Slashdot Mirror
Where Is Spam When You Want It?
Sean writes "In a complete twist to what everybody else is trying to do these days, I need to attract spam to an e-mail address for a research survey I am conducting. I have submitted a few articles to a handful of Usenet groups, and I have signed up to some general mailing lists but so far I have nothing to show for it. How come by personal account gets 100+ spam each day yet when I try to find it I get nothing? Where should I post my address so that it attracts spam?"
You want spam? You should have put in your email address into the submitted article...
Seems like there's more than a few people suggesting signing up with free porn sites to get spam.
Personal experience?
yeah but if they ask for you email address and you give it to them, it is not spam anymore. spam is unsolicited. you giving them your email says that they can email you. unless they say they WONT send spam, but yeah, thats gonna happen.
If you do this, are you willing to be responsible if someone hijacks the machine and uses it to commit illegal/unethical acts? I know, it's unlikely that this would happen, but knowingly putting an open machine online with the intention of having it compromised is asking for trouble. It's one thing to not know any better, but it's another to be apathetic to the situation.
-- "Complacency is a far more dangerous attitude than outrage." -Naomi Littlebear
Create Several Email Addresses - Be scientific ...
.....
Address 1 - (Control Address) Post No Where and read no messages until the testing time is over
Address 2 - Post On Usenet (Deja.com)
Address 3 - Post In Public ICQ program
Address 4 - Porn Sites
Address 5 - IRC
etc
Ethics and law are two entirely different (and sometimes diametrically opposed) things.
Very true.
It is not illegal to set out a machine to be compromised.
Perhaps not criminally illegal, but I believe the owner could certainly be held liable for damages. Imagine if a virus writer put a destructive virus on a stack of floppies and left them precariously around a public computer lab. When the program on one of those disks gets run by some curious person, don't you feel that the virus writer is at least somewhat liable, even though he didn't "pull the trigger"?
-- "Complacency is a far more dangerous attitude than outrage." -Naomi Littlebear
Actually, assuming there is no labeling, and with the legal system what it is, you could definitely be held liable. Ever wonder why there are warnings to not light fireworks while they are in your hand/mouth? In this day and age, you have to assume everyone is an idiot. If your server does not have a legal disclaimer, you may very well be liable.
-William
God is everything science has yet to explain.
Gun's are designed to kill. Computers are not designed for cracking/spaming/etc. If you leave a chain saw out in your back yard, knowing that the kid down the block is (1) a bit whacked, (2) could be a potential danger, and (3) should not be on your property, are you partially responcible for when he kills some one with that chain saw? Now, what if it is the kid on the next block that could be the danger? Or the next city, county state of country? At what point is it no longer reasonable to expect that the public to know something is a threat?
It used to be enough to run a virus scanner every so often. Now you have to start by patching your systems regularly, then move on to running regularly updated virus scanners, installing and updating firewalls for the network, scanning for spyware, installing and updating desktop firewalls, updating spam filters, chasing drivers, updating applications (add more from the endless list here), all to keep a system going. So I ask again, at what point is it no longer reasonable to expect that the public will know something is or could be a threat?
And at what point does the public feel that it is no longer reasonable to expect them to know something is or could be a threat when it comes to that "harmless little box on the desk"?
Well, if it's a honeypot, it is probably monitored at least somewhat regularly. If it ever does become a problem, someone would be able to pull the plug on the machine, both logically and physically, in pretty short order. Yes, 10 minutes is enough time for someone to do some serious damage with and/or to a compromised system. But a close eye on things should keep the damage to minimum.
My sources are unreliable, but their information is fascinating. -- Ashleigh Brilliant
I think you are entirely wrong in your suggestion that honeypots are irresponsible. Honeypots provide a way to track and monitor the latest exploits and hackers. In fact if a hacker uses a honeypot in his activites he is much more likely to be tracked and caught because he hacked a logged and monitored machine.
Isn't this (more or less) the point of a honeypot?
More or less yes. The major difference is that with a honeypot you make sure that there's only a way in -- you make it impossible for the offender to use the honeypot to carry on attacks from the honeypot. And that does not seem to be the case in this example.