Slashdot Mirror
Attacking the Spammer Business Model
Stephen Samuel asks: "Spammers spam because it's an 'easy way to make money'. They send out millions of spams knowing that 99.995% of them will be ignored, but the other 0.005% of responses are pure gold (Andrew Leung at Telus has an excellent report on the economics of spam). Responses to mortage spams are reportedly worth $50.00 each. What would happen if, instead of technical and legal approaches, we simply started attacking their business model? If people
started responding to just 1% of the spam we received, spammers would drown in the responses, and the mortage spam responses wouldn't be worth an email, much less $50. The Nigerian Sweet Revenge is an example of this. The nice thing about this sort of statistical approach is that it would start to reward spammers for sending out -fewer- emails. (fewer emails -> fewer bogus responses). What other ways can people think of to attack the spammer business models, and what are the expected downsides of such approaches?" Of course, the one major drawback to this is the likelihood of more spam, since you'll be giving them a valid email address. However, many of you may be receiving increasing amount of spam as it is (even through your filters) so might an organized spam-the-spammers movement work?
The top 1% of spammers who can afford the bandwidth and the hardware could still theoretically handle the volumes of email they would receive. Then they just have to expand their operations to go after the potential business contacts.
Now what about sending them bogus email addresses and phony information? That would send them on a wild goose chase.
Homestarrunner.net -- It's Dot Com!
what if we sent all the replies through anonymous remailers set up specifically for the task, or even better, had a system that you could foreward all your spam to that would do the replying for you - from an address that would send a random spam back in reply to anything you send it - you would literally spam the spammers.
Those are usually just spams sent out to verify valid email address and filter out bounces, etc so they have a "cleaner" (I use that term in a very loose fashion) list to use for their actual "real" spamming operation.
Here's a link to the article.
http://www.paulgraham.com/ffb.html
It feels good to cost the spammers some money, even if it does waste your time to do it.
The only downside is I don't think many spammers use this approach, but it'd certainly be effective against those who do. I don't think it'd be illegal (as long as each person didn't call more than once) either, but IANAL.
As a programmer working to keep the data flowing smoothly part of my job entails building programatic methods of detecting false data. Some of this is easy (i.e. people who put "I WANT TO RAPE YOUR DAUGHTER" in the first name field). Sometimes this is harder. IP checking helps, but distributed attacks are always a difficult thing to catch. However, all that said I don't know that this would be a significant problem.
One of our upcoming process changes will include an attempt to contact each customer via phone or email to verify their order before following through with it. Futher, automated credit-card checking will automatically drop orders with bogus data in them. CreditCard declined statistics would rise, but ultimately it wouldn't be that much hassle.
If you really want to hurt a spammer, get thousands of people to order a product, then send it back and charge-back the order on their cards. Creditcard merchant accounts have limits on the chargeback rates, and when they get too high the merchant provider will cut you off. Of course you have to front the money and the hassle, and at the end of the day there's only 1 less spammer out of a million (unless he tries to find another merchant provider and succeeds). But for some, perhaps the cost-benefit analysis would still find it worth it.
Total Due: $0.02
My belief is that they are sent for possibly two reasons.
1) Verify that the email address is deliverable. It makes no sense to keep a bad email address in your database of spam targets.
2) Seed statistical spam filters with bogus data.
I've been really happy with bogofilter on my IMAP server. Once I got the bus worked out of my scripts, it's running about 98% accuracy with zero good emails getting filtered as spam.
You could always do what I do.
/dev/null my Postmaster alias (violating RFCs of course).
Add all the spammers to an e-mail list and automatically forward any spam I get (using an address I use only for this purpose) to everyone on that list.
Having recently been a victim of having my addresses spoofed by spammers, I don't think this is a good idea. Only if the SPAM actually says to reply for more information (or to make a purchase) would this work; in other words, only if you have a reason to believe that the address is in fact going to reach the spammer.
The majority of SPAM I get does not come from a valid email address, but instead includes a URL to visit or a telephone number to call. Thus, forwarding SPAM to the From/Reply address will either just bounce, or worse, go to the unsuspecting person who's address was inappropriately used.
I know that often the spammers just use a random address from their list as the From/Reply-To, but for a couple of weeks I was the proud recipient of many thousands of bounced SPAM messages, to the extent that I had to temporarily
NGWave - Fast Sound Editor for Windows
A very significant percentage of spam meets two criteria: 1) it already breaks some existing state or federal law and 2) it ultimately desires someone to supply a US-based credit card (Visa or Mastercard).
The problem with all our wonderful anti-spam laws is that they are not being enforced, and probably never will be, except erratically for 1 or 2 really, really bad repeat offenders. So, instead of using laws to take bad people to court, use laws to make law-abiding people quit aiding and abetting spammers.
Thus, the weak underbelly of many spammers is that some minion of MC/VISA is letting them process cc transactions.
Solution: the FTC should allocate 3 lawyers and 3 geeks, and (the easy part) demand the cooperation of MC/VISA. The 3 geeks maintain emailboxes in all 50 states and a batch of email addresses designed to gather spam. They essentially provide the 3 lawyers with "quality" spam, that meets the 2 criteria mentioned above.
The 3 lawyers select spam that has broken a law, follow the spam-requested transaction to the point where it requires a cc transaction, and do it. At that point, there is a CC transaction involving a broken law. The lawyers provide MC/VISA with the information on what merchant processor handled the transaction and what laws were broken. MC/VISA shutdown that account, or simply dings them $20,000 for each offense.
Note that, unlike the FTC, MC/VISA can penalize any customer they choose to without due process (and they have a record of doing so). They definitely do not want to participate in illegally advertised transaction if a spotlight is shown on it.
The need to process credit cards is the weak link in much of the spam business, and it is very hard for them to work around an inability to obtain the services of a merchant credit card account. MC/VISA have tightened up the requirements for getting CC services in the past, and they can certainly do so again.
MC/VISA might even elect to make the process more automated by issuing the lawyers some "special" credit cards. When they see a transaction for any "special" number come through, they immediately shutdown that processor. (But you better make sure those special numbers aren't as easy to steal as all other credit card numbers seem to be!)
3 lawyers plus 3 geeks could make a bigger dent in spam than any collective effort to date has produced.
Why? Sheesh, I don't know, but whatever story gets posted here, someone always claims it's a good thing, so I figured it might just as well be me this time.
This is a bad thing. Why? Well, I don't know either, but whatever comments get posted here, someone always claims you're wrong, so I figured it might just as well be me this time.
Let's be clever & at least semi responsible at the same time. I propose a blend of technologies ripped from slashdot, P2P, and maybe 1 or 2 key innovations. Let's call this system "Spam Devil" or SD for short.
The Basics:
SD would allow users to connect to a peer to peer network which would enable thousands of users to share information about Spam they have received which warrants a response. Individual users would have the opportunity to nominate a Spam email for response. Once an email is nominated, it would be reviewed by several moderators in good standing. If those moderators certify a Spam for response, a distributed network of computers running SD would begin to flood the Spammer with bogus information either by email or by their websites.
More Ideas:
Moderators could be effectively metamoderated by comparing their votes with the votes of other moderators. A moderator's standing could be stored in a distributed fashion so when you rejoin the network, you don't have to start building your standing from scratch.
Reponses by website could be templated by the original nominator and reviewed by the moderators. Each form field could be given a type such as name, email address, phone, etc. A facility for templating a series of screens would be useful, and probably could be accomplished by having the nominator make a dry run through the website. Additional heuristics could be added that would allow the program to make guesses if the templating doesn't match. In cases when heuristics are used, moderators could be prompted to verify that the responses make sense. It's critical that the responses be difficult to weed out of actual responses from real customers in order to confound the Spammers.
Responses by email would require very careful moderating as the results, if misdirected, could be worse than the original problem (Spam). Some moderators may need to be certified as experts on email tracking. Also, some very clever test emails may need to be sent as confirmation before a response can be authorized. Responses by email should be anonymous. SD should be able to keep a healthy list of open relays by analyzing the Spam emails.
A very clever use of SD could allow for response throttling ensuring that a website remains responsive for SD. It would be a real shame to have SD hammer a website into submission only to end up with no real work being done. The cruft should be added slowly & steadily at first & possibly release the floodgates later in the process.
Finally, SD could be VERY useful for exchanging information about the Spam that is circulating and be used as raw information for filtering engines to reduce the amount of delivered Spam. If the system were to be well used, Spam might only be delivered to a smallish number of people before SD gets the email submitted, moderated, and certified as Spam. Once that's done, Spam filters worldwide could begin using that information to VERY specifically filter those Spam emails and blocking their delivery to suspecting throngs. Now wouldn't THAT be nice?
"Bishops and Bookies live off the irrational hopes of mankind." Bertrand Russell
Not really related to the parent; I posted it up here because I think it's a good idea. I don't want to be too associated with it, anticipating the spammers fighting back.
At the very least, I'd like to have a good Windows programmer put together something akin to this:
#!/bin/bash
COUNT=0
while [ $COUNT -lt 2000 ]; do
lynx -dump -traversal -useragent="By sending e-mail to my domain, you agreed to the published Terms of Service of my privately owned domains and servers, including the stipulation that all spam would result in your webserver log being filled with garbage. If you don't like it, don't send e-mail to my domains. I f you don't want me to visit your website, don't solicit my visit by sending me unsolicited e-mail. You do not have a First Amendment right to waste my bandwidth, electricity, CPU time or hard disk drive space with your crap, characteristically illiterate or otherwise."$1?YOU_FILL_MY_MAILBOX_WITH_UNSOLICITED _C
RAP_AND_WE_WILL_DO_THE_SAME_TO_YOUR_WEBLOGS
let COUNT=COUNT+1
echo $COUNT
done
I use this on all my spam.
Such a program would need to have a drag-and-drop interface, automatically replace the user's e-mail address (wherever it appears in HTML bugs) with uce@ftc.gov or something similar, trim serial numbers, cope with obfuscated URLs and hijacked Yahoo/Google redirectors, and eat both image tags and links.
As it is, I open each message, manually extract all the HTML tags, and plop 'em into a terminal window on one of my servers.
The only real worry is a spammer using a GeoCities or other free webpage. But if a few people hit the site with this kind of program, it would get it shut down faster than an abuse complaint.
Of course, if the spammer is being paid per hit, the advertiser is spending a lot of money to advertise to /dev/null, so it's unlikely that they'll continue the current business model.
I've also got it on the advice of a Federal Court judge (who is blind and can no longer read his e-mail in public places because he's too embarrassed by all the penis enlargement spams being read by his screen reader) that, since they've solicited my visit AND been warned on my website, there's very little the spammers can do about it. (Even so, I'd be hauled up in front of him, and I know how he feels about spam...)
Such a program could be very popular with the general public, since there's a definite feeling of satisfaction. But I think it should also be distributed anonymously. Spammers are likely to DoS any download sites and flood any mailboxes.
Sure, this is essentially a denial of service attack against the spammer. But the spam itself is a denial of service attack against MY mailbox, and nothing else seems to be able to stop it.
Any Windows programmers out there?