Slashdot Mirror
Telstra Denies Selling BigPond Customers' Data
Red Wolf writes "The Age reports that allegations that Telstra sells email addresses of BigPond customers have been denied by the telco. Melbourne-based IT worker Mark Edwards had doubts in this direction when he began receiving unusually large amounts of spam at his bigpond email address. Edwards grew suspicious because some of the spam being issued to him was also addressed only to a number of users within the bigpond.com domain, indicating that the unsolicited mass emailings were being sent to lists of BigPond users."
I'm with testra, and have had nothing but problems. Their Privacy policy allows selling your email address to advertisers. They've also got this insane capping system, that's stopped the rollout of broadband in AU.
Read more in Whirlpool. They've got the facts.
I'm not Seth.
I regularly get spam addressed to my address along with other users at the same domain. But I doubt my university sells addresses. It's probably just what some spam software does, since spam assassin can be set up to assign a higher score to messages where your address isn't in the To or Cc fields.
Sheesh, what's with jumping to conclusions? Like assuming if your new hotmail a/c gets spam, then MS must have immediately sold it to spammers who immediately spammed it....
Telstra have a history of standover tactics (see Here, for instance).
I really hope they get busted under our new privacy laws. I have a telstra email address that I've never used that gets spammed constantly. If telstra didn't sell my details, then something very fishy is going on.
I'm not Seth.
They got hacked and don't want to admit it. Instead they play dumb when their users are getting spammed.
-Look lively. LOOK LIVELY!!! --Mr. Shmallow
Just because the company doesn't sell the list doesn't mean that no-one within the company does (or someone that used to work there). I know of a few people that have taken lists of thousands of email addresses from their work on their last day, just in case they wanted to sell it.
On top of that, I know I've been offered cash more than once to get a list of the addresses in our database. If you were working in a call centre, in a country that you're just visiting, knowing that you'll only be there for a month or two, and knowing you'll never go back, wouldn't it just be too tempting to nap that list for future reference?
I'd like to know some specifics about the alleged selling of the e-mail addresses. Telstra says this:
"The most common practice is to submit a test mail list to an ISP containing thousands of randomly generated user names. Most mail servers would qualify the names and attempt to deliver a blank message to those that have been generated/guessed correctly."
I'm wondering how random some of the addresses were. Were they being sent to asmith@telstra bsmith@telstra, etc.? If so, then Telstra's reasoning makes sense. But if addresses like chalk54923@telstra are on the spam list, then I'd say that Telstra is full of it.
Edwards grew suspicious because some of the spam being issued to him was also addressed only to a number of users within the bigpond.com domain, indicating that the unsolicited mass emailings were being sent to lists of BigPond users.
Why give them the benefit of the doubt and consider that this was simply the work of some relatively intelligent spamming software, designed to maximize its connection to bigpond's SMTP server (by sending the body of the message once with a large list of bigpond address) when you can accuse the cruel corporate ISP of selling customer data?
Now why these spams included target addresses in the headers of the e-mail (something SMTP absolutely doesn't require) is up for debate, but I think we're jumping to conclusions here...
Only on slashdot can a posting be rated "Score -1, Insightful".
There are no email lists being sold! There is no spam in the mailboxes of bigpond accounts! Do not believe the infidels! The glorious Telstra corporation will triumph!
This happens all of the time -- it's called a spam dictionary attack, as the article attempts to explain. Spammers simply use every possible username in the world and append @yourdomain.com hoping to nail every user with their offers of bigger appendages.
The part in this article about spammers testing for the validity of a dictionary-generated email addresses is a load of crap. They could care less if the address is valid or not. They simply let the bounce message go out into never never land.
I doubt Telstra sold any email addresses. Dealing with spam attacks isn't worth the meager revenue that would be derived from selling addresses.
Tired of being "punished" by the Slashdot $rtbl since 2002. I'm now over at http://soylentnews.org/ .
The only way to find out for sure if an ISP sells subscriber addresses is to make a long, hard to guess address (such as jon4859493@bigpond.com) and give it to no one, just let it sit there. If you receive spam, it's a pretty good indication that your ISP is being rather loose with your contact info.
At our school, we don't earn a degree when we graduate—we earn pi/180 radians
I dont like Telstra as much as the next guy ... but it could have been anyone with a simple bot to harvest Telstra Bigpond email addresses and then spamming. Maybe they have a grievance against the company (most people do) which is why its users were targeted .. or maybe it was because Bigpond users are traditionally the stupidest (no knowledge on broadband, computers, security etc) that they were targeted ... and perhaps spam mailers targeted Bigpond users because they obviously will buy anything no matter how reprehensible the product/pricing and treatment of customers.
This has nothing to do with selling email addresses. I'm a Bigpond user. When I surf porn sites I get DELUGED with spam, without having to provide any identifying information.
The Bigpond referrer details identify your user name. You have a default eMail account which is username@bigpond.com. Therefore, any site which analyses its visitor logs can identify a pool of valid Bigpond eMail addresses.
Mate, if you don't want the junk mail, stop wanking so much!
The Australian government recently (a day ago) announced that they will be privatising the rest (remaining 51%) of telstra. I wonder if this being on slashdot has anything to do with that?
Anyway, a day before the government's annoucement the senate was going to vote for an enquiry into broadband access in Australia.
Then later on the same day (or the next day) 4 independent senators voted against it (damn bastards, technophobics afraid of technology).
Look at these are two days in Australian politics and think, are Australians governed by morons?
Broadband enquiry likely
Broadband inquiry killed
New attempt at broadband enquiry
Analytic & algebraic topology of locally Euclidean meterization of infinitely differentiable Riemmanian manifold
If you want a large ISP in WA, I recommend WestNet. They're a bit too big to still be really caring, but their reliability is a notch above iiNet's.
If you want an excellent quality smaller ISP in WA, choose ArachNet. They also have excellent colocation terms, and this bloke can sell you a dandy little rack box to colocate with (review coming soon). I use ArachNet myself. There are others.
If you want reliable DSL in Oz and damn the cost, try Request or Optus (nice picture). Everyone else has to go through Telstra to get their DSL (and these two will also if they have no DSLAM in the exchange), which costs you a big reliability hit.
Telstra account for your data as the sum of both directions. Most Oz ISPs will bill you for the max of in and out, or just bill you for in, but no, not Telstra. As a 'phone company, they're not too bad (their service actually works). As a "competitive" ISP, they suck.
Got time? Spend some of it coding or testing
Quite a lot of ISPs now re-sell Comindico's ADSL now.
Their entry into the market caused a small price war with wholesale prices, leading to the number of cheaper ADSL ISP options lately.
For those not familiar.
Telstra has a habit of raising their wholesale price to be close to or in some cases higher than their retail prices to end users, after a short delay the ACCC steps in and slaps down Telstra, who then behave for a while, then repeat.
This has the effect of discouraging competition.
So far the ACCC has not given out much more then slaps on the wrist, but this is mainly because the government is trying to sell off their share of Telstra, so they want the share price to be high.
You'll note that ACCC has been showing more teeth, and Telstra has been quiet lately, because the government has sidelined their plans to sell their shares (mainly because Telstra's share price is quite low atm).
If your mail server follows the early SMTP RFCs it might well do this :
%telnet bastardface.com 25
RCPT TO: <aardvark@bastardface.com>
550 Address unknown locally
RCPT TO: <andrew@bastardface.com>
250 Recipient ok. [andrew@bastardface.com]
RCPT TO: <apple@bastardface.com>
550 Address unknown locally
[... do your whole dictionary]
QUIT
all usually without ever hitting the logs
you get a nice big list of valid addresses all at the same domain and no-one is any the wiser until it stats filling up their inboxes
I know this because it happened to us when someone followed the wrong RFC
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
%echo matt@bigpond.com.au | /www/bin/get_mx
extmail.bigpond.com
%telnet extmail.bigpond.com 25
Trying 144.135.24.8...
Connected to extmail.bigpond.com.
Escape character is '^]'.
220 bigpond.com service ready (identifier 29/4290323)
helo numpty
250 bigpond.com
MAIL FROM:
250 ok
RCPT TO:
550 recipient unknown
so you run your dictionary attack against the server
MAIL FROM:
250 ok
RCPT TO:
550 recipient unknown
RCPT TO:
550 recipient unknown
until you some 250s
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
%host -t mx bigpond.com
/ index/
bigpond.com mail is handled (pri=10) by extmail.bigpond.com
so you run your dictionary attack against the server
%telnet extmail.bigpond.com 25
Trying 144.135.24.8...
Connected to extmail.bigpond.com.
Escape character is '^]'.
220 bigpond.com service ready (identifier 29/4290323)
helo numpty
250 bigpond.com
MAIL FROM: <>
250 ok
RCPT TO: <aardvark@bigpond.com>
550 recipient <aardvark@bigpond.com> unknown
RCPT TO: <apple@bigpond.com>
550 recipient <apple@bigpond.com> unknown
RCPT TO: <mr_brianpowell@bigpond.com>
250 ok
and every 250 is a valid paid up customer
and there's not a long entry in the world that's going to find you
in fact you can visit http://www.bigpond.com/home/memservices/community
to harvest email addresses like I just did while waiting to post with EXTRANS
still it's more newsworthy if you CHARGE someone for this information !
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
maybee an employee sold them to a spammer.
I have always wondered about inside jobs of this sort.
im sure it wouldnt be hard these days with the compact USB hard disks you can put on your keys.
simply plug it in, transfer all the email addresses, zip it up and send it to your favorite spammer, then collect.
sound easy? yeah... its scary.
When I got my phone connected here, Telstra mis-spelled my name. My name is incredibly uncommon.
... mis-spelled just as Telstra had ( at my company dot com dot au ).
:
About a month later, I was looking through the logs on the mail server at work ( as you do ) and saw an error about an unknown user, which just happened to be made up of my first initial, and then my last name
I immeditately called Telstra and confronted them, and they denied everything. The girl was quite rude about it and implied that I might also have stories about little green men carrying experiments out on my while I was asleep.
I absolutely INSIST that Telstra sold my details, consisting of ( but not limited to )
- my first and last name
- my employer
The above I can deduce from the logs on the mail server at work.