Slashdot Mirror
Attacking the Spammer Business Model
Stephen Samuel asks: "Spammers spam because it's an 'easy way to make money'. They send out millions of spams knowing that 99.995% of them will be ignored, but the other 0.005% of responses are pure gold (Andrew Leung at Telus has an excellent report on the economics of spam). Responses to mortage spams are reportedly worth $50.00 each. What would happen if, instead of technical and legal approaches, we simply started attacking their business model? If people
started responding to just 1% of the spam we received, spammers would drown in the responses, and the mortage spam responses wouldn't be worth an email, much less $50. The Nigerian Sweet Revenge is an example of this. The nice thing about this sort of statistical approach is that it would start to reward spammers for sending out -fewer- emails. (fewer emails -> fewer bogus responses). What other ways can people think of to attack the spammer business models, and what are the expected downsides of such approaches?" Of course, the one major drawback to this is the likelihood of more spam, since you'll be giving them a valid email address. However, many of you may be receiving increasing amount of spam as it is (even through your filters) so might an organized spam-the-spammers movement work?
The top 1% of spammers who can afford the bandwidth and the hardware could still theoretically handle the volumes of email they would receive. Then they just have to expand their operations to go after the potential business contacts.
Now what about sending them bogus email addresses and phony information? That would send them on a wild goose chase.
Homestarrunner.net -- It's Dot Com!
They work by flooding us with crap, hoping that they get one in a million to answer. We could fight them by flooding them so they have to look through a million emails to find the one legit order. Hmmm...
Sorting through a pile of junk to get the stuff you're looking for. Sound familiar email junkies?
Refuse to make a statement in your sig!
Those are usually just spams sent out to verify valid email address and filter out bounces, etc so they have a "cleaner" (I use that term in a very loose fashion) list to use for their actual "real" spamming operation.
How long will people pay spammers $50 a referral once it becomes clear that 99% of said referrals are for non-existent names and addresses?
I'd say the vast majority of spam that I get is just a vehicle for delivering a URL. The spammers don't want a reply, they want you to go to their website.
Frequently, I get spam that seems to be selling NOTHING. The reply-to is invalid, and they don't bother including any kind of URL.
On the bright side, the vast majority of my spam gets caught in the filters - so I only see it if I check the spam folder. And may the spam rot there...
---
DRM is like antifreeze, to the MPAA/RIAA it's sweet, to the consumers it's poison.
It feels good to cost the spammers some money, even if it does waste your time to do it.
...is that the majority of spam I receive has forged headers, so I would in effect be sending the bogus replies to some poor sucker who had no idea their email address was being used as the "From:" header in a major spam operation.
The number of spam emails that get through SpamAssassin because of forged "From:" headers is ridiculous. And worse is the number of bounce messages I get because someone has used my email address as the "From:" header in a massive spam mailout.
Most of the spam I receive doesn't ask me to reply to purchase anything. They simply direct me to a web site of some sort. This eliminates mass-email replies as a possibility. If they use web forms, they can easily tell legitimate orders from phony ones by verifying the credit card numbers, phone numbers, addresses, etc.
It doesn't distinguish between good guys and bad guys. In fact none of the "automatic" schemes mentioned do. Say the spammers decide they hate Paul, they can very easily deliver several spams pointing to his web site/email address/phone number. Remember that the cost of sending extra emails by a spammer is pretty much zero.
The spammers are already picking on the anti-spam people.
So how will your auto-responders etc tell the difference between bad guys and good guys?
Wow, what an easy way to DDoS. Just send out a bunch of Spam with a link to your least favorite website. The spam filters take care of the work for you.
If we all used anonymous remailers, they could simply filter them out and then they would have the legitimate responses. The only way this would work, (and it probably woulnd't unless everyone id it), is for the responses to be as real as possible, from real email addresses. That way they have to spend the time and effort to follow up on the leads. All 10 trillion of them.
Finally, your assertion that it would incentivate less spam from individual spammers is wrong, since the ratio of fake to real responses is the same for a large mailing list as it is for a smaller one. In other words, you have "constant returns to spam." The only way it would incentivate less spam is if you managed to drive some of the spammers out of business. More likely, it would lead to more spam, as spammers scramble to find more addresses to offset their lower "spam margin."
Well, not necessarily. The trick is to craft "leads" that are obviously bogus to a human at the mortgage company, but aren't easily filtered by a machine.
What makes this especially interesting is that, in other words, it's precisely like creatng spam designed to get around spam filters.
With names that are obviously bogus to people, but mot machine, the bogus "lead" is either
- sent to the mortgage company, which realizes immediately that the "lead" leads nowhere, and pretty soon that too many of the spammer's leads are bogus;
- or, you make the spammer himself weed out the bogus "leads" so as to keep the mortgage company as a client.
The mortgage company (or the spammer, if he's weeding) will quickly realize that "Felix Thecat" and "Kiss M'Ass" are bogus. "Heywood Jablowme" might get by a weeder, but won't last too long at the mortgage ccompany. "Gloria Mundi" probably gets several calls before somebody at the mortgage company remembers high school Latin or a Roman Catholic upbringing.While a dictionary of first names will allow some machine weeding, could a 95% coverage of last names be built? What percent coverage of last names is needed to keep a mortgage spammer from being dumped by the mortgage spammer? What's the distribution of last names? Help me out, Slashdot.
Opinions on the Twiddler2 hand-held keyboard?
The amount of money MC/Visa stand to lose is a drop in the bucket. We've seen time and time again these companies trade a few bucks for their public image.
The bread and butter of the credit companies lies in standard retail purchases.. The idea here is that by exerting pressure on the credit card companies you can cut spam off at the source (the companies who finance it in the first place), as their lifeblood is most definitely in credit card purchases. In other words, they have much more to lose than MC/Visa do. At the same time it exerts tremendous pressure on the middle men who create these accounts in the first place.. they MOST DEFINITELY need the support of the credit card companies or they don't have a livelehood.
Assuming the fundamental thesis is true (these companies are in fact breaking the law with spam), this is the most plausible plan of attack I've seen yet.
Turn s60 photos into awesome videos with mScrapbook for all S60 3rd edition phones!
Absolutely the best post in this whole thread. Bravo.
The need to process credit cards is the weak link in much of the spam business, and it is very hard for them to work around an inability to obtain the services of a merchant credit card account.
Weaselmancer
rediculous.
What is the source of the info that spam works? That's right, it's the spammers. Spammers tell you that spam works. Bzzzzt! Rule #1: Spammers lie!
Who are the spammer's customers? No, not you who get the spam. The spammer's customers are those who order spam services. And there are enough idiots who buy spam services to make those 180 spammers very wealthy.
Even though the spammer's customer get burnt once and stop, well, some of them are probably stupid enough to try several times anyway, there are enough of these morons to keep it going for a very long time.
They're not making a single sale, not even 0.0001%, but that doesn't matter, because the spammer got his money, and that's why this continues.
So, if you want to end spam, forget the spammers: Go after those who purchase spam services instead.
Well, that's my theory. It may not hold up, but after all, this is /.! :-)
Employee of Inrupt, Project Release Manager and Community Manager for Solid