Slashdot Mirror
From Artist To Spam-Hunter
I am Kobayashi writes "Wired has a story about Andy Markley, a graphic artists, whose business domain name was spoofed by infamous spammer Eddy Marin and used to spam thousands of people. After the incident recurred at a new ISP, and at the risk of his business and sanity, Markley fought back. He tracked down Marin through several spoofed email addresses and several hi-jacked servers, and eventually was successful in getting Marin's current ISP to shut down his account. Too bad he was a graphic artist and not a professional bounty hunter...."
Get 10,000,000 more of these guys and major domains will start accepting mail from innocent bystandards like me that are unlucky enough to be on small subnets again.
You can't judge a book by the way it wears its hair.
Spamming is such a dirty business that most spammers will commit some illegality somewhere. Their character is rarely that of a saint. And most ISPs will do anything to keep a spammer off of their bandwidth. So if you go after a spammer, there will probably be some dirt to smear him with somewhere.
or, for that matter, hilarious [insert any artist] jokes as well.
-knowles
Here we see the Spammer in his native environment, lets pull his network connection and see if we can get him rialed up. Crikey, look at em dial tech support!
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
hey, how comes your 'I, for one, welcome...' is rated +2 as funny, while mine always get -1 as troll?
That's unfair!!
-snif-
Verio is notoriously spam- and crime-friendly. So much so that I wouldn't be surprised if their management sold their children out to child pornography websites.
As for convicted coke dealer Eddy Marin, he deserves horrible and painful death for his actions. It's sad that no one has taken him out yet.
STOP MISUSING APOSTROPHES, YOU MORONS!!!
Wow, what a revenge! This has all the exciting hallmarks of the most boring story in the world. He shut down a single ISP account. I'm stunned!
I hope the author isn't holding out for a script-writing deal for anything starring Chuck Norris or Lorenzo Lamas. It's hardly going to get rapped about by Dre, is it?
From Artist to Spam-Hunter to zzz...
'Thats they exact same thing a banana wrench monkey.'
If you want to do the same thing as this guy, try using SpamCop. Paste the entire email (with headers, duh) there, and it will backtrack the message to where it originated. It will tell you which company it came from, which one is being advertised, etc. For the especially lazy, it will also allow you to send a carbon-copy form letter to all parties involved. Best of all, it's free. Consider donating though, it's worth it.
Qualified candidates must be professional bounty hunters with verifiable experience and verifiable references.
Yes, my name is Boba Fett and I worked for a Hut called Jabba -- this was a long time ago and in a remote galaxy. During my tenure with Jabba, I successfully tracked and captured Han Solo, wanted for failure to pay back a sizable loan.
I'm fully familiar with the use of various weaponry, grappling hooks, and personal rocket packs. I have also done consulting work for Mr. Vader, a well known businessman who spearheaded the creation of a large spherical space station.
References available upon request.
Want to improve your Karma? Instead of "Post Anonymously", try the "Post Humously" option.
So, this is identity theft. Why cannot spammers be prosecuted for assuming somebody elses "identity" and doing business/making money at the expense of others? This practice is illegal and there must be a legal precedent, yes?
Visit Jonesblog and say hello.
.. literally foaming at the mouth," Markley set out to track the spammer down.
And I'm literally laughing at the rabidness of prolific spamers.
i expected a "and he torched the spammer's luxurious mansion in revenge" kind of ending... :(
Finally, something to fill in the ????? in my
- Linux
- ?????
- Profit!!
business plan. Now I don't have to hide my email address(es) anymore!-- Stu
/. ID under 2,000. I feel old now.
Too bad he was a graphic artist and not a professional bounty hunter....
;)
Or a maniac with a sharp butcher's knife...
The scam almost cost Markley his business, his reputation, his website and his sanity. His Internet service provider wouldn't help him, despite the fact that his computer and his e-mail account were being overwhelmed by an avalanche of spam-spew that made it impossible to do business or even collect his personal e-mail.
Again, working at an ISP, we cannot dictate what a user can or should not receive. He should have installed filters. Now I know I will get flamed for saying this, but when flyer distributors come around, does anyone beat their ass or track them down. Now I know that there is a difference in volume, which is why if I had one million fscktards throwing flyers at my house, I would let loose the rottweiler. Get a filter, and if your ISP doesn't do shit change ISP's. Any ISP however will not filter spam from coming into their networks because for one, no one should dictate what someone should or should not receive. My two Lincolns
MoFscker
Most can't do anything about it coming into their networks. Going out yes, but coming in, there is nothing that can be done unless every single customer agrees that spam should not reach their mailbox. See in order to add those kinds of rules to a router, it has to correspond to all. No ISP is going to update multitudes of routers to add one rule for one person.
MoFscker
It would be great if governments like the U. S. gave 15 million dollars to a new force to track down spammers. The penalty for spamming is now 5 years in federal jail. 50 million people signed up for the national no-call list. I bet millions would back such a SPAM squad. It is too bad the government doesn't seem to care.
Although the logistics of such a plan are always complicated, why not author laws that would hit spammers where it really hurts: their financial institutions!? Since you can buy the shit from these bastards, you should be able to determine where the money is going. So make laws that would seize any such moneys that are a direct result of SPAM activity?
Hell even put the onus on Visa/MC/AmEx so that they are charged with dealing with the financial fallout! Do you think even the idiots who buy shit form SPAM would buy again if they were charged double for their purchase (once from the spammer and again from the credit card company for the penalty)? Sure there are bugs in the plan as is, but stopping SPAM from the technical side is difficult (if not impossible), so lets make it financially infeasible!
"1984" was ment to be a warning, not a guidebook. You hear that Kim Jong-il!? BushCo?!
A scenario: Someone damages you, but it is hard to figure out who it was. You spend money and/or time and track them down. You succeed, and sue them.
Can you include the cost of tracking them down in the damages you are suing for?
Can you sue for more than your actual costs, to account for the risk you took that you'd be unsuccessful in tracking them down (hence your time/money would be gone with no possibility of being repaid)?
Quattuor res in hoc mundo sanctae sunt: libri, liberi, libertas et liberalitas.
How might people who receive faked messages track the messages to a source with minimal effort?...
Or a very large homosexual rapist. Let's see him spam his way out of that.
That's our life, the big wheel of shit. - The Fat Man, Blue Tango Salvage
This is more than just sending off a single email to a scantly watched abuse email.. This means getting hold of a real person and explaining, realistisay, what sort of legal liabilities they might be open to if they continue to support the spammer's actions. (Hacking laws, aiding and abetting, Trademark infringement and vicarious liability) often fit in there.
If more people would do this, life would get a lot harder for spammers.
Free Software: Like love, it grows best when given away.
Of course, [Boba Fett] died in the belly of the almighty sarlaac.
....
Are you sure? As I recall, the fate of those trapped inside the almighty sarlaac was to be slowly digested over many years
-kgj
While spam is certainly all wrong, I don't appreciate it much... I guess I just haven't unappreciated it enough to get off my lazy butt and do something about it.
And it wouldn't even have to be as low as 100... 1,000 or 10,000 would seriously cut down spam without affecting innocent users.
"And there be unix which have made themselves unix for the kingdom of heaven's sake." - Matt. 19:12
I'd never advertise who I am or take any credit. I get enough retaliation from spammers as it is.
He has no idea, he is a marked man now. Very naive to take public credit.
"limited to say 100 e-mails a day" I assume you mean sending no more than 100 emails a day. Not a bad idea, until some liberal judge decides you're infringing on peoples "free speech" rights, such as the recent decision by a Federal Judge in Denver regarding the Do Not Call List.
Pete Carr Owner Chatmag.com
So human resources at a >100 employee business can't send a quick message to every employee? At some point there will be a legitimate reason to send out multiple messages. A law like that would basically kill off telecommuting.
I've hit Karma 50 and gotten a Score:5, Troll... I win!
I'm really surprised this was modded up. There are millions of people for whom that number is either too high, or too low. And that is true for all integer values of x! Not only would it be profoundly ineffective, it would also be practically impossible to enforce.
Paul Anderson
"I drank WHAT?!" -- Socrates
100 E-mails a day could hurt some of us that have legitimate businesses that also have a monthly newsletter that requires we send hundreds of E-mails every month. We send each individually and do not bcc or cc the entire list (automated program). So, everything can't be black or white -- on or off. We need to allow legitimate use of mass E-mails while controlling spam at the same time.
Banjo - The more I know about Windoze, the more I love *nix
How on earth would this system be done, technically? I mean, ok, if the spammers were sending mail through their ISPs SMTP server, it could be done.
However, most spammers seem to rely on open relays to send spam through. So unless the ISPs monitor all port 25 traffic, and parse it to determine the number of emails, there's no way they could block it. Not to mention I'd leave any ISP that did this as soon as I'd stopped swearing at them. And of course, encrypting the traffic between the spammer and the relay (like SSHing into a rooted box before spamming) would nullify this technique anyway.
Just because you're paranoid doesn't mean there isn't an invisible demon about to eat your face
or you could assume I meant something clever involving the following of open SMTP standards that don't descriminate on namespace but rather by server usage or proofreading habits.
You can't judge a book by the way it wears its hair.
That is internal mail. You don't count that... and if a person sends a complain about his employer sending email... well, that moron won't keep his position for much time...
"Very simple. EVERY single ISP should be REQUIRED by law to implement a system where each user is limited to say 100 e-mails a day. This would stop much of the spam."
Um no, it wouldn't. Just build a mailserver and put it on your home account.
"Derp de derp."
I had exactly the same thing happen to me.
The spam in question was a pharmaceutical firm, and one morning I got just about 50 'undeliverable mail' messages with my email address as the sender. I never got any complaint letters, and it hasn't happened since (that was about Sep 21, 2003 give or take a day).
I figure I never got the flak because no one ever comes to my site anyway...
Michael in Toronto
Cheers, Michael From sunny Toronto
How is someone advocating someone's death modded up as interesting? I'm not sure who is more disturbed in this case.
Eat recycled food - it's good for the environment, and OK for you.
There's nothing wrong with dealing coke.
Spamming, on the other hand....
Grandparent is talking about telecommuters - so, no, it wouldn't be internal mail.
Just because you're paranoid doesn't mean there isn't an invisible demon about to eat your face
IANAL, but if this guy has as much evidence as he claims to against this spammer, he needs to sue the spammer. The spammer is knowingly committing an act that he knows will cause damage to the business that he is effectively "impersonating". He is doing it to turn a profit from an illegal activity. If proof of this act is available, the victim here could be looking at a pretty stout judgement. If this guy made $750,000 spamming people last year, there's a good chance he'll be able to find an attorney who will pursue this on a contingency basis.
And IIRC, I'm pretty certain the victim can sue the spammer from his home state (especially nice since the spammer is on the opposite end of the country).
What has *science* done?!? -- Dr. Weird (ATHF)
Check this out.
This would cause too many problems for legitimate people.
My solution would be mandatory authentication. Require all mail relays & servers to create and use a cryptographic key and register it on a P2P authentication network. Plenty of signature algorithms are available for such purposes, read Applied Cryptography to learn more. That key is used to sign all emails coming from or being relayed through that system. All emails must be signed by the originating system, and any other systems it passes through, making a cryptographic trail of bread crumbs back to the sender. Any emails without a signature, or with an invalid signature are silently bit-bucketed, with NO EXCEPTIONS. If ISPs let unsigned or invalid messages through, spammers may be able to get spam through and disguise their origin. The crypto signatures prevent spammers from forging headers or otherwise obfuscating their origin, and any spammer trying to send email through this system will be immediately tracked down and blocked, and their admins contacted with requests for a TOS for the spammer, with threat of blacklisting if the spammer is allowed to continue. In short, it should prevent spammers from forging headers to make the spam appear to be from legitimate systems, thus eliminating stories like this one.
In order to prevent abuse of the P2P authentication network, any member of that network can sign other server's keys, encouraging members to get keys signed by trusted parties (which will naturally emerge). Spammers who constantly change their keys to avoid being blocked would be refused an endorsement by the trusted key signing parties. The trusted signers can be anyone from the US Government to a local ISP who took matters to their own hands and built their own network of trust. If a key signer endorses too many spammers or blacklists too many non-spammers, mail admins are free to stop using that signer and switch to one that's more trustworthy. If a key signer endorsed a key from someone that turns out later to be a spammer, he can issue a signature revocation.
Ideally, the system will ensure that spammers are immediately blacklisted minutes after the first spams are caught, and that that information is propogated quickly enough to enable thousands of mail systems to block emails from that spammer, and that attempts to evade the system are quickly caught. It would enable people to come forward as signing authorities so mailers have a better idea which systems they can trust to stay legit, and it would make sure that incompetent or malicious signers are easily ignored.
Meldroc, Waster of Electrons
Technically the mouse is mightier than the mouse.
- Bayesian filters (or similar) on the SMTP servers, analyzing and SPAM-rating e-mail on a line-by-line basis, as it is inbound to the server.
- Packet-by-packet connection throttling of all connections to the SMTP server, based on the current SPAM-rating of the open connection.
All mail will get through. There are no false-positive or false-negative issues to deal with. There are no freedom-of-speech issues to deal with. But SPAM works only because of VOLUME and this will drastically reduce the volume of SPAM that a server can send, making spamming unprofitable.Not my idea -- someone else suggested the scheme a while back. I wish I could remember/locate a reference.
There are days I _write_ and send well over 100 emails, as the owner of a medium sized web hosting company I send lots of email. I also recieve a LOT of email.
I wish I had a simple elegant solution to spam, the challenge/response is somewhat decent for normal users if implemented properly and used properly big IF there. Bayesian filtering is ok but again only if you work at it, plus it doesn't stop the spam taking up our bandwidth, just the end user from seeing it (if they decide to trust the filters).
Using spamcop and open relay blocklists helps some, we also have an inhouse rbl where we add ips that spam us so at least they can't get us again. But this doesn't stop it all, maybe 50% or so I guess.
In any one day our servers get millions of spam messages, and I only host about 12,000 websites, imagine the big guys.
--- www.f-theocean.com
No, not really. There is no requirement that mail must be sent through an ISP's SMTP server. For example, I run my own mail server, and I send mail direct: completely bypassing my ISP's mail server. This improves performance and eliminates my dependence upon their server ... my mail goes out whether their system is up or not.
The higher the technology, the sharper that two-edged sword.
Drop in the bucket. It wouldn't affect spam generated from foreign countries one whit. That's the whole problem ... it's a global phenomenon, which means that the solution will have to be technological, not legal.
The higher the technology, the sharper that two-edged sword.
...but I already did this 371 times inside of a year, back before spam took over the Internet and it was still a solvable problem.
Yawn...
p
In Korea, long hair is for old people!
Good point.
:)
How about make it possible to send more, but you have to demonstrate a need and ask for the privelege, thereby making your identity much easier to establish should you suddenly start abusing the system a la herbal-viagra-toner-university-diplomas? In any case, there would be, in 99.999% of cases, an upper-limit on the number of emails anyone could ever reasonably need to send in one day, and I'm guessing it would be under 1e6 in almost every case. If you have 10k employees, I don't think anyone would be terribly miffed if you broke that up into two batches of 5k/each over two days. Or one batch at 11:59pm and another at 12:01am if you really have to be fair, such as, oh, I don't know -- when sending out the company scavenger hunt list?
Seriously though, don't be so quick to shoot down a fairly-reasonable suggestion that might be workable after a little thinking and tweaking.
everything in moderation
How would this "only 100 outgoing messages per user per 24 hours" rule allow for senders of legitimate solicited bulk mailing lists such as EFF's, Sourceforge's, Bugzilla's, Slashdot's, etc?
Will I retire or break 10K?
This is from my previous post on the subject, and outlines my plan for eliminating spam, worldwide.
... no problem. Just give us your email address and we'll PayPal you the money. Don't have Internet? No problem: we'll get you the money. My research indicates that, if my plan were to be implemented on a sufficiently wide scale, we could expect to see the end of Spam by next Friday.
Now, fifty to one hundred thousand dollars per spammer may seem excessive, particularly as these people are already intrinsically worthless. However, if you look at the numbers, the worldwide savings that will accrue from not having to accommodate spam will be dramatic, and will far outweigh the actual disposal costs. Furthermore, I am sure that once the ball is rolling, we can count on additional help from our friends and allies around the world.
Of course, some of our {ahem} less-enlightened neighbors might object to our putting out what might appear, at first glance, to be a "hit", or contract, on their nationals. But as soon as senior bureaucrats, heads-of-state, industry leaders and their secretaries begin to notice the comparative emptiness of their in-boxes, I firmly believe that they will quickly come 'round to our way of thinking.
Offer a reward of, say, $50,000 for every bona-fide spammer brought in alive, and double that if he has already assumed room temperature. The beauty of my scheme is that it, like the Internet itself, knows no borders. If someone successfully manages to capture or whack outright a spammer in, say, Nigeria
The higher the technology, the sharper that two-edged sword.
- limited by law to 110 emails a day
- limited by law to 100 emails a day
- limited by law to 90 emails a day
- limited by law to 80 emails a day
- limited by law to 70 emails a day
- limited by law to 60 emails a day
- limited by law to 50 emails a day
- limited by law to 40 emails a day
- limited by law to 30 emails a day
- limited by law to 20 emails a day
- limited by law to 10 emails a day
- limited by law to 5 emails a day
- limited by law to 4 emails a day
- limited by law to 3 emails a day
- limited by law to 2 emails a day
- limited by law to 1 emails a day
- limited by law to 1 emails a day, reviewd by government
Tell me at what point you agree with this hypothetical "liberal judge" that "free speech" rights are being infringed. Can I call you a fascist without the moderators calling this flamebait?XML causes global warming.
It really isn't obligatory at all. Really. I swear. In fact, it's highly discouraged nowadays since it's not in the least bit funny anymore.
Only a slashdot poster such as yourself can pound a joke so hard and for so long that even a great Simpsons' line makes me queasy when I read it. But I have to hand it to you -- you, my friend, are clearly the master of pounding it long and hard. But please don't feel obliged in any way.
You can take a rest any time and no one will miss it. Except for possibly your local Kleenex(TM) and/or hand lotion distributors.
everything in moderation
WCG.net, and told the tech support staff what had been happening. Within a few hours, Marin's account had been canceled.
/24s. Then they feign this concern by "shinning" on those who complain about their dubious customers. Why don't someone ask them about Wholesalebandwidth.com/Optigate?
c efile=1114
Baloney! It is likely that they told Marin to change the domain name before Markley sues and WCG loses their big bonus blood money.
But WCG sounded sincerely surprised to find out the infamous Eddy Marin was one of their customers."
Rule #1! Williams Communications Group is notorious for continuously providing bandwidth to spammers with dirty
Anyone who wants to know about Marin and his scum operation can see it on Spamhaus.org:
http://www.spamhaus.org/rokso/search.lasso?eviden
!@#$% whole-grain cereal. When I want fiber, I eat some wicker furniture. - G. Carlin
if this guy makes as much money, can people not sue him? i'm surprised no predatory lawyers launched a case against him yet.
I for one welcome our new vigilante overlords! Let's kill us some spammers!
--fetch daddy's blue fright wig, i must be handsome when i release my rage
No one does spam filtering at routers.
There are filters and blocklists, but they have nothing to do with
routers. Long ago particularly egregious spammers were blackholed at the
router level, but that hasn't happened for years.
No ISP can stop all spam, but given enough resources we can stop most
of it. The problem is usually somewhat like you allude to, that there
is a certain set of people with an absolute horror of a non-spam
message being bounced. They claim "loss of email", and thereupon close
their ears.
But there is a more insidious foe, the scan-and-delete error.
Most admins today have two basic ways to stop spam -- blocking and user-
based filtering. Blocking rejects spam detected (via filter or
blocklist) and puts the onus on the sender to re-establish the
communication. User-based filtering puts the onus on the recipient to
review their spam folder and look for "false positives".
And there are three ways to play your two tools.
1. Little or weak filtering or blocking means communications are lost as
people have scan-and-delete errors due to battle fatigue from their
daily fight with spam in their mailbox. Much legitimate email is
lost, and it is lost and *neither party knows it was never read*.
This collateral damage is spread over every part of the net,
spam-friendly or no.
2. Aggressive filtering and tagging for dropping in the user's "spam"
folder means that legitimate communications are tagged as false-
positives. People usually don't scan their spam folders carefully,
because such a high percentage is spam. Again, legitimate email is
lost and *neither party knows it was never read*. This collateral
damage is spread over every part of the net, spam-friendly or no.
3. Aggressive rejection of email via blocklisting causes some legitimate
email to be rejected. However, that collateral damage is limited to
spam-friendly parts of the Internet. The sender knows full well it
was not read and can re-send the message via another channel if it is
important. This knowledge also allows them to take action to correct
blocking errors; and heightens awareness of who is not doing their
part to fight spam.
To me, selecting #3 is a no-brainer. When legitimate email gets lost,
the sender knows it was not received. And it is almost all lost from
networks participating in the massive denial of service attack on the
Internet at large that is spam.
AOL, for example, does a simply outstanding job of making sure spam is
not sourced from their network. They don't allow spam hosting of any
kind. I *never* want to lose mail from them. Same with Earthlink, MSN,
and Hotmail. They deserve that consideration due to their effort. If my
users lose mail from them due to scan and delete errors, I have not done
my job. I would much rather have them lose email from the people who pay
the spam-friendly providers. (And no, folks, those fake hotmail.com
addresses in the From line don't mean they source spam.)
You can do filtering at the MTA level too with rejections, but I don't
do that except with filter settings that have a near-zero false-
positive rate.
First Noah's Flood of spam, then isolation and even blame, and now his server gets Slashdotted to death ;).
. ~/.sig
So what ever happened to that great idea of including RMX records in zone files? It would 100% eliminate spam like this (which accounts for the vast majority). I haven't heard anything frome either qmail or sendmail implementing it.. which sucks.
See, the reason I'm so big on this, is because I consulted at implementing this at Shadango.com (a new, free, filtering service). We started performing reverse lookups and you would NOT believe the filtering success. It was like day and night. So seriously.. try implementing that on your mail servers and see what happens. And if you're just curious and want to see how effective it can be, check out the implementation at Shadango.com
-Fatty
The spammer was forging mail from one of my domains. Since the domain name was a registered trademark, I had some extra leverage. ISPs have a "safe harbor" for E-mail content, but not for trademark infringements.
I ignored where the mail was coming from, and concentrated on where the money went when you placed an order. The spammer had two phony "billing companies", with phony addresses. Accepting credit cards without providing a valid business name is illegal in many states, so, by sending appropriate letters to the ISPs that hosted his billing sites, I was able to turn off his income stream. The sites reappeared on other ISPs, but with some work, I was able to get his domain registrar to lock some of his domains.
This is an effective tactic. If you file an "incorrect whois data" complaint with the Internic, and the registrar can't contact the domain owner, the domain goes to "locked" state. Then, if you get the hosting company to dump them, they can't move the site. In this case, the spammer operated his own DNS servers (triply redundant, on different ISPs), so I had to get all of them kicked off various ISPs.
By now, I'd had this guy kicked off ISPs from Dallas to London to Sao Paulo. This was made easier by the fact that he was paying for much, if not all, of his hosting with stolen credit card numbers. Since his porno sites generated credit card numbers, he could keep signing up for new hosting accounts with his customer's credit cards. That doesn't work once the ISP knows who to look for.
Finally, the guy retreated to his home ISP in St. Petersburg, Russia, where he apparently felt safe. That took a while to crack. I found out that the upstream provider used by the small St. Petersburg ISP was a larger telecom company in Moscow. That company was in the process of doing an initial public offering on NASDAQ. I talked to their investment people in New York, and eventually received a call from the Russian telecom's CEO. It turned out that we had some friends in common, and that he knew about the small St. Petersburg ISP as a known problem.
With that connection, I had some discussions with the St. Petersburg ISP, which kicked off the spammer. He came back with new accounts the next day. I got those accounts closed. This went on for several weeks. Finally, after some additional prodding, the St. Petersburg ISP shut the guy down and kept him shut down.
It's been months now, and the spammer's content is nowhere that Google can find it, so he seems to be out of business.
The key to dealing with spammers is to follow the money. While dealing with this problem, I talked to bankers, the people who developed his billing system, and a company to which he'd outsourced web design. Eventually, a picture of the spammer emerged. This was basically a one or two person operation devoted to stealing credit card numbers. Once I knew that, getting cooperation in shutting the guy down was reasonably easy.
Trademarking your web site name gives you some additional legal options, and is definitely worth the $450 or so it costs. When you raise a trademark issue, the problem escalates to the ISP's legal department, and you're no longer dealing with the customer service people.
Once you get to the legal people, and fraud is involved, you can point out that the ISP, once informed of the problem, is knowingly aiding and abetting a fraud scheme. This usually results in quick action.
It's always useful to check business license and corporate filing data. If you find a Whois entry for Phonycorp, Inc. at a Mail Boxes Etc. address, find out whether the company has a business license (where required) and is registered as a corporation in the state. If they don't, they're doing business illegally. So report them to the IRS, the state tax authorities, and the local authorities. ("Hello, City Assessor's Office? I'm trying to locate the offices
Not that I would dispute the accuracy or honesty of someone who makes a living from such activites as spamming and (apparently) dealing coke... but...
Ya suppose all this money Eddy likes to gush about in interviews comes from an activity other than spamming? Wouldn't spamming make a great way to launder income. Its already a shady, though not entirely illegal business. It wouldn't be too odd to have a customer base that's a litle difficult to trace. And it would explain a solid income without any apparent labor, contacts, or business partners.
(not that this little conspiracy theory has plenty of holes - but hey, that's not the fun of it)
to be a bounty hunter to hunt and shoot at things.
Crisis is the rule, not the exception.
Comment removed based on user account deletion
Comment removed based on user account deletion
I say Spam Hunters should have baseball bats and frequent flier miles to go with their traditional tools...
When I try following your link, I get redirected to a Japanese casino site that tries to force malware onto me. What's going on here?
The only thing necessary for the triumph of evil is for good men to do nothing. - Edmund Burke
How is someone advocating someone's death modded up as interesting?
Because spamming is such an unusual crime; one that our society is still coming to grips with.
What other crimes have the property of a single offense affecting millions of people?
Our society considers murderers among our worst criminals. We measure the crime of murder not just in terms of the suffering caused to the victim, but in terms of the suffering caused to all those affected by the crime.
When we consider the crime of spamming, any attempt to measure or quantify the aggregate suffering caused to all of the people that were directly affected by a particular instance of spamming overwhelms the senses.
How does one deal with a crime that causes suffering to millions of people every time it occurs? What is an appropriate punishment? Given the nature of the crime, it is possible to argue rationally for almost any punishment.
That is why proposals for the execution of spammers is viewed as "Interesting" by some.
3. Aggressive rejection of email via blocklisting causes some legitimate email to be rejected. However, that collateral damage is limited to spam-friendly parts of the Internet. The sender knows full well it was not read and can re-send the message via another channel if it is important. This knowledge also allows them to take action to correct blocking errors; and heightens awareness of who is not doing their part to fight spam.
Anyone who reads somethingawful.com knows that this isn't necessarily the nobrainer that you think it is. They had a particular problem where people would be able to sign up for their forum accounts, but they could not be mailed back with the activation because of the SPEWS blacklist determining that the part of the internet SomethingAwful belonged to was Spammerville, USA. This meant that 10-20% of the people who tried to get a forums account couldn't be mailed back, and SomethingAwful could even mail them back to explain why!
Here's a nice link for the angry rantings of Zack "GeistEditor" Parsons on the subject. Yes, we should fight spammers at every turn we get, but the "collatoral damage" means that some people can't even find out why they never get a reply from their girlfriend/grandparents/long lost friend.
a) Unless the actually catch the spammer or trace to the distribution source, how do you tell what is bought from a spammer VS not (there's also legit sources, ebay, etc
b) You may argue fining the company for whom the spam is soliciting a product... but if you look up the term "Joe Job" you'll see why this isn't a great idea either.
Well now! All I have to do is successfully send spam from my roommate's computer, whack him, and you will paypal me 100 large to Zurich? Hmmmmm. 100,000 big ones and a double room to my self? I gotta go get a banker and a good lawyer.
"No beer until you finish your tequila!" -Leela's Dad
testing out my trending skills
ever sence the first pop up on aol thers has been internet spam now i will admit withen the last 2 years it has gotton worse from spywhere to pop ups to toolbars you cant uninstall without a spyware removing program. relly the goverment relly needs to limint what they can do i mean hell spywhere is just as bad as a virus it steals info and sends it to third partys hell a torjin virus does the same just sends diffrent info. to tell the truth thats part of the reasion i dumped windows for linux lol you dont have any form of spam/spywhere other then email but a simpl spam blocker fixes that to.
I agree, I run a Yahoo! group with about 800 subscribers for our ski club. This works well and people only see newsletters and meeting reminders so not a very high volume. We need the bulk email and like you our subscribers are genuinely 'opt-in'.
See my journal, I write things there
I haven't seen SPF being mentioned yet.
It's a sistem whereby you, the domain-owner, via DNS records, explains what SMTP-servers (their IP adresses) are allowed to send email with your domain in the From: header.
To me it really does look like a way to kill spam, if it were adopted.
Spammers should be killed, or something. With the size you get with hotmail, its gone in a day :\ Have you seen their prices? its like 36 bucks for 10 megs.. wtf??? ?!
?
"Fear teh chickens.. do not use teh window, use teh curtain." ~ChickenKillr
But please, yeah spam is annoying, but death, Marin doesn't deserve that, no one does
I disagree. Marin has demonstrated time and again that he's a parasite, existing solely by stealing from others. My issue with him is about more than just his spamming past, it has to do with stunts like this one, where he's directly caused innocents financial loss through his actions.
STOP MISUSING APOSTROPHES, YOU MORONS!!!
One spam arrived as I was reading this! And they are still abusing whois/dns. Nice, but this guy has managed to do sweet FA
Relevant supporting evidence attached (my account is hosed, anyway..)
News Story.
-----------
http://www.internetnews.com/
Spam Headers
--
Return-path:
Received: from punt-3.mail.demon.net by mailstore
for johnc@yagc.demon.co.uk id 1A4cHz-0006dB-Fh;
Wed, 01 Oct 2003 08:25:56 +0000
Received: from [24.128.200.166] (helo=h000ae62be489.ne.client2.attbi.com)
by punt-3.mail.demon.net with smtp id 1A4cHz-0006dB-Fh
for johnc@yagc.demon.co.uk; Wed, 01 Oct 2003 08:24:52 +0000
Received: from lcs.mit.edu [59.95.222.125] by h000ae62be489.ne.client2.attbi.com (Postfix) with ESMTP id EDA4562DFCBD for ; Wed, 01 Oct 2003 09:28:33 +0000
Date: Wed, 01 Oct 2003 09:28:33 +0000
From: Tofikequf
Subject: Johnc Receive your Dip1oma 1965936
To: Johnc
References:
In-Reply-To:
Message-ID:
Reply-To: Jolisojap
Sender: Juleka
MIME-Version: 1.0
Content-Type: text/html
Content-Transfer-Encoding: 8bit
Traceroute results
--
3 130.152.80.30 10.121 ms isi-1-lngw2-pos.ln.net [AS226] Los Nettos origin AS
4 198.172.117.161 163.950 ms ge-9-3.a01.lsanca02.us.ra.verio.net [AS2914] Verio
5 129.250.29.136 2.821 ms xe-1-0-0-4.r21.lsanca01.us.bb.verio.net [AS2914] Verio
6 129.250.2.11 6.288 ms p16-7-0-0.r00.lsanca01.us.bb.verio.net [AS2914] Verio
7 129.250.9.210 9.905 ms p4-1.att.lsanca01.us.bb.verio.net [AS2914] Verio
8 12.123.28.130 9.913 ms tbr1-p012201.la2ca.ip.att.net (DNS error)
9 12.122.10.25 13.635 ms tbr2-cl3.sffca.ip.att.net (DNS error)
10 12.122.9.137 12.811 ms tbr1-p012501.sffca.ip.att.net (DNS error)
11 12.122.10.5 54.916 ms tbr1-cl1.cgcil.ip.att.net (DNS error)
12 12.122.10.1 78.542 ms tbr1-cl1.n54ny.ip.att.net (DNS error)
13 12.122.9.130 76.257 ms tbr2-p012501.n54ny.ip.att.net (DNS error)
14 12.122.10.21 81.463 ms tbr1-cl1.cb1ma.ip.att.net (DNS error)
15 12.122.11.194 80.896 ms gbr1-p40.cb1ma.ip.att.net (DNS error)
16 12.123.40.97 80.612 ms gar1-p360.cb1ma.ip.att.net (DNS error)
17 12.125.39.214 81.116 ms DNS error
18 24.91.0.42 81.131 ms bar02-p6-0.wobnhe1.ma.attbb.net
19 24.91.0.154 81.628 ms DNS error
20 24.128.190.57 82.081 ms bar02-p4-0.lwllhe1.ma.attbb.net
21 24.147.0.38 82.124 ms ubr01-p2-0.lwllhe1.ma.attbb.net
22 24.128.200.166 97.001 ms h000ae62be489.ne.client2.attbi.com
/usr/games/fortune > ~/.signature
In my case, the spams seem to come from all over, from several continents. I'm guessing that those machines got owned through some backdoor or exploit, and they are simultaneously sending those spams. I wonder how all of them are simultaneously using my domain in the "from" header. Is there some central control server for these infected hosts that tell them "use this domain in your forged mails"?
There's 10 types of people in this world, those who understand binary and those who don't.
"So unless the ISPs monitor all port 25 traffic, and parse it to determine the number of emails"
Why would you need to parse a connection? Look at the origin, compare to the destination.
"And of course, encrypting the traffic between the spammer and the relay (like SSHing into a rooted box before spamming) would nullify this technique anyway."
I'm hoping that you aren't working anywhere critical. Ignore the content, that approach hasn't worked, but simply look at the volume of traffic.
SSH'ing into a rooted box usually isn't necessary and is overkill. I like your use of buzzwords, though. Nice touch.
Oddly Draconis
Too cynical to live, too stubborn to die.
"Why would you need to parse a connection? Look at the origin, compare to the destination."
Um, that is parsing the data being transferred. When you look at a datastream, and analyze it so it forms actual information, that's parsing.
Monitoring volume of traffic may work, but that would mean penalizing people who transfer large attachments too.
SSHing into a rooted box may be overkill, but it's one way I could think of off the top of my head to easily foil any content analysis of a datastream over port 25. I didn't bother trying to find a light, streamlined approach, as I was merely using it as an example of how such as an idea as the original post puts forward could be avoided. As long as it can be avoided, the approach is stupid. ISPs monitoring, filtering or denying the use of port 25 is a stupid way to prevent spam.
To butcher an oft-used quote: Those who trade their ports for a little temporary security do not deserve ports or security, and in the end, will have neither.
Just because you're paranoid doesn't mean there isn't an invisible demon about to eat your face
"ISPs monitoring, filtering or denying the use of port 25 is a stupid way to prevent spam."
Blocking port 25 stops 100% of spam. That's it's overgregarious is the problem.
The main point of this is that if you try to place the burden on the end-users, a huge quantity of which are still not running virus-checkers, have open SMTP relays and confirm their email address as live at every available opportunity, then the squealing will come from that direction. They demand protection from offensive spam, the ISPs shrug, and guess who steps into the gap?
You really want Government moderating this? I certainly don't because as soon as they get involved, it's like watching a monkey rewire a car.
So far the community of technically competant people have completely failed the more clueless users, but they represent a larger block of people who complain louder. ISPs currently have AUPs coming out of their asses to indemnify themselves against anything, so why not do something about the spam problem _aggressively_.
"Monitoring volume of traffic may work, but that would mean penalizing people who transfer large attachments too."
They're already penalized. 10Mb of storage is considered to be 'a' capacity that is limited, but that would be a single datagram stream/connection rather than a blizzard of smaller connections. The thing is that nothing will be perfect, there will always be cracks, but at the moment there is nothing happening that would cut down on the massive amount of traffic that is floating around the infrastructure at the moment.
My best idea so far is to hit, and hit hard, the companies that 'benefit' from spam, but that gets government involved, and so far they aren't doing that well with tracking back the people using open relays, despite netblocks being submitted, having names, etc. etc.
"content analysis of a datastream over port 25."
It would have no effect on downstream transfer between MTAs. Sure, these days it's point-to-point between the destination and source, but then you'd have an IP in the headers. You could even run destination filtering to check the From, return-path and path statements which would cut down on a minority of spam. Hell, that's how I track mine back.
"Those who trade their ports for a little temporary security do not deserve ports or security, and in the end, will have neither."
You consider firewalls bad, then?
Oddly Draconis
Too cynical to live, too stubborn to die.
I already had an idea quite like this after reading the story on that spammer from .nz who left the industry after getting harassed because his real identity was made public in some local newspaper... Set up some fund which will pay bounty for accurate and valid information on proven spammers, and set up a directory just like rokso at spamhaus.org. Dont really harass them, just give them the bad feeling that we know who they really are...
sick of sigs... *sigh*
"Blocking port 25 stops 100% of spam. That's it's overgregarious is the problem."
That is pretty much what I meant. Stupid doesn't necessarily mean ineffective - it can mean inappropriate too.
No, I don't particularly want governments interfering with this. Quite apart from the legendary technical ineptitude of most governments, you'd have problems with the governments of various countries implementing contradictory regulations and such. I think that the best solution for spam is a technical one.
Filtering is ok, but it's a stop-gap measure at best. Even if it got a 100% success rate, it wouldn't stop the bandwidth wastage spam causes. I'm hoping a bunch of smart people are going to come up with a replacement, or enhanced, SMTP that retains enough backwards compatibility to be slowly phased in over time. The only real answer to a technical problem is a technical solution. Regulations and litigation deal with societal problems, not technical ones.
"You consider firewalls bad, then?"
If it's my machines they're protecting, and I can't reconfigure them, damn straight I do. Perhaps I should rephrase that "control of their ports", but that would just mangle the quote even more. The gist comes through, I think.
Just because you're paranoid doesn't mean there isn't an invisible demon about to eat your face
You may of missed my point. I am NOT in favor of some judge making a "free speech" case out of sending spam. But that is what would happen eventually, someone would challenge any limitations on how many emails a person can send.
I agree that any ISP has the right to set limits for home and business users of their services.
Pete Carr Owner Chatmag.com
No ... all you have to do is bring him in to the nearest police station and they'll take it from there. It will take some work on the part of the State Department, and a few new laws I'm sure.
The higher the technology, the sharper that two-edged sword.
SomethingAwful is a poor example to use in this case. Zack Parsons, in my own hog-fucking opinion, is a child who doesn't understand the basic functioning of email and blocklists and incited the flooding of newsgroup news.admin.net-abuse.email by his idiot subscribers. We saw Zack on the newsgroup and on the above-mentioned page whining like a little girl about his problems.
Oh fucking well. Hosting with a spam-friendly provider could have been avoided. He could have contacted his hosting provider and gotten things straightened out on his own. Inciting his readers to harrass the spam fighters because he got his panties in a bunch over his mail not getting through was a bad move, and I'd think it would be an embarrassment for him.
SPEWS and the "collateral damage" concept are one of the few things that have gotten providers off their asses to remove spammers from their networks. Just because some kid's little chat site gets their mail blocked is no reason for the site's readers to act just like spammers, and probably resulted in somethingawful's mail being even more widely blocked than it had been when only SPEWS was listing it.
"Somebody has to do something. It's just incredibly pathetic it has to be us."
--- Jerry Garcia
The same spammer forged a number of other domains, including mine. I have a page about it at http://www.whitis.com/mypillsrx.htm. There is also another article available at AVN Online.
Eddy Marin, a well known spammer with a history that includes convinctions for cocain dealing, money laundering, and who was involved with pornography, seems to be behind the spam.
In the meantime, his pet lawyer, Mark Felstein, ( check out the cute picture) is suing several people who fight against spam for blacklisting "anonymous members" of his newly created EmarketersAmerica organization, and several anti-spam sites all over are being under DoS attacks.
The spammers are winning because the good guys are playing fair and honest while the spammers have no morals are are making up their own rules.
Anybody that knows the whole story knows that somethingawful.com isn't the innocent victim you claim them to be. And anybody who uses groups.google.com to search for somethingawful.com will be able to find that information.
> Bayesian filters (or similar) on the SMTP servers, analyzing and SPAM-rating e-mail on a line-by-line basis, as it is inbound to the server.
Bayesian filters are but one tool in the arsenal. I have seen them in operation for millions of spam (I work for an antispam company, and no I won't say which), and I can tell you that they're not a silver bullet. Spammers are increasingly padding the message nowadays with text snipped from books, news clippings, etc. Even if it doesn't outright fool the filter, it sure gives it fits. What next has to happen is to get those filters. Another thing going on now is that much spam is contained entirely within an image. Recognizing text out of the image within reasonable CPU time is definitely not an easy problem.
I've finally had it: until slashdot gets article moderation, I am not coming back.
argh, snipped a sentence off there... Meant to say "what next has to happen is to get those filters to recognize subject matter through semantic analysis, so spam can be determined by the actual content, not by mere word proximities." I understand Apple of all people is working on such a beast.
I've finally had it: until slashdot gets article moderation, I am not coming back.
You really have to wonder why they do this s***. If they are not linking to there own web page then how are they going to sell anything? The only benefit is the nigerian money laundering scandals, those are downright funny, one of the few things that is keeping me sane in this world.
"The gist comes through, I think."
.cn TLD because of the huge number of completely open relays...but how are those open relays connected to the internet? That's the key.
To the extent where I'm going to apologise for being a c**t. Sorry.
"The only real answer to a technical problem is a technical solution. Regulations and litigation deal with societal problems, not technical ones."
Spam is a sociological problem in terms of this idea of constantly bugging people to buy stuff. Pretty much every communication method has had to deal with this, but generally you're talking about single bodies that can be asked, cajoled and threatened to stop the transport...fax, phone, mobile...
ISPs made a big fuss about stepping back from the information they carried because of the whole child porn/copywritten content issue, something that came up during the recent senate hearing with the RIAA, and the handwringing that has taken place by them has really gotten my goat. ISPs are the first chokepoint for email entering a subnet...they're in a bloody good position to handle this stuff and personally I'd prefer that this duty wasn't handed over to a Carnivore box because someone was too bloody wet to handle it.
"replacement, or enhanced, SMTP"
Or build a network of trusted SMTP servers with full authentication by using the relay system as is already allowed by SMTP but not used because of the relative difficulty of building a network from the current 'mush' we have.
Hell, I know admins that are firewalling the entire
Given that there's some horrendous inroads by spammers into hacking and DDoS attacks to the extent where RBLS are being pushed off the net, spammers should have their access to the internet cut, which means stamping on open relays until they can prove that they're no longer open.
Oddly Draconis
Too cynical to live, too stubborn to die.
Thanks
I think part of the reason people are reluctant to give the ISPs this sort of responsibility is that then that would make the internet analagous to a telco. The strength of the internet is that it is out of the control of companies (although this position is getting more and more tenuous - cf SiteFinder).
But much as I hate to use the term, this is a prime example of the slippery slop. If we refuse to guard ourselves, and appoint guardians, then we no longer control the system, the guardians do. Somebody has to do something about these problems. You can either do it yourself, and retain control, or give it to others, and lose control.
Maybe there's no choice but to lose control. Maybe the internet population in general just cannot exercise eternal vigilance. But that's the only coin that buys freedom.
- Sorry for the melodrama there, but I just can't help myself sometimes. I wonder if anybody else will find their way down to the bottom of this thread. Nice talking to you anyways. -
Just because you're paranoid doesn't mean there isn't an invisible demon about to eat your face
I say let the spammers have their fun now. I blame both IPv4 and SMTP. Since IPv6 will (alledgedly) assign a unique address to every computer on the Internet, I'm thinking that it will be far easier to track spammers to their location than it is with IPv4. Of course, SMTP has inherent flaws but it's a very old protocol that was first created when we didn't have to worry about useless messages taking out our MXs. The new motto of the Internet needs to be: "If you build it, they will spam." There is, as of yet, no way to protect mail servers from spam. You can take steps to TRY to protect your poor MX, but I can't imagine what would happen if 250 million spam messages hit my MX all at once.
Identity theft is an entire subject in itself. I say we open DNA banks. Gattica did have a good concept there (using DNA). Sort of like a SSN in your blood. Being a mathematician, I don't believe in 100% -- 99% and maybe even 99.99% -- but not 100%. And if anything, the Internet proves that nothing is 100% full-proof.
Seth Anderson BTW, I'm not 23 anymore -- I am TexasCowboy26 now. =)
Plus he spelt Overlords wrong......
I have no sig yet I must scream.
Another thing going on now is that much spam is contained entirely within an image
Does that mean that it's an HTML e-mail, serving up an image from a web server somewhere? (Making it easy to trace back?)
Agreed, Bayesian filtering is but one tool in the arsenal. (Personally, I have a dozen or so white list rules that run on the client prior to putting the rest of the e-mail through a Bayesian filter... The whitelist rules around around 95% accurate, which reduces the amount of work that the Bayesian has to do. (If it gets to the Bayesian filter, 95% positive that it's spam.)
However, we really need to get some sort of reverse DNS system into production so that whitelist rules are more dependable.
Wolde you bothe eate your cake, and have your cake?
Must be some kind of regional thing ... I regularly send mail to Earthlink accounts, but I don't know anyone on AOL. Unless it's just because my Comcast IP just happens to be in an accepted range. I dunno.
The higher the technology, the sharper that two-edged sword.
Dont really harass them, just give them the bad feeling that we know who they really are...
... not all of them illegal.
Well, harassment can take many forms
How about a mail list that is sent out at regular intervals listing the names, addresses, emails and phone numbers of verified spammers. Let the people that receive the list decide what to do about it.
The higher the technology, the sharper that two-edged sword.
Oh, and you would have to get a lot of coverage in the press to advertise the web site. It would be better on the "First Gov. Site"
My last article on slashdot got rearranged mysteriously. You are amazingly right. There is only one problem. 50 million people signed up for the no-call list because it was done by the FTC. 50 million people didn't write letters or send e-mails. Figure out how 50 million people could communicate with government easily and you'll solve this problem. This problem is why special interest groups and businesses control congress. Everyone wants an easy way to contact congress. People are lazy. Who wants to form a special interest group? My solution is convincing a congressman to put up on a web site a "Yes" to no SPAM. The "NO" would be left out so spammers couldn't spam it. Clicking on the "Yes" would vote "Yes" to no SPAM. A link would be sent to your e-mail address and clicking on that link would validate your vote. Then put this system on a site like FirstGov and get press coverage in all the newspapers. This would send a message to those interest groups and businesses that control congress. The public can rule them out. This is more of a pure democracy that I've always dreamed of.
Common guys. How hard is it to figure out:
Eddie Marin ==spam
<|:-(
Darwin award nominee at least.
I promised myself that I would NEVER use html here, but I guess some things are too tempting.
My motto is "POT is US"
Any preoccupation with ideas of what is right or wrong in conduct shows an arrested intellectual development. (Wilde)