is on the rise, and that's a mail address I can't change to dlkjghadlgh@somehost.com just to get away, any more than I could move away to avoid being spammed in the real world. Neither can businesses and others with the need for a static and publicly accessible address.
At least the catalogs he's getting have a real return address. I hate spam with fake sender, and I hope someone will soon enforce that domain.com must come from a domain.com mail server (or through one with authentication) and start the snowball running. If you can't send through the domain.com mail server, why should anyone believe you have the right to send mail for user@domain.com? The default "trust anyone" is one of the big signs e-mail was designed for "serious" use by "serious" people before the general public started using and abusing it.
Kjella
Live today, because you never know what tomorrow brings
I wonder, how does the USPS deal with a person who gets that much mail? Obviously they have to deliver it since that's their whole purpose, but I know the little mail truck that comes to my house probably couldn't fit a few extra hundred pounds of mail. And the poor mailman, and the mailbox itself.
I mean, logistically, how do they cope with it?
Well, if you piss off people, they may try to get back at you. The Ralsky attack is the result of Ralsky pissing off a lot of people an each person engaging in a small and individually harmless act. In comparison to the kind of disputes among neighbors and individuals that often occur in the real world, that seems both harmless and unprosecutable. Welcome to the real world.
If you piss off a lot of people for justifiable reasons (e.g., you are the author of Satanic Verses), then some concerned government may try to help you out. Otherwise, the solution is simple: don't piss off too many people.
I favor Tomahawk cruise missiles, Delta Force...
Take:
Empirically, 1000 pagers (at 3-4 dial sequences per minute) equals about 4 days of constant calls to the vicitim's phone. How I know this is another discussion...
Of course, this was more effective when digital pagers were much, much more popular. Today, it probably wouldn't go over as well, but back in the late 80s and early 90s, it worked flawlessly. Essentially, it was distributed crank calling before the "DDOS" term was coined.
The most interesting part was that the pager companies explicitly refused to do anything about it. No tracing of calls, no attempts to halt sequential dialing, etc. Not their problem.
What's wrong, he could he not do the physical world equivelent of clicking the unsubscribe link?
Fight Spammers!
DOH!
You are correct Sir
I work for a scummy direct marketing company, and can tell you that when people mail back dog shit, dead cats, bricks, etc. it really does slow business down because that mail is not sorted from the legitimate mail. From time to time the bomb squad is even called in to check an unexpected parcel and that can gum up the whole works.
What constitutes sending someone bad packets in the real world? Stuffing rotten eggs in the mailbox on a hot day?
So, someone could write a script to harvest the form details for a whole lot of catalogue companies, **and each company's address** at the same time. Then they could sign each company up for all the other companies' catalogues. Not only would each of these snail-mail spammers suffer a deluge of mail in a week or two, they'd also spend a fortune on mailing catalogues they'd never recover through sales, heh! Perhaps they could be put out of business, making life nicer for the rest of us..?
:-)
Now, if only I could write PERL...
Boy am I glad this story was posted - I almost forgot to sign Ralsky up for my quota of 20 newsletters/catalogs today!
Someone needs to find out where he moved to, and make sure his "change of address" info gets filled out at the post office. We wouldn't want him to miss out on any important mail. :)
Whoa, lay off the sauce, bub. In your current condition, I think you'd get about 2 blocks before you smacked your car into a tree. Just to be safe though, please give your keyboard+mouse to a designated Slashdot Reader? We wouldn't want you to bash up your car(ma).
Pardon while I run for cover due to the atrocious pun in the last sentence.
Please help metamoderate.
Lex Talionis, the principle of an eye for an eye, is a morally bankrupt code of law we've been moving away from for the past few thousand years, thankfully.
Wrong. Lex Talionis was the principle that you take NO MORE than an eye for an eye - promulgated as an "improvement" in an era where the response to losing an eye (or a purse) might be to do in the alleged perpetrator and confiscate all his worldly goods.
It's morally bankrupt, all right. But only to the extent that if the thief only loses what he stole, and has a nonzero chance of getting away with it, theft remains a profitmaking enterprise despite full enforcement of the law. So it becomes an endorsement of theft as a lifestyle. This is why there are "puntitive damages" - extra penalties to punish the perpetrator (thus making continued misbehavior a losing proposition even with imperfect law enforcement).
None of which applies here. Applying "Lex Talionis" to the spammer would mean spamming him, rather than seeking compensatory and puntitive damages.
===
Which is what they did, isn't it? B-)
===
Lex Talionis also recognizes a moral principal of equivalency, to wit: In an egalitarian society, regardless of what actions you think are fair, you have NO moral gripe if someone does to YOU what YOU did to them. If it was wrong for them to do in retaliation, it was AT LEAST as wrong for YOU to do without provocation.
===
I note, by the way, that your posting is IDENTICAL to one you made several times previously - including in the slashdot article credited with inspring the USPS DDoS attack in the first place. (And that last one I cited was under your own slashdot ID of Chuck Flynn.) Given that, I felt free to repeat, almost verbatim, my response to your most recent previous missive.
The posts that recieve your canned response seem to be any suggestion about spamming the spammers. You wouldn't happen to be a spammer, would you?
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
Actually, "an eye for an eye" is an improvement over what came before it - it basically says "don't penalize someone more than the amount of damage he's caused".
"adult diapers catalog request state zip"
This returns a much more interesting list of companies.
Certainly I agree we should not rely on Lex Talionis to punish spammers. It would be much better to follow proper legal procedings to persuade them to quit. Unfortunately, our legal system does not have the infrastructure in place to effectively punish spammers (if it did, there would be much less spam). Hopefully, by pursuing this outdated vengeful idea of justice, we can convince our legislators to put effective anti-spamming measures in place, so that we will not have to rely on vigilanteism.
Junk mail usually comes with return envelopes, so send the junk back!!! Empty, or filled with scrap paper (maybe other junk mail).
I guess they have to pay postage for all those returned envelopes...
It comes in trucks by the bagful. Bigger trucks, if the normal one doesn't work. It's practically a cliche in movies about people who get famous and get loads of fan mail.
a. reads all of his own spam email? If not, why? Why should we?
a. sends anonomus mail-and the list of addresses he sends it from.
b. blocks incomming spam from his personal accounts! Does he include a "secret" header code in the spam, or block the list of addresses that he owns+ his buddies? How can I be on that list?
Did everyone make sure to slightly misspell his name, fake name, etc. when they filled out the forms [note: I only just heard about this and being a lamer have not contributed my self] This would make being removed from the lists that much harder. Of course, I'm sure he's against the "do not spam" lists--so he shouldn't expect anyone to automate the removal process for his address from the databases, now should he!
So, what the heck IS his address??
A postal firewall... It filters your mail when the postman leaves... shreds what you don't want and your good.
Of course... just like the firewalls of today... some legitimate stuff will be shredded. Colateral damage I guess? Hopefully, it won't be your tax return, or your tickets to the concert.
Alan Ralsky aliases and addresses.
Seems like his "real" address is:
Alan Murray Ralsky
6747 Minnow Pond Dr,
West Bloomfield,
MI 48322
Telephone: 248-926-0688
Current email address: amr777@comcast.net
If this were "eye for an eye," all that mail Ralsky would be getting would be delivered postage due.
Years ago, I read about a guy who intentionally signed up for as many catalogs and other junk mail as possible. I think he got 200 lbs a day. He heats his house with it.
>and mobs do great things to bad people
>(sometimes.)
Yeah, them mobs sure knew how to treat uppity coloured down south.
mobs are like terrorists...they do great things
when they work for you, not so great when its against you.
zeke
http://www.kuro5hin.org/story/2003/3/13/23423/4648
Lex Talionis is a morally bankrupt code (5.00 / 1) (#7)
by A Proud American on Thu Mar 13th, 2003 at 11:29:39 PM EST
http://www.kuro5hin.org/user/A Proud American/diary
Why should we be happy when the spammers get spammed? Ponder this.
Lex Talionis, the principle of an eye for an eye, is a morally bankrupt code of law we've been moving away from for the past few thousand years, thankfully. It can't deal with the complexities of the modern legal order, and it ignores all proper justifications for systems of punishment: rehabilitation, prophylaxis, etc. It makes an assertion of rigid judgment in an attempt to avoid judgment itself. We can't live in a world without judgment.
Ask yourself this: should we rape the rapist? If not, why not? (Ignore for a moment that we essentially do rape rapists by committing them to so-called "maximum security" prisons where they get systematically brutalized and raped by guards and other inmates.) It's not a morally tenable position to lower ourselves to the level of brutes just so we can vindicate some idea of retribution.
Therefore, ask yourself why we should be happy when the spammer gets spammed? No one should have to endure the pain and annoyance of spam: it's the scurge of the online world. Not even the spammer, who may be in his business because of factors outside his control like debt or bills for an illness in the family, etc. We should be outraged when anyone is spammed, and we should put the full force of the state and the law against the perpetrator no matter who the victim! Picking and choosing among which victims to protect is something the legal order of former barbaric times did. I'd be disgusted if our government returned to those days.
Spam = bad. Victimization = bad. Why do people conflate the two? What kind of giddy moral superiority to you get from seeing anyone hurt?
I always wondered why instructions contained phrases like:
Now type "somecommand" (without the quotes).
Now I know....
Mod down posts with a "Free Mac Mini/iPod" sig, they're spam!
Look familiar?
3 74 389
http://slashdot.org/comments.pl?sid=54945&cid=5
Theoretically they may have lowered the value of his house upon resale. Like murders or other infamous events in a house it's the sellers responsibility to inform the buyer or the deal can be busted at a later date. So the spammer must inform the next buyer that they may recieve a monthly flood of "For Alan Ralsky or current occupant" mail. I know I would think twice about moving into a cursed address.
I've hit Karma 50 and gotten a Score:5, Troll... I win!
"
Lex Talionis, the principle of an eye for an eye,..."
If you studied this, you owuld not an eye for an eye is not literal. It is about compensation. granted, its been used out of context and basterdized by anybody who wants to do violence.
Back to Spam.
This guy is costing people a lot of money, and there is no practical recourse. It would be very difficult, if not impossible, to draft a law, or make a change to the internet to stop this abusive behaviour that would not change the internet to a heap of worthless crap.
He is not being hurt. He is being taught a valuable lesson: "Whats good for the goose is good for the gander"
More iportantly, people are taking notice and being made aware.
The only way thru stop spam is through education.
The Kruger Dunning explains most post on
Yepp.. at the beginning of the first harry potter movie he is attacked this way by Hogwarts.
-- When did Ignorance Become a Point of View?
Lets play Guess The Spammer!
Stupid though cos theres a big difference between spamming and your anal rape analogy.
Raping someone is an evil crime that leaves premanent damage. Spamming does not - if this spammer stopped today probably no-one would ever give him a second thought. Dealing with spammers is much more about modifying their future behavior, not punishing them for the past.
So yeah, to continue the analogy, this guy should be gang-raped with sharp spikey envelopes until he could model for goatse !
Am I the only one who is going to mention such a great target for this type of retalliation? I believe I have several hundred AOL cds that arrived at my house without warrant. Perhaps the AOL distribution office needs a cluttered mailbox... :)
I think in some cases eye for an eye isn't appropriate--for example, murdering a killer is going too easy on them--locked in a cell for a long-ass time is much crueler and more deserving. However, I agree with the previous poster: SPAM THE FUCK OUT OF THE SPAMMERS
Rooting for the yankees is like rooting for herpes.
Enough time hasn't passed. 22.3 years. That's how long it takes for something tragic to become funny.
As of March 1, 2003, the Secret Service and the Customs Services have been moved from the Treasury Department to the Department of Homeland Security. ATF has been split between the "tax and trade bureau", which remained in the Treasury Department, and the "law enforcement functions", which moved to the Department of Justice.
I know it's a joke, but it's a little out-of-date.
Eh, I got enough karma, I'll bite.
Theft, assault, embezzlement, drug crimes, so on and so forth, maybe even murder, do deserve a fitting, lesser punishment...but we go too kindly on rapists as is already.
Rape is a totally different level of crime than anything short of killing somebody, and even when you kill them you aren't stuck on that same pure brutal desire to show that you can dominate somebody and do whatever you want to them, and there's not a damn thing they can do about it. I think a framing hammer to the testicles and glans would be a more fitting punishment - followed by hanging, drawing, and quartering. In the grand olde english fashion, with the entrails and the blood and the horrible horrible suffering...mmmm, let those fuckers swing. (disclaimer: very close friend was raped about a year ago)
Facts do not cease to exist because they are ignored. - Aldous Huxley
Now that Safari supports AutoFill Form, I'll actually have something to do all day.
Cmd-shift-A all day long.
From the Alan Ralsky link:
Ralsky agreed to this interview and the tour of his operation only if I promised not to print the address of his new home, which I found in Oakland County real estate records.
Hmmmm.....So im looking for a 8,000 sq. foot luxury home in Halsted and Maple, West Bloomfield, Oakland County, Southeast Michigan. I bet Eva the realtor knows!
The author's of the paper against defending against physical attacks go to some lengths to develop reverse Turing Tests to ensure that a human is involved in the loop.
A simpler protocol to ensure the same end is a non-identification based biometric check. This ensures that a real live human was present at the location and time the check was made (yes, I know this can be faked).
A non-dentification based check means that the individual is not explicitly _identified_ merely that their identity can be _verified_. Hence this is a less intrusive procedure.
This form of biometric authentication is quite often found in supermarket checkout lines for example, where an operator must periodically (or prior to significant activity such as withdrawing cash from a register) pass a biometric check to verify that a) they are present and b) they are the same individual that passed the previous check (or a new operator has taken over) and c) they are authorised to carry out various tasks.
STF
Except for Mr. Ralsky's postman, the postoffice is probably okay with the increase in business. To get more people pissed off at Mr. Ralsky, we should really use the technique in the article to sign up his NEIGHBORS to all this junkmail. They'll all be pissed off, and they may vent their anger at him because ultimately he is the reason for their deluge.
Your mailman is your filter.
Ralsky needs to:
1) Change his address to 123 whatever st APPT 2,
2) Buy a big mailbox
3) Buy a woodstove (He does live in the north..)
4) Find one of those guys from junkyard wars to build a temperature conveyer system..
5) Profit..
The law is a weapon of the government, not a protection for the likes of you. Surely you understand that.
I totally misread the headline at first glance. I saw "DOS Attack on US Postal Service". And since today is tax day in the US, I thought this was a joke about the deluge of tax returns being mailed today flooding the post office and causing their service to break down. Oh well, maybe next year.
Despite the spammers, there are a lot of legitimate businesses and non-profit organisations out there that are trying to get people to sign up so they don't waste their time and money mailing people who have no interest in what they have to send.
Just because a business or organisation asks people for contact details to send mailouts doesn't mean that they're doing it maliciously. What you'll accomplish by scripting this is to give headaches to the people doing it correctly by polluting their mailing lists with people who don't want their mail. If anything, it'll have a negative effect on their customers or members who actually want to hear from them in the process, and it'll waste the resources of an organisation that often won't have a lot to waste.
Rule #1: You do not talk about the IRS.
Rule #2: You do not talk about the IRS.
!#@%*)anks for hanging up the phone, dear.
We need to fight spam with DDOS attacks. Imagine a distibuted client on thousands of computers, that when given the signal, attack a server known to SPAM (spamcop database?). Not the most legitimate technique, but i'm sure it would be effective.
does he still live there right now?? if it is, i can take a picture of his mailbox after the mailman swings by. let me know :)
Anyone know Bill Gates' home address?
Dude, Maryland ain't the north. We're all hicks here.
Has anyone successfully written a program to automatically do the sign ups, even as a proof-of-concept?
Does anyone, per chance, have Rush Limbaugh's home address?
Manipulate the moderator system! Mod someone as "overrated" today.
I wonder what would happen if the politicians who legislate the postal service, and their top campaign contributors, were each subscribed to 250,000 junk mail and email lists. Perhaps the economics would change then. Perhaps not. I'm certainly not advocating anything of the sort! No! Don't do this! You hear me? That would be bad and irresponsible!
He suggests that you type "request catalog name address city state zip" into Google whereupon Google will kick back some 250,000 pages with online web forms to fill out.
Google now kicks back one hit
- Try it without the quotes: about 256,000 hits.
If we could get any of these, we could have some serious fun!
... i.e. "ring ring - 'hello, Ralsky here' - *beep* *beep* - hang up - repeat 5 minutes later"
... we should at least be able to get this douchebag's fax number for his company - yes?
First - get his fax number into some key marketing/questionaire databases and blamo! - Fax Spam Ahoy!
Second - Setup a couple of "Faxback" server attacks on those numbers. Faxback servers are fantastic because they're realllly dumb. Call them up on an toll-free number and order up a mess of documents to be faxed to wherever you want. The best part is that they're relentless - they will just keep on calling (up to 10 times) to try to make a connection
Its mega-annoying - especially if you get a couple of them going at once - and at 3AM
But heck
---- "Logoff! That cookie shit makes me nervous!" - A. Soprano
to determine the business addresses that those who actually respond to his spam would be sending their checks too and swamp those? Spammers depend on a very low operational cost model to make money. If they have to sort through 100s of items of mail for every one that has a check in it, you've just increased their cost of doing business.
If they're doing most of their business electronically, publishing a list of their SSL sites could be interesting. If we all ran something to walk the list once an hour and just make a connection to the SSL sites and leave it, they'd be effectively down. Negotiating the SSL connections has a high computing cost on their side.
If someone were to design a virus that does that and continuously checks into sites for new lists, I might actually try to get the virus.
In other words, if you want to have a real effect, go for cutting off the money.
It works for Homer!
When you post the article as Anonymous Coward, you accrue Real Life karma, instead of /. karma. So you're still a karma whore. Wipe up afterwards.
'occupant' changed his name to 'alan ralsky' it was in the news today. really.
if you get mail for 'occupant', make sure you fill out a forwarding slip, available from your local post office.
really, this is true. occupant was worried he would miss a catalog. he has lived at so many different places, you know.
remember, alan ralsky wants every catalog he could theoretically receive in a perfect world. let's make the world a little more perfect!
Where's Robin Hood? We could kinda really use him now.
Hopefully this DOS attack will 'deltree *.*' his spam operations.
*Ducks flying tomatoes*
My blog
The only one who hates us more than Ralsky
Is his postman. Can you imagine all the huge stacks of spam he has to haul up to the mailbox? Geeze, I bet by now he almost has a seperate bag...
At least sign the guy up to Playboy so that the postman has something interesting to "obtain" from the sack 'o' mail he must have to deliver on a regular basis.
the fucker deserved it.
hope he got paper cuts from all the mail.
Easy, just get a PO Box and change your address with the companys/friend/family you deal with to goto the PO Box. Then do a return to sender on the original address. All mail goes back to where it came from and you have to make a daily trip to the PO.
Well kinda easy...
I don't want a pickle; I just want a Motor-Cycle! A four foot cop arrived with a five foot gun!
Apparently, he has a website up now... flash 6. Rather goofy.
Can't click on anything, and I sure as hell wouldn't want him working on my servers...
Here's his $HOME.
Bernard Shifman
773.391.0595
2828 N. Burling St.
Ste. 402
Chicago, IL 60657
GO TO IT! Just for the fun of it. You know you want to...
He's not a big fish like Ralsky, but he was so fr00t headed. The first catalog is free...
When i was away from my home for a while, some idiot removed the sticker- no unsollicited mail-- from my letterbox. Sure enough, when i came back i had a hell of a job trying to enter the old house, what with all that junkmail littered and jamming behind my front door... I can imagine he has the same problem now, serves him JUST RIGHT though.
When I scrolled through the posts, I was really looking to see if anyone here had been sued, or even contacted, about this potential suit.
So,has anyone heard anything yet? Personally, I think they'll have a hell of a time proving that anyone did anything. It might be a false threat to try to get the postal DDOS attack to stop.
IAAL
"One Microsoft Way" wasn't it?
;)
Whatever you think about MS, you gotta admire a company that can make a mailing address into a mission statement...
What's his address? I would like to ask his opinion on getting a taste of his own medicine:P
Carpe Diem: Seize The Day!
I get callback validation less then 5% of the time.
The post that started it all.
And a previous story on slashdot.
.ACMD setaloiv siht gnidaeR
Regarding:
" "the companies that are sending these items are directly bearing the cost of your DoS."
Costs passed on to the consumer."
etc..
Dude (Guppy06(410832)) -- You are wrong.
"If you're not giving them Ralsky's address, rest assured that they're probably interested in buying his address... "
Firstly - Two wrongs don't make a right - If Ralsky is does something wrong, it isn't right to *lie* to hundreds of companies to get them to send him junk mail.
Secondly - as others have pointed out here, your "it's not hurting anyone else" argument is false. For example, this is one of your justifications:
" depending on how much they're shipping and where, it may actually be cheaper for them to add in a few extra addresses to bump the mailing into the next rate "
This is a classic example of wishful thinking -- the lucky company that hits this "price break" only gets a fractional reduction per catalog. On the average, most companies will *not* hit the "lucky break". End result -- real money, real trees, real petrol, real effort -- are being expended in mailing Ralsky catalogs by companies who have been lied to, to get them to do this.
Is that good?
It takes several months to take full effect but it works. I sent mine in a few years ago. We get NO junk mail. NONE. In fact, at work we were talking about the advantages of churning credit card balances between cards, and when someone said "Just get a card on one of the half dozen offers you get in the mail every day" I realized I hadn't seen one in a LONG time. Like, about a year. I used to get at least a dozen a week. Several others verified that the mailbox spammers haven't let up, so the opt-out must be working.
back in the days of old,
we had a few people annoying me and my brother.
the reply was quick and painless:
3 accounts on 3 freemailers we did not like,
due to reasons of selling of adresses to spammers, forwarding the account to the two others,
subscribing them all to spam and mailinglists,
then setting the relaying to the offenders.
effect: mails doubled and doubled and doubled,
and in short time the entire thing went haywire.
in most cases the people that pissed off (as which
we registered the entire thing) also got trouble.
btw. this doesnt work anymore, as well als
loop forwarding AND pointing a forward outbound.
in most cases people seem to be able to learn.
and no one pisses of mr spectacles anymore...
I get more spam on my some-months-old Comcast account than I do on my free Yahoo mail account which I've had for, ooh, must be going on five or six years now. And I used to use that all the time as I was travelling to different countries for months at a time on business.
On a related note, can it be considered a DOS if Comcast gets fed up with the huge volume of spam which I diligently forward to abuse@comcast.net with full headers? What if that e-mail address (that's abuse@comcast.net, chaps) somehow gets harvested now? Whoops...
Yeah, in collage some friends of mine thought it would be highly amusing to sign each other up for playgirl this way. Soon everyone on the floor was getting their monthly copys of playgirl. It goes for about 4 months before they stop sending it. So this is definatly one way to spam someone.
The attack is, to a considerably larger degree, a consequence of the actions of the spammer - by engaging in a highly antisocial activity.
My real address has been on the net for years, and I haven't had a single problem, perhaps that's because I conduct myself with respect towards others?
I work for a utility company. My last job was at a printing company that was also a mail house. On average, it costed our clients the same price to mail a person a 30-50 page catalog as it was to send a first-class letter. (Just shy of 40 cents) The price for mailing catalogs is insanely cheap IF and ONLY IF you have high enough volume.
Why do some utility companies give you a $1.00 or $2.00 credit for electronic billing and payment? Because "Slow-pay" and "No-Pay" are the bane of the utility billing process. Your paying the utility company a day later than normal costs the company money. I'm dead serious on this. Everything is based upon a constant revenue stream, and the accountants figure out how to thow the money around the books to make sure everything is covered when it should be covered. If money is tight, they have to dip into investment funds, or take out a very short-term loan.
Accounts that are over a certain age are automatically written off for tax and accounting purposes. If a customer calls back in for service after having a written off account, they are researched and then the write-off amount is reversed. We can't just bill them some miscellaneous debit, we have to reverse the write-off document. It's all for accounting. It's crazy. But I'm rambling. The end result why they will give you the credit is yes, they do save money on postage and printing, but the main thing is, online payment gets the money into the utility's bank account faster.
(Not only that, but bouncing checks, and the fact that every check cashed costs the company money as well. Ever owned a business checking account?)
Mysteriously the mail volume seems to increase every time the article gets mentioned
hummm talk about publicity being a bad thing
DP
"(I) have this unfortunate condition that causes me not to believe a single thing any politician says when a mic's on.
Sorry your landlord lied to you. When you get out into the real world you'll learn that sometimes we have to schlep to the landromat. Got a car? Shouldn't be too much of a problem. Or if you can't possibly be bothered to go to the landromat, invest in a washer/dryer yourself - either apartment sized or full sized if you've got the space. There are plenty of cheap models out there.
In any case, no need to bitch about it and take it out on your landlord. (No, I'm not a landlord, but was in a similar situation to yours - I bought myself a W/D and now am happy/clean)
I'd hope it's on the level of Kris Kringle in "Miracle on 34th Street" with bag after bag after bag coming in.
Send it to his neighbor's address, but with HIS name on it. Then they WILL know who to get mad at.
There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
Agent 'under disclosure laws, I must inform you of any known defects'
Buyer, "here it comes, what's the catch- the price is so low"
Agent 'this house was formerly owned by Alan Ralsky who...' WHHHHOOOOSHH!!!!
Agent muttering to himself "-- every damn time..
every day http://en.wikipedia.org/wiki/Special:Random
Just to wax meta for a minute... what, exactly, do the 'overrated'/'underrated' mods mean, anyways? The faq touches on them, but it seems like they work differently in M2 and have a different effect on one's karma score.
How does this work?
-Hentai [in vita non pacem est]
If i Remembrer correctly he has a High speed DSL/ISDN something line to that house for his spam servers.. somebody find his IP address and post it on the front page..that'll be a lesson ;0 even might cost him on his bandwidth cap..doh!!
Just Limin' Mon
There have been recent attempts of using the freepost address of the uk labour party as a dos attack. The idea being that they are charged 19p for every letter you send them, and double that if they cancel the freepost address. How well it worked I don't know though.
Jerk, thanks for posting my email address...
u gh.its.a.joke.somehost.com
--
FroMan
dlkjghadlgh@somehost.com
http://la
Norris/Palin 2012
Fact: We deserve leaders who can kick your ass and field dress your carcass.
if the USPS stops delivering his mail, then he won't get checks from paying customers. And *that* will hurt him where it counts the most.
Long were the days of pain I have spent within its walls, and
long were the nights of aloneness; and who can depart from his
pain and his aloneness without regret?
-- Kahlil Gibran, "The Prophet"
- this post brought to you by the Automated Last Post Generator...