Another Worm Targets Anti-Spam Sites

kevinvee writes "Yahoo! is reporting about the next battle of Spam Houses versus Spamhauses. This time, its W32/Mimail-L receiving the attention. "It's the third Mimail variation to come after us, except this one is trying to do more," said Steve Linford, founder of The Spamhaus Project. Apparently this reincarnation comes as an attachment offering naked photographs. Once infected, a follow-up e-mail is sent to the user stating that a CD containing child pornography will be delivered to their postal address. "These guys write trojan (viruses), they carry out DDOS attacks and they get their money through selling stolen credit cards and spamming," Linford said."

Comments

A new low

[CleverNickName]

I didn't think that it was possible for me to hate spammers more than I already do.

Turns out I was wrong.

Re:A new low

[Saint Aardvark]

No kidding.

It's absolutely insane. They won't stop 'til they've destroyed email.

It's melodramatic, but: spammers really have declared war on email, and the Internet and its users as a whole. They're fucking with email, they're fucking with DNS, they're sending out viruses to infect users and spread more filth, and they're trapped in this huge positive feedback loop that I'm desperately afraid won't end. They pump out millions of emails which get ignored so they pump out more which gets them blocked so they pump out more to get around that and they start attacking their opponents and now the volume of spam is so high they need to pump out even more just to get any sort of return...

Rationally, I think the only way around it is to attack the economics of spam, as has been suggested by many much smarter than me.

But really, what I want is revenge.

Re:A new low

[Anonymous Coward]

Why is that whenever CleverNickName posts, at least five or six people have to post replies pointing out that hey, look, it's Wil Wheaton everybody! Hey, Wil played Wesley Crusher in ST:TNG everybody! Gee, look at that! Of course that was more than decade ago, and Wil isn't exactly the fresh faced youth he once was, and Wesley is a fictional character anyway so why does it matter how annoying he was?

As though we didn't know any of this. Or as if we should care.

Now, will the real Bruce Perens please stand up?

Re:A new low

[Uma Thurman]

There's a term for a coalition engaged in the act of making money through the use of intimidation and illegal acts: organized crime.

The spammers are exactly the same as the mafia.

Re:A new low

[.Bruce Perens]

Now, will the real Bruce Perens please stand up?

Certainly. All you had to do was ask.

Re:A new low

[johnkoer]

I thought you were going to say RIAA, but organized crime works too.

Re:A new low

[DavidTC]

The FTC recently went after a popup spammer who would hit people hundreds of times an hour with ads to block his own popups.

But that guy should be arrested, not fined. He was commiting extortion, and last I checked that was a felony.

Re:A new low

[Anonymous Coward]

Simple answer - Civil easier than Criminal.

Re:A new low

[lone_marauder]

Rationally, I think the only way around it is to attack the economics of spam, as has been suggested by many much smarter than me.

When you talk about changing the economy of spam, you are talking about creating scarcity with regard to communication by taxing it. I couldn't disagree more with the suggestion that we must restrict communications in order to solve the spam problem. We demand that outfits such as the RIAA learn to adapt in a world where communication is profligate and free. How can we, in good conscience, recommend that communication be restricted in an area where our personal convenience and comfort is concerned, and not in another, where someone's multimillion dollar industry is concerned? If we think freedom of information is a good thing, we must be consistent in that belief.

Re:A new low

[Anonymous Coward]

So fight back. What I do is locate the source, usually through whois, whitepages,and clicking a few links to trace the company and/or persons invloved (just the usual cyber-stalking stuff). Then I use an anonymous email account and a free internet fax service to fax them a few pages of the applicable legislation from www.spamlaws.com

Fuck 'em. If they waste my time and backwidth I'll waste theirs just as easily.

Re:A new low

[martingunnarsson]

One might wonder if a new e-mail standard could be designed. One that by design would eliminate the spam problem. I don't know much about this, it's just a thought.

Re:A new low

[planetmn]

Rationally, I think the only way around it is to attack the economics of spam, as has been suggested by many much smarter than me.

You are absolutely right. But attacking the economics does not mean taxing email, etc. You have to get it through the heads of people much dumber than we can imagine not to reply to spam. Spam is very cheap to send, but it does cost some money and time, so if you can reduce the return to $0, you've won.

People just don't get it though.

-dave

Re:A new low

[Anonymous Coward]

Shut up, nobody was addressing to you. He said the real Bruce Perens.

Re:A new low

[MindStalker]

Thats not the only way to change the economics of spam. Simply put spammers exist because the rate of return on investment is very high. We have to change that economic principle some how, there really is no argument there. There are many suggestions on how to do this, taxing is just one of them. Heck everyone pretending to reply is another one, which forces to spammer to follow many false leads. There is many, but something must be done to make spamming more expensive.

Re:A new low

[BiggerIsBetter]

The issue is adoption rate. Personally, I think it's doable. If the mainstream Open Source crowd and Microsoft migrated to a new format/transport then others would have to follow or risk being blocked by folks who decided to stop using the old system because of the amount of spam they receive. The industry is small enough that we could do it.

Re:A new low

[MrLint]

Im advocating disorganized violence against spammers.

-Decriminalize anti-spam violence in 04!

Re:A new low

[Anonymous Coward]

Fuck 'em. If they waste my time and backwidth I'll waste theirs just as easily. Why do they even bother? You seem to be managing fine on your own.

Re:A new low

[erroneus]

To me this is justification for violence and life endangerment. I would like to read a few news stories about how someone was viciously murdered where the motivation is identified as "...because he's a spammer!"

This is like a fight on terrorism. They don't have a limit to how low they can go. We have limits that we haven't reached yet. We need to go slightly beyond our limits now to kill these diseases before they develop further immunity against us.

(Note that I liken fighting spam like fighting disease. If we do not fight hard enough, we do not kill all of the disease and it just comes back harder and more vicious. Kill it all NOW and we're done forever.)

Re:A new low

[Anonymous Coward]

cute. you think a distributed war dialing effort can't take out phonelines and fax machines, rendering a spammers office "offline"? you think this can't be done anonymously? you think the distributed dialing can't be handled from a single machine? you think a spammer can make money when the 30 customers he would have got can't even contact him because the website is DDOS'd and his phones are too? you think local laws can touch someone doing it from another well-chosen country?

Re:A new low

[scrytch]

> It's absolutely insane. They won't stop 'til they've destroyed email.

s/email/every public commons/
These people can, have, and will spam by email, fax, autodialers, IM, SMS, spyware, and every single method of communication they can get their hands on that makes it cheap to publish.

The feedback loop will certainly end ... when there isn't a commons left. When we've all retreated into isolated communities and protocols, and will have to pay for the privelege of connecting with strangers, under the rare circumstance anyone might even treat contact from a stranger as anything but suspicious. Where that contact will be monitored and regulated, ostensibly to reduce spam, but nevertheless we will need the permission of the gatekeepers to push out any decent quantity of content.

FTC Commissioner Orson Swindle (I love that name) has said about spam "what we need are a couple of good hangings". While the government continues to do the one thing it's good at, make harrumphing noises at the problem, nothing whatsoever is being done about this ongoing criminal behavior, let alone unethical hucksterism. I'm not a fan of government intervention, mind you -- it'd just be nice if they just started enforcing the laws they actually have on the books.

Re:A new low

[Saint Aardvark]

What? Nice troll. Point out the word "taxing" in my post. I'll wait.

Okay, my fault for feeding the trolls, but:

When I talk about "attacking the economics of spam," what I mean is making it unprofitable to be a spammer. I think there are lots of ways to do this; taxing, while one way, is a particularly stupid and noxious method.

Here are things I think will work to varying degrees:

• Blacklists
• Spidering spammer websites
• Legal action (sadly, no URL...)

I think the best idea is spidering websites. What if spamming meant inviting a massive DOS on your website?

Re:A new low

[operagost]

You're correct. If you offer a product or "service" to solve a problem that you yourself are causing, that's one form of extortion. I've also gotten a spam that offered a spam-filtering product for sale. I wish I'd realized at the time that it's not just ironic but extortion, because I would have traced that email and possibly helped put a spammer out of business.

Re:A new low

[Saint Aardvark]

Why do you think I meant taxing? Where did I mention that word? What dictionary defined "changing the economics of spam" as "taxing email"?

Re:A new low

[drakaan]

You have to think about what you're saying here...you're saying that if everyone in the world currently using e-mail updates all of the software that they have (servers, clients, filters, firewalls, etc) that is used to transmit said e-mail, we stand a chance.

I agree with that, but don't agree that it's easily changed...there are a lot of mail servers out there, and a lot of mail clients out there, and ensuring that a change-over happens within a given time-frame is unreasonable.

What I imagine will eventually happen is that features to send certified or authenticated e-mail that currently exist will be placed into more widespread use and/or expanded on...much simpler to issue some patches for client apps to do that than to change the way e-mail works at a lower level.

Re:A new low

[TheMidget]

Heck everyone pretending to reply is another one, which forces to spammer to follow many false leads.

Even better: pretend to buy. Some spammer's site are so easy to crack (hint: SQL-injection) that it's a joke.

Harvest credit card numbers (with matching delivery and billing addresses, and often with matching CVV's) on one spammer's site, and use them on another's.

If enough people do this on a routinely basis, several things will happen:

• The word will spread about among buyers of spamvertised products that buying these is a surefire way to get trouble with their credit card
• Excessive rate of chargebacks make many spam operations unprofitable
• Credit card companies will realize that spammers are troublesome business partners, and become very reluctant to give them merchant accounts.

Hit them in the pocketbook (but use an open proxy, unless you want to get into trouble yourself...)

Re:A new low

[blueAcid]

I couldn't believe it when my E-commerce profesor at university suggested mass-email as a marketing strategy a few weeks ago. Here's a woman who, for all intents and purposes, should be a little more forward thinking, yet she preaches this filth in a college classroom. I think the problem is, people just don't understand or care to gain understanding of the consequences of their actions. Until the public rejects this stuff in totality, this is a viable business strategy, and thats all that matters.

Re:A new low

[Robmonster]

Something tells me that you are wasting a great deal more of yout time than theirs. All that time spent tracking them down, and oganising the fax/email which will just be trashed when it reaches their end (assuming of course the number you are faxing to is actually them)

I doubt very much if they spend any time reading these faxes, surely no more than a few sentences.

Re:A new low

[Anonymous Coward]

I interpret an attack on the economics of spam to be an effort to limit the funding of spam. If more people ignoring spam causes more spam to be sent, which in turn causes more ignored spam, then getting every spam recipient to ignore every spam keeps this cycle going.

Several companies in varying industries (loans, online dating, weight loss, "enlargement") are clearly sponsoring this form of marketing. These are the guys paying for spammers to send all those mails. As long as the money keeps coming in, these guys will still send spam. Publicly identifying and criticizing companies whose products are advertised via spam may be a more viable approach to combating spam than to try to convince every single person using email to not respond to spam.

It may even be reasonable to say that these companies are paying the spammers to severly hamper the operations of companies that provide email services to it users (e.g. ISPs, corporate email).

It may be even be reasonable to say that these companies are paying the spammers to launch DDoS attacks on spamhauses.

Re:A new low

[scrytch]

> Legal action (sadly, no URL...)

Here ya go

As for a url to blacklists, it doesn't get much better than the SBL for prepared evidence and spamcop for raw data, http://www.spamhaus.org and http://www.spamcop.net respectively

Re:A new low

[spacecowboy420]

Yeah, that makes sense. "Spam me and I'll spend 300000% more time in faxing you!" Yeah, that will show them. How much time/effort do you think it took for them to send you that email? I bet they laugh their asses off when they get someone who does this stuff - I know I would. Such a passionate, yet completely ineffectual response. Don't waste your time until you can do something with a little more impact. Even if this spammer decided to quit because of your fax, do you think he'd tell all of his spammer buddies and they'd stop as well? Not bloody likely.

Oh and bandwidth goes both ways. When you waste theirs, you waste yours as well.

Re:A new low

[Frater 219]

When you talk about changing the economy of spam, you are talking about creating scarcity with regard to communication by taxing it. I couldn't disagree more with the suggestion that we must restrict communications in order to solve the spam problem.

The problem of spam is not caused by the freedom of email, any more than murder is caused by the availability of knives and other weapons. It is too easy for technically-minded people to see spam as a technical problem, which is to be solved by replacing the existing mail system with something more restrictive. However, the spam problem is not spontaneously generated by the mail system, just as knives do not go around murdering people. Spamming, like murder, is a human action that certain humans choose to engage in.

It is, of course, useful to use technology to make harmful actions more difficult. Locking up valuables makes theft more difficult; hiring bodyguards makes assassinations more difficult. However, we do not pretend that technology should make theft or murder impossible, or that the world should be transformed into a padded cell so that everyone is technologically prevented from doing anything wrong. Instead we deter and punish crime through education and law enforcement. Technology can reduce the likelihood and impact of harmful human actions, but we cannot use it as a replacement for social responses.

Regardless of whether particular legislatures have passed laws which specifically address spam, we recognize spamming as a lawless and criminal endeavor. Spammers co-opt the property of others against the will of the property owners. (Note that this is worse than simply using that property without permission.) Just as gangs protect their core unlawful enterprises with further crimes such as murdering rivals and bribing police, spammers have come to use cracking, viruses, and DDoS to protect their core activity. Structurally, spam is just like other sorts of lawless action which we see as the proper jurisdiction of law enforcement rather than technological kludgery.

There is no shortage of evidence, gathered from public sources and fully admissible in court, that particular spammers are engaged in criminal actions such as the above. Contrary to common belief, these spammers are not in "third-world nations"; they are in Western nations such as the USA, Canada, and the UK -- nations which have broadly functional legal systems, and nations whose Internet users are the chief recipients of spam as well. Volunteers have already carefully collected this information in the Registry of Known Spam Operations. What is needed is twofold: (1) Funding for law enforcement to go after the known criminal enterprises; (2) Further litigation by major victims of spam, such as large ISPs, against those who are victimizing them.

Re:A new low

[Anonymous Coward]

how many people need to do this to put an office out of business, or even to just piss a spammer off as much as they piss the rest of us off? 10? 100? certainly not the 250k that get spammed. you can smugly poo-poo the idea all you want (and do nothing about it, most likely), but if even a small bunch of geeks do this, their 1 or 2 person business is rendered ineffective pretty quickly.

btw, if it takes more than 5 minutes to track someone down, you're doing it wrong.

Re:A new low

[Anonymous Coward]

>There's a term for a coalition engaged in the act of making money through the use of
>intimidation and illegal acts:

The US army? Although admittedly more of them get killed:

http://cryptome.org/mil-dead-iqw.htm

Still, you shouldn't invade other peoples countries and kill thousands of civilians if you can't take a joke?

Re:A new low

[Anonymous Coward]

If I were less ethical, I'd be *SO* tempted to create a worm that recognizes spamware and destroys it (overwritten with random crap, or infected such that it becomes a virus for the user, rather than a pox on the recipient) and perhaps even infects the BIOS, screwing up the computer every so often / reinfecting it with the above.

*sigh* Pity you can't make the spammers' computers explode... preferably while they're at the keyboard :/

Re:A new low

[spacecowboy420]

Ever see/read the movie/book "Needful Things" by Stephen King? Basically, in the climax of the movie/book, everyone is in the middle of the street trying to kill each other due to provacation from this one guy. Wouldn't it be cool if we could turn microsoft, sco, spammers, virus writers, conservatives etc...against each other? Have them all in the middle of the street stabbing each other to death.

Re:A new low

[spacecowboy420]

You missed the point. Even if you were successful in tracking this ONE guy down and successfully knocked him down - you got ONE. You need an automated approach that will get everyone of the sonsabitches. Maybe if you automated the process and integrated it into firebird where every time you marked spam it would do this behind the scenes in a hands off sorta way - yeah. But not the way you do it. The opportunity cost is far greater than the return.

Re:A new low

[Dharzhak]

Actually...why not tax internet (as opposed to intranet) e-mail? I don't mean a flat rate, but rather a sliding scale tax like what's used for income tax. Below a reasonable threshold, say 200 emails/wk, you don't get taxed at all. The more e-mail you send, the more you pay per e-mail. That would utterly destroy the business models of spammers and wouldn't put a burden on Joe User. Btw, it would also put somewhat of a burden on those companies that outsourced their IT dept, but after having mine been outsourced to IBM and then witnessing all the monkey shit around here lately, I have no sympathy.

Re:A new low

[Anonymous Coward]

Any other even semi-famous people posting to Slashdot? No? Okay, please go away now.

Re:A new low

[Anonymous Coward]

I, for one, support our new vigilante hacker overlords.

Give them a taste of their own medicine.

Re:A new low

[Savage-Rabbit]

Calm down, calm down, spam is not so bad. Why if we eradicate spam just think of all the jobs that would be lost!! All those good people in the electronic mail marketing business (aka. spammers) and the developers that derive a living from anti spam software, the doctors that treat patients who's hearts have begun to give under the constant emotional irritation and anger generated by spam, the drug companies that make their medicine... the list goes on. No spam is an essential component in modern society, it creates jobs, tells us where to look for cheap viagra and it is an invaluabe guide to profitable business opportunities in Nigeria. I ask you sir, how can we live without spam???

Before you mod this down as a TROLL please ask your self:
Whould you know sarcasm if it bit you in the backside?

Re:A new low

[Kenja]

What a GREAT idea. Fight Spam by committing a federal offence. You can laugh at the foolish spammers from prison.

Re:A new low

[larard]

If one is prepared to change the infrastructre in place to enable taxed email, why not just make the change instead to globally require SSL authentication, or alter SMTP to require authenticaion and not be so trusting of everyone?

The changes required to allow per email based taxation would surely be more difficult than implementing this?

Re:A new low

[sfjoe]

It's absolutely insane. They won't stop 'til they've destroyed email.

The tipping point is on the horizon. There will be a point where the ISPs that profit from spam (Verio, etc) will be so clogged and/or so widely blacklisted that spam will become unprofitable for them. When that point is reached, spam will disappear virtually overnight.

Re:A new low

[Anonymous Coward]

I didn't miss it. Spamhaus reckons there's perhaps 200 of the fools running the scene. The rest are juse wannabes. I know what you're saying though, I just disagree.

Re:A new low

[TheMidget]

That's why you use open proxies. And then, do you really believe that the spammers will call the cops on you?

Re:A new low

[Yoda Doll]

Well done.
By giving the instructions for hacking and credit card fraud you just committed a crime under the PATRIOT act.
And posted logged in.

Re:A new low

[sketerpot]

If you can drive up spammers' bandwidth bills and make the return less than $0, then you'd have something really nice going.

Re:A new low

[sketerpot]

I wouldn't want to be running any mailing lists under your taxation plan. Sourceforge, for example, would have to shell out lots of money for a legitimate service.

Re:A new low

[Golias]

Any other even semi-famous people posting to Slashdot?

Yes. I just didn't make the error of revealing the identity behind my user ID to the world.

Re:A new low

[Kenja]

No I think the people who own the credit cards you used to commit fraud will call the secret service on you.

Re:A new low

[Anonymous Coward]

Who is she (i.e. full name)? What is the title of the class? Which University is it?

This kind of thing will continue if we just keep quiet about it. Perhaps you can give us her email address to so we can just show her how pleasant mass-email marketing is.

Re:A new low

[fermion]

It is possible that the assumption that making email cost money, say comparable to the postage of physical mail, in an effort to make spam go away is naive.

The reality is that all the costs involved with physical mail merely force advertisers to acquire targeted mail lists. Since each piece of mail costs them money, in addition to the development cost of the campaign, they want to make sure each piece has a good possibility of generating a sale. Of course, since they have to have enough sales to cover the campaign, they send tend to accept returns of less that 1 in 100.

Taxing email will not directly address the slight bigger issue of deceptive or inappropriate advertising. With physical bulk mail someone, somewhere, is accountable for the contents. People are still free to send out whatever they wish, but they risk prosecution if the contents are illegal. This is why firm like Publisher's Clearinghouse, which is probably responsible for more trash than the City of New York, is allowed to exists. They walk the a fine line in order to generate sales, and occasionally crosses over to illegal content. When they do, they settle and business goes on.

So what is needed is accountability. All Spam tries to avoid accountability, either through forged headers, shill companies, or offshore operations. The accountability issue is the weakness of most current laws. If you can find the source, you can sue them, but there are few tools to find the source. One possibility to punish ISPs that exhibit a pattern of catering firms that break existing laws, or do not enforce their EULA, or whatever, but most current laws give blanket amnesty to the ISP.

One has to assume that firms other than the spammers are making money. There must a fair number of otherwise legitimate companies that are reaping tons of profit from this for the laws to be so weak.

Re:A new low

[ooby]

How can the US/UK/AU tax emails coming from all over the world?

Re:A new low

[Anonymous Coward]

Yes. Why not? We (as in `the people') have already basically given them the green light (or at least demonstrated that we'ven't bothered to use traffic cops). Let them get cocky enough to do just that, and the publicity might culminate in a long overdue crackdown.

The question is, where do we find a large pool of script kiddies with martyr complices? Hmm...

Re:A new low

[JuggleGeek]

Some spammers appear to have some fairly direct ties to organized crime. Eddy Marin, for instance, is a well known spammer from Boca Rattan. He also has also been busted in the past for cocaine sales. It's led me to wonder if some spammers are using their "legitimate opt in marketing" as a way of laundering money. There is no way for anyone looking in to tell how much money they really made by spamming, so they can report that they are making a profit (regardless of whether they sold anything) and use that as a way to make the money look legitimate.

Re:A new low

[Maxwell'sSilverLART]

Let me guess...you're a criminal defense lawyer, looking to build a new practice, right?

Re:A new low

[TheMidget]

No I think the people who own the credit cards you used to commit fraud will call the secret service on you.

Why would they? They just call up their bank, who'll happily reverse the charge, and stick the spammer with the bill, as intended. Isn't the credit card system great?

Re:A new low

[brassman]

What if spamming meant inviting a massive DOS on your website?

Point that cannon at the spammers and they will gleefully start spamming for anti-spam sites (in addition to their own, I hasten to add). Note the original article.... spammers will seize the chance to point any purely technical takedown mechanism at their enemies, gleefully. Taking down the antispam sites would be worth it, to them.

Re:A new low

[Tackhead]

> I didn't think that it was possible for me to hate spammers more than I already do.
>
> Turns out I was wrong.

As of last night, when I read the Groklaw article about how SCO is suing IBM for software that SCO knowingly inserted into the Linux codebase, I decided I hated Darl McBride and his band of barratrous bastards even more than I hated spammers.

Now I gotta retract that. Until Darl's next press release tops his most recent one, spammers are back in the lead.

Re:A new low

[Snowdrake]

Rationally, I think the only way around it is to attack the economics of spam, as has been suggested by many much smarter than me.

Someone else on this thread mentioned that the way this is going to stop is when there is no commons left. What I see, though, is a middle ground. Whether the spammers like it or not, their feedback loop almost certainly doesn't generate anywhere near the profits we imagine, or that they imagined when they were getting into the business. (I'm thinking of the Sanford Wallace interview that was posted a while back, albeit taken with much salt.) Even at the hundredths of a cent per message they're paying right now, it's necessary for spammers to keep escalating their tactics. Eventually they're either going to run out of technology to abuse, at which point the spam-fighters catch up and the whole thing implodes, or (more likely) the cost of their next trick (l33t h4x0rZ don't work for free) is going to become so astronomical that the ROI's no longer there, and hopefully all these spammers will run themselves a couple million a piece into debt before they decide it's time for a long walk into the Atlantic Ocean.

Realistically, I don't think we're close to that limit. It might still be a race between spammers destroying their own economics and the destruction of the commons, but I have to hold out at least a little optimism.

Re:A new low

[Tackhead]

> There's a term for a coalition engaged in the act of making money through the use of intimidation and illegal acts: organized crime.

I'd actually go one step further. A Racketeering-Influenced Corrupt Organization.

> The spammers are exactly the same as the mafia.

But on that, I must dissent. The Mafia has a long and storied history of providing everything from illicit booze, prostitution, sports gambling, lotteries with better payouts than the government-run lotteries, duty-free liquor and cigarettes, financial assistance to those with whom banks will not deal, as well as a full range of soft and hard drugs.

Unlike spammers, the mafia provides things that people actually want.

Re:A new low

[G27 Radio]

The best solution I've heard mentioned entails using encryption on all e-mails. By requiring a certain level of encryption on received e-mails, it's possible to force senders to "spend" a certain amount of CPU time to get an e-mail out to you. The amount of time spent encrypting isn't going to be a big deal to someone just sending one e-mail, but to a spammer sending millions it will be very expensive resource-wise.

So basically this method uses a technological means to change the economics of spamming. As a side effect we get strong encryption built into our e-mail.

Re:A new low

[Anonymous Coward]

> Structurally, spam is just like other sorts of lawless action which we see as the proper jurisdiction of law enforcement rather than technological kludgery.

Government loves spam, just as they love street crime, "the war on some drugs", and etc ("crime"). Crime helps to justify police and government control; without crime, there would be no excuses for the existence of The System, and hence, the "elite" that controls it would lose their "jobs".

So, I'm afraid you're right. And precisely because of that, I'm afraid SPAM will never cease. At least not until MICROSOFT BIGBROTHER INTERNET WORLDWIDE GUARD (TM) is deployed, which will replace lawless SPAM with "Official Microsoft-Certified SPAM(TM)".

Re:A new low

[DotDotSlasher]

What a GREAT idea. Fight Spam by committing a federal offence. You can laugh at the foolish spammers from prison.

Or, order the product using your credit card. The next day, in good faith, try to cancel the order. If a package comes, send it back with the infinitely cheap "Return to Sender" moniker. After a week, contest the charge on with your credit card company, saying you cancelled that order. Of course, it will be impossible to communicate with this "company".
Vendors with many cancelled transactions have their credit card account terminated.

Re:A new low

[Anonymous Coward]

But really, what I want is revenge

They murdered my inbox. They thought they murdered me. They were wrong. This isn't about revenge. This is punishment!

The Punisher

Re:A new low

[rworne]

Aside from the also-mentioned adoption rate, you also have the problem that the entire process will most likely be patented to the hilt. If there isn't something patented already.

I really doubt that anything as important as an email protocol would manage to avoid the current IP quagmire we have today.

Re:A new low

[lone_marauder]

What? Nice troll.

Isn't there an extension to Godwin's law out there that applies to that accusation? I find I can't take seriously anything that follows it.

Re:A new low

[JAgostoni]

No! But the owner's of the credit card numbers you just stole may just have the gall to call in a fraud report.

Re:A new low

[Saint Aardvark]

If you don't have an answer to the question, just say so.

Re:A new low

[wytcld]

Further litigation by major victims of spam, such as large ISPs, against those who are victimizing them.

Nice idea, but. The new federal "anti-spam" legislation specifically removes private "right of action" against spammers. That is, victims can't sue. All they can do is complain to the federal government, which can act - or not - in its own way and time. It also pre-empts states from passing anti-spam laws stricter than the Fed's ... so you won't see the equivalent of NY AG Elliot Spitzer's action against the mutual funds.

What more evidence do we need that certain dominant elements among the Majority leadership are in favor of economic rape by any means, of any resource?

Re:A new low

[AyeRoxor!]

OMG!!!
now Wil Wheaton hates t3h spammers m0r3!!!

+5 funnay! :P

Re:A new low

[Shoggoth of Maul]

Anti-spammers have the option of leaving the "battlefield" if this happens; the spammers don't, if they want to keep their hobby/livelihood.

One could have a list of protected domains (user defined) that wouldn't be spidered...

But that's just an idea. I'm frequently wrong.

Re:A new low

[quacking duck]

In the same vein, it's like saying how Windows security holes and poor OS design aren't a bad thing because they keep millions of MSCEs employed and the economy running strong...

Re:A new low

[TheMidget]

you just committed a crime under the PATRIOT act.

And posted logged in.

... from outside of the United States of Texas! Nice try.

And do you think Slashdot will hand out my IP? Not unless somebody tries to use these instructions against the Church of Scientology!

Re:A new low

[filmsmith]

You have a damn amusing (and damn right!) typo right n'yah.

No spam is an essential component in modern society

fs

Re:A new low

[leviramsey]

How about this:

Amend federal law to remove common carrier in civil cases.

Of all the legal options, this one will be the most effective, as it gets around the problem that the US laws would have no jurisdiction outside the US (and that, even if enough nations ban the sending of spam to anywhere from within their borders, that will only make it more worth it for nations like Luxembourg or Costa Rica or whatnot to keep it legal). How would this work?

US ISP receives spam

US ISP sues their upstream for carrying it. In all probability, the upstream won't bother fighting it, so they'll pay up and accept the log of the email headers.

The upstream ISP will then be able to sue the next cog in the chain up (pass-through liability), much as insurance companies are able to do.

Lather, rinse repeat.

At some point, you hit one of:

• the spammer himself, actually sued by his ISP.
• some ISP decides that the buck stops here and eats the cost; however you can bet that they won't be willing to give the client who put them in this position a great deal on his service.
• an international backbone provider from $COUNTRY to the USA that pays up and has no recourse in $COUNTRY.

How does this work with say, a spam sent from Korea to AOL through C&W?

AOL sues C&W. AOL wins. C&W pays up. Assume that C&W can't go after one of their customers in Korea. This fact would lead them to offload the risk of doing business in Korea to insurance companies. The insurance premiums then get built into their connectivity prices from Korea to the US. Eventually every operator of a route from Korea to the US will either give up or stay in with dramatically higher prices. A thousandfold increase in bandwidth prices from Korea to the US is not out of the question. At this point, after some relay operator in Korea gets a bill from his ISP that's 50 times higher than normal, one suspects that he would close the relay. Problem solved.

Extend this to DDoS zombies, copyright infringement, and other civil offenses.

I imagine DDoS attacks will become a lot more difficult when people whose machines became zombies get a letter from Comcast or Verizon terminating their service with a demand of $1,000 to turn it back on.

Once you've established the liability for these activities in monetary terms, insurance companies can move in. You would have the option of buying insurance for your internet connection protecting you from liability of this type. If you're running up to date software, not participating in file-sharing networks, and not running an anonymous proxy or open relay, you're premiums will be low and since you're properly insured, the ISPs will give you service at the normal current rates.

Re:A new low

[foqn1bo]

Wow.

That's the most lucid analysis of the Spam situation I've heard yet. Well done.

Re:A new low

[leviramsey]

Exactly. Spam is one of those activities that's on the other side of the law. Spammers will be very hesitant to go to the cops as judges will laugh the cases out of courts. This is the reason why, in countries where prostitution is illegal, you can basically get away with defrauding a hooker (bouncing checks, counterfeit bills, or just a plain old stiffing). Ditto for bookies.

Re:A new low

[leviramsey]

Hell I know a guy in Michigan (goes by the name of Dell Dude online) who scams online sportsbooks through credit card fraud and kiting EFT transactions. One of these days, he'll hit a 10-way suicide parlay for $3 million and retire.

Re:A new low

[the_mad_poster]

I'm not trying to be offensive or troll, or anything like that, but you don't really have a terribly firm grip on reality, do you?

There's a HUGE difference between forking over IPs because of frivilous, civil litigation and being told to hand them over as part of a CRIMINAL investigation.

I highly doubt anyone's going to come knocking at your door for suggesting we all participate in mass, organized wire and credit card fraud, but that's beside the point. I think and HOPE Slashdot would turn over IP addresses if it was part of a legit criminal investigation.

Re:A new low

[Anonymous Coward]

I believe this is going to be the spammers downfall. All of this activity is definately going to attract the attention of the authorities and a lot of us are going to get hurt, in many different ways.

The (LE - Law enforcement) is going to deploy super draconian tracking tools in an attempt to catch the virus writers (which IMHO is an exercise in futility). So a lot of innocent people are going to be swept up into this mess.

Spammers are already virtually untouchable as they deploy more clever tricks to avoid getting busted.

This could result in sweeping changes in the way internet mail is handled.

IRC operators are then going to be targeted by the authorities and required to put stricter monitoring software and logging. ISP's may even start blocking private IRC operators. IRC is the tool of choice that controls the spam zombie computers.

Most of the high level "commands" to the infected hosts come from IRC Bots, but other methods are also used.

IMHO - the only way to track them is follow the money trail. Spammers make their money by selling anatomy enlargement kits. If more and more people would take an active role in tracking spammers by actually ordering these so called products, then it's an easy matter to obtain the details of the Financial institution processing their money.

Once these financial institutions are identified, then the authorities with their investigative powers can supena the financial transactions and put pressure in them to identify the benficiaries... the ones who actually profit from this activity.

Of course, getting any self respecting Slashdotter to stoop to such low morals to actually do this, might take an Act of God, but hey man.... a guys gotta do what a Guys gotta do to stop this insanity.

Tracking spammers and trojans by following the path of spam mail is really a waste of time. However, I always encourage everyone to report spam either manually, or through SpamCop, because it DOES shut down the infected trojans. But don't think for a minute that you can just contact the Spamvertized site in the spam mail. Even if you're able to de-obfusgate the URL and obtain the domain name of the site, you'll still run into a dead end. This is because the domain owner has the domain registered under someone totally unrelated, or it has bogus information. Can you get to the web server operator? NOPE! No way, this is because the server is someones infected machine on a DSL or cable modem, known by the spammer to be left on 24/7. They operate their own DNS and constantly re-point it to other infected servers. Most of these hosted sites are run on custom servers on machines running, and often use non-standard port numbers. These are pretty easy to identify. How many spams have you received that offers "bullet proof hosting" services? You can rest assured their sites would be hosted on a machine who's owners are totally unaware of this.

Of course the burdon is then going to be on the ISP to follow up on these reports and take action, but I suspect they are swamped with millions of reports already.

You should not take the attitude of "Geee - someone ELSE will wind up reporting it". Instead, I encourage all you spam haters to continue to report spam as much as you can. Even though it may be time consuming.

It's not that hard to write a spam reporting script in Perl to go through an "mbox" of known and confirmed spam, and reporting it. Yes, you would need a database of course, and use "RE" to extract the emails from the "whois" data.

Although ours is a lot more sophisticated then what I described, it IS making a difference, and we're shutting down about 500 proxies per week with this tool.

Of course M$ is part of the problem and certainly not the solution. Their swiss cheese operating system is a perfect platform for spammers, and they are going to get as much out of M$'s delemma as they can.

Re:A new low

[Anonymous Coward]

You wrote:

>If enough people do this on a routinely basis, several things will happen:

yea - like a visit from the authorities having handcuffs with your name on them. BAD Idea... there are too many laws broken to make it worth the court costs.

If you want to fuck with spammers, then do the least desirable thing, track them down by following the money trail.

Re:A new low

[CrazyDuke]

In other words, this law is just like the other laws this current set of jackasses has come up with:

Clean Air Act and Clear Skys Initiative gives free reign to industry to pollute as much as it wants with no ill consequence.

USA PATRIOT Act is the most unpatriotic and authoritarian piece of legistlation since the Alien Sedition Acts, possibly earlier.

The Medicare Reform hands medicare over to private HMO's and basically sets up Medicare for a crash in a few years.

The Energy Bill that hands over tons of money to the corporations that caused the problem in the first place.

The effort to "free" Afghanistan that basically handed that country over to opium drug lords.

They go into Iraq in part because they may be collecting radioactive material to build nuclear bombs to use on the US, and procede to dump 75 tons of depleted uranium rounds in their country.

They critisize corporate fraud and promise to crack down, then procede to disolve legal and financial protections for whistleblowers. Not to mention many of thier own little financial escapades.

They proclaim to "Leave No Child Behind" (TM) and then procede to slash funding across the board for public education.

They "support the troops" by slashing pay and benefits for active duty and veterans and extending tour durations over and over.

And many many many more.

They make war in order to maintain peace.
They proceed to strip us of all our freedom in the name of protecting it.
They maintain security by controling hiding information.

War is peace.
Freedom is slavery.
Ignorance is strength.

This is no different, and not the least bit surprising.

Re:A new low

[OMEGA Power]

you can basically get away with defrauding a hooker (bouncing checks, counterfeit bills, or just a plain old stiffing). Ditto for bookies.

The problem with this theory is that since they are "on the other side of the law" pimps and bookies won't call the cops, they'll just beat the shit out of you

Re:A new low

[shamino0]

Or, order the product using your credit card. The next day, in good faith, try to cancel the order. ... Vendors with many cancelled transactions have their credit card account terminated.

Sounds good, in theory. But what makes you think Mr. Spammer isn't going to sell your card information to other criminals?

As much as I'd love to make a spammer's life miserable, I really don't think it's worth making myself an identity-theft victim over.

And if anybody doesn't think spammers are involved in identity theft rings, please let me know. I've got a bridge to sell you - real cheap.

Re:A new low

[ChaosDiscord]

I think the best idea is spidering websites. What if spamming meant inviting a massive DOS on your website?

The problem is that the website might not be the spammers.

Potential attack: Pick a target you want to DOS. Craft up a spammy looking email, include your target's URL in the message. Spam the hell of out the message. Watch target get crushed.

for the system to be an effective deterrant, it needs to be powerful to be dangerous. If it's dangerous there is a real risk of hitting innocent targets.

Re:A new low

[roedeer]

Why use a subset, when you can use the general expression without losing definiteness...

Re:A new low

[Anonymous Coward]

I don't think most pimps would try to track down a stiffing customer and get money out of him. First, whores lie, and he could spend all day on wild goose chases. Second, strongarm robbery (which is what you described) is harder, more dangerous and less lucrative than pimping. Third, many johns are very dangerous, which is why a smart pimp never wants to meet them face to face. But I'm sure all pimps appreciate being considered bad-asses.

As for bookies, it probably varies a lot, but the guy who answered questions here recently said that blacklisting was sufficient threat to make most gamblers pay up.

Re:A new low

[Anonymous Coward]

So actually the RIAA is better comparison.

Re:A new low

[CowboyMeal]

Stiffing? Hooker? Eh, never mind, too easy...

Re:A new low

[minas-beede]

But really, what I want is revenge.

Have you tried a proxypot?



Imagine laughing and being gleeful when spam arrives at your system - and the more spam, the louder the laugh. Imagine reporting the spammer's IP to his ISP and geting his accont terminated. Imagine the spammer getting a new account and hitting you proxypot once again, getting terminated once again - because of you.

It can't be enough revenge - but it's way more than your'e getting now, I'd guess.

Re:A new low

[minas-beede]

Technology can reduce the likelihood and impact of harmful human actions, but we cannot use it as a replacement for social responses.

I'll accept the premise. Technology can be the vehicle for social response - at the technical level, of course. Spam is a problem that involves trust. Several technological means are used to implement our distrust of spammers, with blocklists and filters coming to mind. But spammers also trust us - and that trust is well placed. Screw that: stop being trustworthy for the spammers. Right now, today, spammers can trust that if they test an IP for vulnerability as an open relay or open proxy, if it tests vulnerable - it is. For open relays, for example, all effort is directed to "secure your system." The spammer tests a secure system, it tests secure, he skips it. The spammer tests an insecure system, it tests insecure, he abuses it. If you don't see how the secure system has directly aided the spammer look again. There's no reason a secure system must test as secure - it's a mistake if they all do (so it's a mistake now.)

There's a direct and simple technical way to destroy the trust the spammers have in us. Destroying that trust doens't hurt the trust of non-spammer for non-spammer: it is almost exclusively the spammers who go around testing for insecurity.

Put another way, the non-spammer behavior patterns up to now haven't ended spam. It seems to follow that if the desire is to end the spam then the behavior needs to be changed - what's being done is a failure. That doesn't force my suggestion - but my suggeston does fit into that analysis. If you've got a better way to change the behavior, good for you. Tell us about it.

Sue the software companies

[grub]

If the government can go after the tobacco companies for killing people with their second hand smoke, why can't they go after the software companies that have obviously turned a blind eye to security in the name of profit and the after-market anti-virus industry? It's their shoddy software that allows this to be possible yet they make billions while costing ISPs and end users billions more.
Hell, some US states are even going after gun manufacturers..

Re:Sue the software companies

[NetJunkie]

WHAT? Who? Where? These viruses don't use some security exploit. They get the user to run the attachment..plain and simple. If the user runs a file that is no ones fault but the user.

Re:Sue the software companies

[cbreaker]

Because we can't tax the spammers.

Re:Sue the software companies

[grub]

The fact that when opened this software is allowed to execute code, crawl through the address book, copy itself and send itself out to others is a fault with the system.

I've never had a problem when opening an attachment with Mutt.

Re:Sue the software companies

[spankyzone]

Beyond all the normal inferences of why you can't target spammers... there is one fundamental thing to note. There has yet to be a proven case, directly or indirectly, of email spam causing death. :)

Yeah, it costs people time, lots of money, and probably some hair; meanwhile someone profits from the exploits good and bad. Hell, that happens all over the place, not just here.

Re:Sue the software companies

[Anonymous Coward]

I did read the article ~15 minutes ago (subscriber, eh)
Please show me where I've used this "boiler plate" before. Ahh.. you can't, begone troll.

Re:Sue the software companies

[Anonymous Coward]

If the government can go after the tobacco companies for killing people with their second hand smoke, why can't they go after ... the after-market anti-virus industry?

Be reasonable! When's the last time a virus effected your health? ;)

Re:Sue the software companies

[Anonymous Coward]

FLAMEBAIT? Billy must have his sandbaggers working on slashdot today.

Re:Sue the software companies

[BenjyD]

If it's an executable and the user runs it, then it can do anything the user can do. If I emailed you "hot_nekkid_chicks.sh", you saved it using mutt, ran it without thinking and it did rm -rf ~/ , you wouldn't blame Mutt.

The fact that MS software makes it so easy to run an attachment and to hide its executable nature is the problem.

Re:Sue the software companies

[Anonymous Coward]

If more than 20 people used Mutt, there might be some reason to write an exploit.

Re:Sue the software companies

[Kombat]

So if I email you an ELF binary as an email attachment, and you save it and run it, that executable will not be allowed to crawl through your address book and send itself out to others?

Linux prevents it from doing that, eh? Really? Which distro might that be?

Re:Sue the software companies

[grub]

If I just look at "hot_nekkid_chicks.sh" in Mutt I would only see the script. Just looking at these things in Outlook lets them run. With mutt I would have to save the script, chmod it +x, then run it.

Which is safer?

Re:Sue the software companies

[Malc]

If I misslead you and get you to hand over your life's savings, then it's your fault, right? I won't have to worry about being hunted down by the long arm of the law and prosecuted for being a con man?

These viruses prey on the ignorant. It's easy to make comments like yours when computers are a key part of your life. Perhaps we should have a minimum competence level before letting people on the internet, a so-called computer driving licence. That way we can hold the users responsible.

Or perhaps you're responsible. You know what the problems are, but you haven't done enough to educate others.

Re:Sue the software companies

[Anonymous Coward]

Read above. I'd have to save the attachment, chmod it then run it. Most unix people are smarter than that and any worm that requires all that intervention would just die on the vine.

Re:Sue the software companies

[www.sorehands.com]

Actually, there was a 419 spam victim that killed. The ironic part is that is was a Nigerian diplomat.

Re:Sue the software companies

[Anonymous Coward]

Of course I can't. Slashdot doesn't have the ability to search posts and only shows the last 20 or so. Your post, however, is hardly original. If I had the energy I could search through every virus story to see where a post just like yours existed.

Re:Sue the software companies

[Anonymous Coward]

Alright. Well let's say, for the sake of argument, I send you a package in the mail. It says it's a free copy of an encyclopedia or something like that, and asks you kindly to open it. You open it, and it explodes in your face.

Whose fault is it that you just got your head blown off? Is it yours? Well, you did open the package. The bomber shouldn't be held responsible, you were stupid enough to read the sign and open the box anyway. It's your fault, isn't it?

Re:Sue the software companies

[BenjyD]

That's what I said - the ease of execution is the problem, not the fact that code can crawl your address book as the grandparent post states.

Re:Sue the software companies

[Anonymous Coward]

I have two comments:

1) If it is actually that difficult to run a program in Linux then it will never take off for the home users.

2) There is nothing that says that this virus is activated by opening or previewing the email but only when actually executing it.

Just face it. You are a low digit troll.

Re:Sue the software companies

[BrianPM]

Because people don't write viruses to exploit Mutt. It's not saying that they can't. They don't because Mutt has about the same market share as the Kia Sorrento.

Re:Sue the software companies

[Anonymous Coward]

Cripes, don't be so lazy. It took me three seconds to find this guy shouting off his bullshit on forums other than slashdot with a google search. He states the same thing over and over outside this little corner of the 'net, apparently.

Here's a hint, grub. If you're going to push an agenda, change your nick everynow and then.

Re:Sue the software companies

[Anonymous Coward]

1) If it is actually that difficult to run a program in Linux then it will never take off for the home users.

You (wrongly) assume that I run Linux.

2) There is nothing that says that this virus is activated by opening or previewing the email but only when actually executing it.

I suggest you re-read the article then:

• "Clicking on the attachment activates the virus. Once triggered, the worm forwards itself to other e-mail users."

Clicking on the attachment is all that's needed. Granted that's the same as executing the thing but that's still deplorable security.

Re:Sue the software companies

[Kombat]

I'd have to save the attachment, chmod it then run it. Most unix people are smarter than that

Exactly my point! It's not the system, it's the users.

Re:Sue the software companies

[Hrothgar The Great]

You fucking idiot. Seriously, why are you people so GOD DAMN STUPID?

The Internet Worm

Please at least have some rudimentary knowledge of computer history - this was 1988 so unless you're less than 15 years old you have NO excuse for this idiocy. This slashdot article is about vicious attacks by VIRUS WRITERS. You are using it as a platform to espouse your obviously ridiculous opinion about security holes in an e-mail program.

In case you don't get my point, let me hammer it home for you - the link I provided is similar in that some smart guy exploited a security flaw to propagate a virus which copied itself all over the god damn internet and shut large sections of it down. The fact that this wasn't his specific intent is irrelevant. Would you like to sue UNIX for allowing a virus to propagate?

You edgy fuckers think shoving your tired, irritating Microsoft bashes into every god damn article on Slashdot is so clever. Examine the facts, genius - if someone wants to fuck with software, they will find a way.

Re:Sue the software companies

[NineNine]

No matter which way you look at it, there's absolutely no comparison between tobacco and spam. Tobacco kills people, spam is a minor inconvenience. This isn't life or death, and it's sad to see geeks with nothing else in their lives acting as if spam is as bad as say, Hitler. Yes, it's a PITA. Now, get on with your life.

Re:Sue the software companies

[Anonymous Coward]

OHHHH. So you are an l33t BSD user? Who cares what you actually use. The point is that any operating system that wants to cater to end users has to have an easy method to run and install applications.

I also thinking that looking at an attachment and clicking an attachment are worlds different. You know - look with your eyes not with your hands.

I also like the fact that you are trying to save Karma by posting AC now. Isn't it funny how people can be obsessed with such silliness. I avoid it completely by always posting AC.

Re:Sue the software companies

[jandrese]

The difference here is that to execute a bit of mail in a regular mail client, you have to go through some work (and it's somewhat technical, many computer illiterate users would have a difficult time doing it). In fact, it is those very users that cause the most problems with these email distributed viruses. By the time someone is literate enough to know how to excute an attachment, they should be (hopefully) savvy enough to realize why it is not a good idea. This is one of those cases where ease of use is actually detrimental (you don't see that very often).

Re:Sue the software companies

[Anonymous Coward]

Yeah yeah, I was around for the Morris worm. That was 1988. How about something current? What you provide was tantamount to "Eniac had tubes! OMG OMG!"

Fucking microsoft apologists always have to resort to 15 year old stories. Losers.

Re:Sue the software companies

[Trigun]

Perhaps Microsoft should stick by the rules that if the damned file ends in .bat, it should be plain text, not say that the user screwed up and we'll just execute the code anyways.

It is Microsoft's fault for how they decided to deal with executable code. They have gone too far in their ease-of-use campaign, and should be admonished for it, not lauded for it. It is time to stop coddling the end user. If they want a computer, they should have to learn to use it. I don't buy a jet because I don't fly and do not want to learn. I don't expect Boeing to make a jet that I could fly because I don't want to put the effort into using it properly. That would be stupid. And that's what the computer industry has become.

For Chrissakes, my grandmother can learn to use a computer properly, which is more than just connecting to the Internet and checking e-mail. If she couldn't, she wouldn't have a computer.

Re:Sue the software companies

[NetJunkie]

You misread. I didn't say the bomber was not at fault. The original poster is blaming some security hole when there isn't one. This isn't a security problem, it's a people problem.

Re:Sue the software companies

[erlorad]

Yes, but you can't sue packaging material producers or fedex because they allowed that package with hazardous materials to be labeled as 'books', delivered and allowed itself to be opened.

Re:Sue the software companies

[NetJunkie]

You misread. The original poster is blaming some security hole when there isn't one. This isn't a security problem, it's a people problem. Someone has to take the blame. It's the person sending the virus. But the person receiving it needs to pay a bit of attention.

Re:Sue the software companies

[mlefevre]

Re-reading the article won't help, as the article isn't correct on that point. If you check a technical write-up, e.g. Symantec's, you can see that this worm actually arrives as a .zip file.

So, users need to do something like click on the attachment, wait for Winzip to appear, and then double-click on the executable file (the type will be displayed) in the Winzip interface to run it (and if they're using a version of Winzip that's not ancient, they'll get a Winzip pop-up pointing out that the file is executable and asking for confirmation that they want to run it).

The problem isn't the software, it's the users.

Re:Sue the software companies

[Anonymous Coward]

"On the Internet, flamebait is a "posting" or note on a Web site discussion forum, an online bulletin board, a Usenet newsgroup, or other public forum that is intended to elicit the extremely strong responses characteristic of flaming and active public discussions. To be effective, flamebait should be a bit subtle (but not too subtle) so that potential flamers will "take the bait." This term is similar to troll, which is an effort to get a reaction from readers but not necessarily for the purpose of eliciting flames."

I think your post fits that definition to a tee.

Re:Sue the software companies

[Anonymous Coward]

Clicking on the attachment is all that's needed.

Wrong.

the reg reveals that the virus arrives as a zip attachment. Which means the file has to be unzipped and the executable run in order to work.

So this is not some Outlook exploit, this is purely and simply users being idiots and going through several stages in order to be infected.

But rather than study the subject, you'd rather bitch about Windows in the hope of cheap Karma. If you weren't a Karma Whore why did you start posting AC halfway down your own thread?

Spend less time polishing your karma and more time reading about the subject in hand. Then you won't look such a complete idiot.

Re:Sue the software companies

[Trigun]

Using the same little scenario, say some terrorist groups were sending bombs all over the world via the postal system. The return address was always from someone you know, or a friend of a friend, but the handwriting was off. The package looked kinda suspicious, things were spelled wrong, and you weren't expecting it.

But you open it anyway, knowing full well that there are madmen running around shipping bombs in the mail. You open it and it explodes in your face.

I say that you got what you deserved, it's just a shame that it levelled your whole fucking apartment building.

Re:Sue the software companies

[Anonymous Coward]

OH Puh-leeze!

The Tech TV definition of flamebait. I find this much more accurate. Your def is much too ... "old" internet. Pre-commerical DNS and AOL days.

Re:Sue the software companies

[grub]

Ah, then the article was wrong. Thanks for clarifying that. I was basing my "click and run" theme on what the linked-to article said, thanks.

Re:Sue the software companies

[Anonymous Coward]

You (wrongly) assume that I run Linux.

Given that you claim your hypothetical executable is a shell script (....chicks.sh) and that you'd have to chmod it +x, I think it's reasonable to assume you are talking about Linux not Windows.

Perhaps you should start talking about .exe and right clicking attributes if you geniunely don't want people to get confused.

Or you could continue to try deliberately scoring cheap points in a thread where you've been made to look an total idiot.

Re:Sue the software companies

[Robmonster]

Nonsense.

Thats like saying that I should sue the phone company as they make it possible for me to receive telesales calls (and I pay a monthly fee to have a phone line, much akin to a broadband monthly charge)

Re:Sue the software companies

[Anonymous Coward]

I think it's reasonable to assume you are talking about Linux not Windows.

Get a grip. He could be talking about any Unix version or clone thereof.

Re:Sue the software companies

[Neon Spiral Injector]

Any distro that mounts the /home partition as noexec, and since you aren't running as root you won't be able to save the file into a partition that does allow executables to run.

Re:Sue the software companies

[Hrothgar The Great]

What the fuck do you think you know about anything? There was an apache worm about two years ago, you drooling moron. It was a flaw in one of apache's add on modules, mod_ssl. This "microsoft apologist" found this very worm on my apache server which was running on a fucking cable modem in my apartment.

APACHE WORM FOR ILLITERATE MS BASHERS

Is it your assertion, by the way, that I am a "microsoft apologist" because I think that you're a moron and your opinions are misguided and ill thought-out? I've been running Linux since 1997, you jackass, so I'll finish this post the same way I started it - what the fuck do you think you know about anything?

P.S. there was a more recent Apache worm that affected some BSD variant or another. TRY READING ONCE IN A WHILE.

Re:Sue the software companies

[blane.bramble]

There are other operating systems that run shell scripts and use chmod +x that aren't called Linux you know...

Re:Sue the software companies

[Anonymous Coward]

Ahh, so the worm wasn't actually an Apache exploit, it was an exploit of an Apache module. Nice try, go back to sleep, it sounds like you need a nappy.

Re:Sue the software companies

[Hrothgar The Great]

What's your point in regard to security flaws being exploitable in all software and their bearing on the discussion of whether software authors should be held responsible for attacks that occur because of them? (Remember that discussion from 10 MINUTES ago? Think back - I know it's hard)

Oh that's right, you never were making a point in the first place. And you couldn't even be BOTHERED to respond to the BSD Apache exploit which WAS in fact a core Apache issue.

Not that it matters - do you think OpenSSL wrote itself or magically appeared out of the sky one day, or did someone AUTHOR that?

Re:Sue the software companies

[Anonymous Coward]

Yawn.. look man, just make me a Foe and ignore my posts. You have nothing to offer.

Goodbye.

Re:Sue the software companies

[tepples]

Any distro that mounts the /home partition as noexec

Then how would users of such a system develop and test programs?

Re:Sue the software companies

[irokie]

There is a computer driving-licence. well, at least in europe. the ECDL. it's a joke. the premise is "can you open a document in word, can you paste in excel"...

it's so pathetic that it's almost become a blackmark against you on your resume/CV

And anybody i know who's actually got the damn thing would be the people i'd most likely peg to get hit by these worms... they know enough to open and download attachments, they just don't know what to look out for.

Re:Sue the software companies

[Malc]

You sound rather elitist. My mother has been studying for that computer driving licence. It's vastly improved her confidence with computers, which for most people is their biggest stumbling block. Don't under-estimate that.

I live 5,000km away, and so helping my mother with computer problems can be a pain. Now she is able to understand the basics of what I'm telling her and she is able to follow my instructions with less hassle, and notices when things don't seem right. I think this thing is a very good idea and the start in the right direction.

You might think it is a blackmark on somebody's CV, but I'm guessing you're not involved in hiring for the same positions that my mother would apply for - in her circles it's a huge bonus for her employment chances. By dismissing the qualification, you show you either work in a niche of society (yes: that includes people like me who are software engineers), or that you're an arrogant elitist prick who I wouldn't want to hire for my team in case you turn out to be another pain-in-the-arse prima donna with no real understand of most business requirements, and too much arrogance to get along with non-technical people.

hmm....

[frodo from middle ea]

I always though the money making scheme from "Lock stock and two smoking barrels" was very practical and doable..This looks preety similar to that.

In case you don't know what I am talking about, Go see the movie before you mode me down.

Re:hmm....

[Space cowboy]

If you're talking about the "mail order" scheme, I agree. If you mean the dope scheme, I think that's out of my league - far too (expletive deleted) dangerous :-)

Simon.

Re:hmm....

[Anonymous Coward]

"Go see the movie before you mode me down."

chmod 777 type-o

Re:hmm....

[frodo from middle ea]

Yep the mail order scheme. Can't be too elaborate from work place ;)

Re:hmm....

[IWorkForMorons]

What? You don't think growing copious amounts of ganga in an old castle in the middle of Britain with two braindead potheads is good safe money-making opportunity?

Re:hmm....

[Anonymous Coward]

Three hundred dollars per wank! Oh wait, that was "Way of the Gun."

Re:hmm....

[Anonymous Coward]

No - he means the dildo scam... watch more carefully next time

Re:hmm....

[mrtroy]

Copious

That was one of the funniest lines in the movie.

Go get the B.B. guns out while you are at it.

Re:hmm....

[gsx1400]

Alright, alright, Keep yer Alans on!

baseball bat

[Clay Pigeon -TPF-VS-]

What we need to do is find out the physical addresses of these nice individuals and try to reason with them using advanced negotiation tools, such as baseball bats and tire irons.

Re:baseball bat

[Icarus_SFX]

And if we all do that we give them a tast of their own medicine.

A CBoS(tm) attack :-)
(Collabarative Battering of Spammer)

Re:baseball bat

[Anonymous Coward]

Why is such an insightful post modded funny? No one is going to stop these spammers if we don't take matters into our own hands!

Re:baseball bat

[mirko]

Whoever modded this "Funny" has a big problem.

Get a life : it's email, it won't kill you.
Just use a decent mailer, some antispam filter and update it.

Why would you just physically hurt somebody ?
"He" may spam you but there is justice, after all, so let it do its job and contact your representative to get this point on top of the next government deliberation list.

Re:baseball bat

[lexluther]

What we need to do is find out the physical addresses of these nice individuals

I looked it up for you:

Microsoft Corporation
One Microsoft Way
Redmond, Washington 98052

Re:baseball bat

[Anonymous Coward]

As if your congressman is actually going to do something constructive on the subject. Most congressmen only know as much about computers as Microsoft, the RIAA, MPAA, and Intel tell them.

Re:baseball bat

[Rasta Prefect]

Get a life : it's email, it won't kill you.
Just use a decent mailer, some antispam filter and update it.

Why would you just physically hurt somebody ?

I can think of plenty of reasons. Like, say, promoting child and bestiality porn. To anyone, including children. Because they refuse to take no for an answer and mutate their mail around my spam filters. Because they hammer mailservers with dictionary attacks, wasting resources that aren't theirs. Because they pull the kind of crap referenced in this story. Because they file frivolous lawsuits against anti-spam organizations who are just trying to help people avoid their crap, so that they can try and drain their resources. Because the email address I've used as a public point of contact on my websites is so flooded with bestiality porn that I'm afraid to open it in public.

In short, I don't think it's the right response, but theres certainly plenty of motivation to do so. I'm not going to cry over it if someone takes a baseball bat to Alan Ralsky's head.

Re:baseball bat

[mirko]

If enough people ask him, then he will.
In Switzerland, a law says that if more than 100000 people want something, then a referendum has to be made.

Re:baseball bat

[Anonymous Coward]

Well this ain't Switzerland, and there is no national referendum.

Re:baseball bat

[Lumpy]

What we need to do is find out the physical addresses of these nice individuals and try to reason with them using advanced negotiation tools, such as baseball bats and tire irons.

no, socks with soap in them, and bags fill of doorknobs do a much better job.

This is your first time as a part of an angry mob?

Re:baseball bat

[mirko]

Even if I'd hit someone because of these things, noone of the spams I ever received contained such .
I had spams about :

• university diploma
  
• medicine (including penis enlarging stuff)
  
• pr0n
  
• Nigerian money
  
• mini toys
  
• mortgages
  
• etc.
  

So, which nasty people did you give your email address to ?

Re:baseball bat

[Anonymous Coward]

How can I sign up for the beastiality porn emails?

Re:baseball bat

[Spl0it]

Actually it could kill you. For example having to deal with increasing spam and the stress involved with that as well as the stress from trying to block the spam by updating/changing spam filters on a weekly or daily basis could kill you. The fact that stress is probably one of the most comon reasons for say an early heart attack then I think its safe to say that by daily stress brought on by email after email that spam can kill. I think if I visited a spammer I wouldn't harm him the first time, I would just make it very clear that people won't tollerate this privacy invasion. After all my e-mail box is MY email-box.. its not his or anyone elses to flood. So if said spam continued I might get a few (10-20) people or a few hundred people and all go pay said individual a visit. Whether we actually hurt said invidual would be redundant as the fear it would instill him and the chaos it would cause when police tried to breakup the large group.. it would be vaguly obvious that spammers are criminals and to this spammer he may then consider another line of work.

Re:baseball bat

[Anonymous Coward]

Calm down. Bestiality's fun! It's the new millenium, man!

Re:baseball bat

[Pig Hogger]

Why would you just physically hurt somebody ?

Those aren't human beings. Those are psychopaths who do not give a flying fuck if they are costing $11 billion a year in lost productivity.

Anybody who'd walk in any store and start shouting at customers would promptly be hauled-off by the fuzz. Why are'nt spammers (who do the same thing) aren't????

Re:baseball bat

[pyros]

noone of the spams I ever received contained such .

Not all of us are as fortunate as you then.

So, which nasty people did you give your email address to?

studies have shown that having you email address in unaltered text on a web site is the most sure-fire way to get on spam lists. So any web archive of USENET or mailing lists which does not strip the address out of the headers is like a candy store. Even if they do strip the headers, lots of people put their address in an email signature, which will get displayed in the archive.

Re:baseball bat

[Anonymous Coward]

Get a life : it's email, it won't kill you.

Did you even read the title of the article. It's not just e-mail. Jeeze.

Re:baseball bat

[JuggleGeek]

If they'll stop forging my domain in their spam, I won't be nearly as angry with them.

The 400-500 spams a day are a pain - but I can handle them. Sending me the bounces, the complaints, and basically trying to pretend that *I* am the scumbag is pissing me off. If they don't want me to fight back, they need to leave me alone. I've already tried contacting the feds, the Texas AG, etc. Those guys don't give a shit - it isn't there problem. I do give a shit - it's my problem.

I haven't beaten the shit out of a spammer, but believe me, I've been tempted, and the forgeries still continue.

Re:baseball bat

[stephenbooth]

I have my own domain which is well spidered by Google and other search engines. I frequently get masses of spam addressed to a variety of common names at that domain advertising kiddie porn, beastiality porn &c. On top of that I have a variety of other addresses that I've used over the years, e.g. on USENET when it was thought to be safe to do so, and get similar mails to those addresses. Fortunately Spamcop blocks most of them. I've recently run into problems where the sheer volume of spam and bounces from spammers putting my address in theri From: field I've been recieving (one day I got 400,000 spam messages, approximately 399,950 of which were legitmately blocked by Spamcop) have caused Spamcop to threaten my account as their systems were basically being DOSed!

Stephen

Re:baseball bat

[Tackhead]

> In short, I don't think it's the right response, but theres certainly plenty of motivation to do so. I'm not going to cry over it if someone takes a baseball bat to [a noted spammer's] head.

Agreed. I don't advocate extralegal violence against spammers, but were such a thing to happen, and were I asked to sit on the jury of the person charged with the offence, I would return a verdict of not guilty. Assault and/or homicide are crimes against human beings. In my system of values, spammers ceased to qualify as such several years ago.

If asked for my views on spammers during jury selection (DAs in spammer-infested areas take note, I'm by no means the only one), I would admit as such and would likely be removed from the pool of eligible jurors. If not asked during jury selection, I would simply stick to my guns during deliberations and demand a verdict of not guilty on the grounds that neither an assault nor a homicide was committed.

My beliefs would most likely result in a hung jury and a retrial, or, (in the extremely improbable event that I sway the other 11), jury nullfication -- the setting of a precedent that in that court's jurisdiction, and unless/until the verdict is overturned by a higher court, spammers are no longer protected by laws intended to protect human beings. Let hilarity ensue.

Re:baseball bat

[Rasta Prefect]

So, which nasty people did you give your email address to ?

Well, the real flood started about the time I listed it as the contact address for the local anime club. I don't think it's a cooncidence that a relatively high percentage of the pr0n spam is for "h0t t00ns".

Re:baseball bat

[mirko]

This is about the Internet, so, this is also about Switzerland.

Re:baseball bat

[LuxFX]

Get a life : it's email, it won't kill you.

No, but it's costing me thousands of dollars.

I estimate each piece of spam to take roughly 1 second of my time. The second is either spent scanning and deleting the spam that got through, or the time spent setting up the filters for the spam that was caught. I multiply that by my average hourly rate, and find out that, based on my current spam average, I will loose around $2,500.00 annually due to spam.

That is not acceptible, I would obviously rather the time be billable hours. Or, as is usually the case, I would rather go to bed earlier instead of having to make up for time wasted.

Re:baseball bat

[WNight]

These people are abusing any and all common resources they can find, as well as attacking anyone who tries to get in their way.

Why shouldn't they be killed? What possible reason could there be to justify their ongoing existence at the cost of everyone around them? It's not like they don't know they're hurting people - they're specifically setting out to do so.

I'm willing to give everyone the benefit of the doubt, in the beginning, but I don't see why it's unreasonable to think that people could abuse their neighbors long enough for that assumption to change to them having to prove their worth.

Re:baseball bat

[Glass of Water]

It's not the worst thing in the world to be a spammer. Neither is it the worst thing to hit someone with a baseball bat.

Re:baseball bat

[jayrcee]

I multiply that by my average hourly rate, and find out that, based on my current spam average, I will loose around $2,500.00 annually due to spam.

Using that logic you will lose around $50,000 due to reading /.

Re:baseball bat

[LuxFX]

which pretty much takes us back to the problem with spam. I want to read /., so I choose to go and visit /.. I don't want spam. But it's shoved in my face, and I have to either deal with it or risk loosing valid emails from my clients/users.

Re:baseball bat

[thogard]

What we need is one small town DA thats got the balls to go after one of these idiots and one judge that feels he must protect the children.

Lets assume I've got the name of one of the bastards. What can I do about it? My local DA is clueless and won't do a damn thing. The FBI could care less. The state police are even less interested than the FBI. MS is now offering a reward in theory but there seems to be a lack of decent contact info.

The best DA for this kind of case would be someone that has political aspirations, knows how to make use obscure laws to extend sentences, is very conservative and is willing to stand up for what they belive is right. I'm looking for someone like Ashcroft when he was still a prosecuting attorney. They also need to be contactable so they need to be from an area small enough that someone random person on the street could call them at their office.

So does anyone have the name and phone number of a DA that meets the requirements?

Re:baseball bat

[Anonymous Coward]

You can't access the physical address in protected mode--it'll segfault. ....Err....excuse me...it's late...

Re:baseball bat

[Grizzlysmit]

Whoever modded this "Funny" has a big problem.

Get a life : it's email, it won't kill you. Just use a decent mailer, some antispam filter and update it.

Why would you just physically hurt somebody ? "He" may spam you but there is justice, after all, so let it do its job and contact your representative to get this point on top of the next government deliberation list.

Hmmmm clearly your are humor challenged, I think it's you who needs to "Get a Life"

And don't even appear to defend Spammers, he who defends the "morally indefensible" is "morally indefensible"

Re:baseball bat

[mirko]

Gruezi, your Boldness,

Hmmmm clearly your are humor challenged, I think it's you who needs to "Get a Life"
Well, my humour is not compatible with most slashdotters ; but IRL, chicks do seek and appreciate my company :)
So, I am not sure which sort of life you'd like me to get ?

he who defends the "morally indefensible" is "morally indefensible"
some sufficient guy just called, he wants you to give him his sufficiency back.
I told him you might give him some back, the rest being sufficient enough for you.

Re:baseball bat

[Anonymous Coward]

So what's it like being the biggest douche in the universe?

Yeah...

[Kirk Troll]

Apparently this reincarnation comes as an attachment offering naked photographs.

Yeah... apparently, people are still STUPID enough to open these things. Does ANYONE out there still beleive you can get "100% free porn, just click here!" from some sleezy, unsolicited email that just redirects you to a credit card entry, despite the "free"?

I guess so...

Re:Yeah...

[cbreaker]

Unfortunately, some people do..

If you send out a million e-mails, and only .5% click your thing, then you are still getting 5,000 people to your site.

It sucks. I hate it. People are so dispicable.

Re:Yeah...

[IWorkForMorons]

people are still STUPID enough to open these things

Because, for some people, curiousity is just too strong to resist. They know it can't be true, but they'll click it anyways "just in case". Then they'll call me to ask why their computer is all of a sudden slow, at which point I clean their system and buy a new pair of boots because my old left boot is embedded in their ass...

Re:Yeah...

[Anonymous Coward]

Does ANYONE out there still beleive you can get "100% free porn, just click here!"

Free pr0n does exist.

Re:Yeah...

[FunkDaddy]

Well when your grandma gets an email labeled "hi" I doubt she's thinking it's gonna be pron.

Re:Yeah...

[Savatte]

dude, when you are horny enough, you'll click on ANYTHING

Re:Yeah...

[NewStarRising]

... And all those "free" Operating systems, and "open source" Programs! i don't beleive people still fall for that old scam!!

Re:Yeah...

[Anonymous Coward]

It's called lack of self control...

these are the same people that speed and drive like idiots...

No self control.

Re:Yeah...

[Anonymous Coward]

Free porn is a treasure. It is buried under masses of false treasure (all those spamvertised websites) and is a guarded secret kept by a select few.

Re:Yeah...

[TheMidget]

at which point I clean their system and buy a new pair of boots because my old left boot is embedded in their ass...

Photos? You know, he might become the new goat man!

Re:Yeah...

[gnu-generation-one]

"Yeah... apparently, people are still STUPID enough to open these things"

Strange isn't it. You have an email address, you write it on your job application, and a week later you get an email with "Re: your job application". How can people be so STUPID as to open these things?

I'm pretty stupid, I open most of the letters I receive at home. It would be nice if I could just bin them like you do with your email, but last time that happened, the council came asking where was their tax cheque?

Email is better, because it doesn't matter if you delete anything that looks suspicious. Like, I can delete the "Renew your website NOW" email because it's spam and only stupid people click on it, but I know that I should read the "Renew your website NOW" email, otherwise my domain name doesn't get renewed.

Re:Yeah...

[Spl0it]

So in Outlook Express I have to click on an email to delete it, and emails auto open when clicked on. Hmm.. I'm guessing since the attachment is run automatically (thx Microsoft) I would say I don't have much choice but to get infected or mass-select emails just to delete this one safly. Hope I don't miss click and click on some spam like this!

my $0.02 :)

Re:Yeah...

[poot_rootbeer]

I clean their system and buy a new pair of boots because my old left boot is embedded in their ass...

You ought to alternate between left and right. That way you'd only have to buy new boots half as often...

Re:Yeah...

[jjhlk]

I hate the ones that say something like, "See you on Tuesday." I don't remember anybody named Darcy meeting me on Tuesday, but how can I be sure? I'll have to open it and find out. Nope, Darcy wants me to hire his sleazy escorts. Of course I'm not susceptible to those sorts of worms, but otherwise it could be a dilemma.

Re:Yeah...

[Anonymous Coward]

There's enough free porn on the internet as it is, why would you click on a SPAM link?

They should've known better

[fred_sanford]

The virus is sent as an attachment to a anti-spamming company yet they open the attachment anyway and get infected? I'm just as against spam and viruses as the next person but you figure a tech-savvy company that's supposed to stop unwanted e-mail would be more cautious in opening attachments.

Re:They should've known better

[arkanes]

The virus installs a DDOS zombie that attacks Spamhaus. It's not that Spamhaus got infected.

Re:They should've known better

[fred_sanford]

sorry to respond to meslef. just realized that it was the users running attachments not the company. my bad for jumping the gun.

Re:They should've known better

[kefoo]

I think you misunderstood. The virus sends an email about the shipment of the porn CDs with a spoofed return address that's actually the address of an anti-spam organization, so they get bombarded with emails from users who think they're sending them child porn.

Re:They should've known better

[mercan01]

Um...maybe you and I read a different article, but the article linked here talks about a DDoS from external sources.

Re:They should've known better

[NickFitz]

Somebody else's bad for modding your original post "+1 Insightful" :-)

Re:They should've known better

[maximilln]

Agreed. How the heck do people in an anti-spamming organization get caught up on this? They should really know better. If this article is true then I wouldn't be surprised to find out that the anti-spamming organization is staffed by tech-ignorant do-gooders who, meaning well, only further pave the road to hell.

If there really is child pornography being sent on CD through the mail then the FBI should really be involved in tracking this down. Using the postal service to commit a crime is a federal offense in itself. Certainly the attackers can be fudging their return addresses on the packages but there are so many other ways of approaching the problem. ISPs already track users that visit such websites. CDs are imprinted with media identifiers. Are there lot numbers which can be tracked to distributors and regions? What about imprints left behind by the burning hardware and software? What about identifiers embedded in the pictures themselves?

Why aren't existing security admins cooperating on this? A few years ago I spent a couple months making a concerted effort to track down the spam that made its way to my inboxes. I would look at the e-mail trail, run WHOIS and DNS lookups on the servers, find the last known good smtp portal, and try mailing the admin to ask him to help stop the spam. Typically I received no response leading me to believe that the operator was an absentee sysadmin who collects his paycheck but doesn't care about his job. Additionally, so many of the smtp servers were running Windows that it isn't unthinkable that the admin can really do nothing about it--his box is backdoored and the executive board would fire him if he took it down to reinstall. That same executive board probably insists, for contract skim purposes, that he continue to use a Windows platform.

On the issue of funding I don't believe that these people really and truly make the majority of their money from stolen credit cards. I feel that has got to be nothing more than scare tactics and hype to direct attention away from the real source of funding. I believe the majority of their money comes from taxpayer subsidized small business loans and tech-ignorant investors. I've traced a large amount of my spam back to addresses associated with "desktop advertising agencies". "We sent out one million e-mails today. It's technically not spam--don't ask questions. There's a loophole in the definition which makes this not spam. This will look great on the quarterly report and on the small business report to the bank. It will also bump us up into the 'productive' category so that we can qualify for an additional $X million in taxpayer subsidized small business loans."

If we want competent sysadmins we need to hire people who really have a passion for the systems that they work on. Companies are free to hire me but I'm always given the critical eye of scrutiny because I didn't spend the $15k to get night-school certifications.

Re:They should've known better

[geoffspear]

What I want to know is why our schools aren't putting more funding into reading comprehension. You could certainly use an in depth course.

Re:They should've known better

[IamGarageGuy 2]

I think you are missing the point regarding the cd's being sent. Nobody is sending out cd's - it is just the threat of sending them that scares the end user.

Re:They should've known better

[maximilln]

-----
"So many Internet users are flooding us with complaints about these child porn CDs that we supposedly ordered for them," said Linford, adding that he was cooperating with police
-----
You're right. I was reading in pan and scan mode and didn't see the paragraph about this one in it's entirety.

Please turn your flame mode off.

Re:They should've known better

[Rahga]

With the exception of people (?) like Michael Jackson and R. Kelly, who probably forwards these worms to everyone in his address book intentionally.

Re:They should've known better

[JuggleGeek]

Your post is quite possibly the stupidest thing I've ever read on slashdot.

Spamhaus didn't open an attachment and get infected. Idiots like you opened the attachment and got infected. And that attachment launches DDoS attacks (amoung other things) which are directed at Spamhaus.

Can your tiny little brain comprehend that?

How does he know ???

[mirko]

These guys write trojan (viruses), they carry out DDOS attacks and they get their money through selling stolen credit cards and spamming

Who are "these guys" ???

Re:How does he know ???

[ePhil_One]

Who are "these guys" ???

These guys are directly opposed the "They" in "They say ...",
who are not to be confused with "The man",
which is a common misconception

Re:How does he know ???

[Neophytus]

These guys

Re:How does he know ???

[marsu_k]

Apparently, not one of those guys, as none on the Spamhaus page are French (scroll down the page to find the hidden text within the worm)

Good

[Karamchand]

I think this is actually a good thing because it links spammers with viruses and therefor reinforces the association "spammer = evil". Perhaps sooner or later more people (and gov. agencies and companies) see spam not just as annoyance but as attack.

Re:Good

[southpolesammy]

Worse yet for them, it associates spammers and virus writers with child pornography, which is considered among the lowest of the low for crimes. If this doesn't get those in a position of power to realize the depths of depravity that these people are willing to go to, I wonder if anything will.

Re:Good

[jafuser]

I agree that it's good that this kind of behavior demonstrates to the less technically literate people in our society that the spammers are not just "eagar entrepreneurs", but that they are (as another post put it) slowly becoming a form of organized crime.

The bad side of these developments is that the spammers have created a job market for virus writers.

Some of them are probably being paid enough to make a living off of their destructive skills, which means they have more time to dedicate to making particularly malicious viruses.

Re:Good

[Karamchand]

I can't imagine why they'd write specially malicious viruses since they depend on all the infrastructure they'd destroy. They need the thousands of unsecured running windows boxes, trojaned of course. They also need the bandwidth.

That's why I don't think we'll see viruses which are particularly evil for everybody. (There might be a rise in viruses which are used of a dDoS attack which of course is a bad thing - but it's not dangerous for most users' computers)

Re:Good

[kent_eh]

...it links spammers with viruses and therefor reinforces the association "spammer = evil". Perhaps sooner or later more people (and gov. agencies and companies) see spam not just as annoyance but as attack.

And rather than just ruminating amongst ourselves, here on /. , this is a good opportunity to get in touch with the local newpaper's (or tv or radio) "technology columnist" and ask them to re-inforce this point to their audience.

This attack is currently in the headlines, so it'll be easy for them to make the connection for the general public.

Even if it only gets 1% less people replying to spam (and especially buying from spammers), then the 'bad guys' loose ground. And we all win.

Re:Good

[Cecil]

Since when do authorities really care about child pornography? Last I saw, their favourite passtime is occasionally busting people who download child pornography, always claiming "this is the most horrific child porn I've ever seen", to make people feel safe that "don't worry, we've taken another sicko pervert off the streets". Meanwhile, the people who actually abuse children and take the photographs and the people who sell them, well they're a little smarter than your average child porn downloader, so no one is willing to expend the effort and money required to stop them.

Just one of my pet peeves.

Re:Good

[scrytch]

> Since when do authorities really care about child pornography? Last I saw, their favourite passtime is occasionally busting people who download child pornography, always claiming "this is the most horrific child porn I've ever seen",

Here is your official Media Tool badge, proclaiming you a credulous dupe of major media. There are certain requirements for keeping and wearing this badge. Examples include but are not limited to:

1. Ignoring the existence of units dedicated to tracking and busting child porn rings, and assuming that 100% of arrests are televised, and if there wasn't a story today, no one was arrested or investigated.

2. Believing in the rising omnipresent danger of violent crime in every neighborhood in the USA, based on news coverage of said crimes. This belief must be held in spite of the steady decline of violent crime rates in the USA since the 1970's.

Corporate communication guidelines prohibit wearing the Media Tool badge at the same time as any Critical Thinker insignia. If you do not agree to follow either of the above guidelines, you may return the Media Tool badge for a full refund.

Re:Good

[Aelfy]

It also associates the anti-spam sites with child pornography. In the long term I agree with you, but in the meantime, Echelon (et al) has picked up all these emails confirming despatch of porn going to the anti-spam sites. I suppose it isn't hard to prove they were attacked, but it might cause them headache.

Re:Good

[Fishstick]

>Here is your official Media Tool badge

mod this up, please

one of the best posts I've seen on /. for quite some time

Re:Good

[Anonymous Coward]

Good? That's great! Now the spammers themselves are giving reasons not to "enlarge your penis with the lowest mortgage rates ever."
Keep up the good work morons.

Re:Good

[minas-beede]

Well said. It also brings the pure anti-abuse people into the battle against spam - or should. Also good.

What proof do they have?

[Steve 'Rim' Jobs]

Seriously, I dislike spammers as much as the next guy, but immediately saying this is the work of a spammer is stretching it just a bit. For all we know the person behind the worm has nothing to do with spam.

Re:What proof do they have?

[Anonymous Coward]

Your mom

Re:What proof do they have?

[DavidTC]

Yeah, all those worms that attack anti-spamemrs must be a wacky coincidence.

Re:What proof do they have?

[JuggleGeek]

Seriously, I dislike spammers as much as the next guy

Seriously, I doubt that.

but immediately saying this is the work of a spammer is stretching it just a bit. For all we know the person behind the worm has nothing to do with spam.

You obviously are not well informed on the subject. This isn't the first time they've used viruses to help launch DDoS attacks on anti-spam sites. Occam's Razor would suggest that the reason they are working so hard to try and take down those sites is because anti-spam sites keep the slimeballs from making as much money.

But your "the worm has nothing to do with spam" argument (with not so much as a hint of a reason) is so compelling, I'll ignore the evidence and just believe that spammers aren't slimey enough to write worms.

You are defending some of the most dishonest people on the planet, despite all evidence against them.

Re:What proof do they have?

[elemental23]

Like another post said, the fact that infected machines try to DoS anti-spam services is a pretty strong indication. Also see the recent Sobig worm that installed a mail proxy on infected machines. The sole purpose of this worm is to create proxy servers to relay spam through. This has been well-documented.

Anti-DDOS

[Angram]

Isn't there some way to distribute the anti-spam sites/lists so that a DDOS attack can't take it out? All that's needed is a simple neural net-style system - redundancy and distributed content (which the internet makes simple) could solve this sort of problem, at least for now.

Re:Anti-DDOS

[Anonymous Coward]

Perhaps the computers are sending out the emails in order to persuade us to create such a system. Who knew that it would be spam that would cause us to build Skynet, not US defense.

Re:Anti-DDOS

[Angram]

Perhaps you misparsed that - I intended "simple" to mean "basic," as opposed to implying that it was an easy task (i.e. "simple to design"). I have no idea how easy it would be to create, however I think it's worth pursuing. If normal computer programmers are having a hard time, perhaps they should consult with people who program AI systems.

Re:Anti-DDOS

[Nasarius]

Maybe you could explain how neural nets (an AI programming construct) relate to a network of distributed content.

Re:Anti-DDOS

[liquidsin]

I'm definitely not an expert on this topic, but hey, this is /. and everyone gets their $0.02, so here goes. A spam blacklist needs to be up to date. Every time someone tries to add to that list, the update would need to be pushed out to all of the nodes on the net. And all of the machines using that blacklist would still need to get the updated blacklist from one of those nodes, so they'd need to connect to some central server to at least be redirected to one of those nodes. So some central server still has to exist to tie all the nodes together, or so I'd assume. And that central server is the one that would get raped. And now, time for everyone who knows more about this than I do to tell me I'm wrong!

Re:Anti-DDOS

[Icarus_SFX]

You could have a look at :
http://www.agk.nnov.ru/drbl/en/index.html
They have a distributed network.

Also a while ago I saw a document describing a form of P2P network with Blocklists. Dunno the URL anymore but it was a kind of nice idea, it included Signatures. So that the network could not be injected with false information.

But from that point of view you could also use web of trust structure.

Most Anti-Spam sites use servers located at diffrent sites/parts of the internet.

Example spamcop.net:

# dig bl.spamcop.net ANY
; <<>> DiG 9.2.1 <<>> bl.spamcop.net ANY
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 45125
;; flags: qr; QUERY: 1, ANSWER: 8, AUTHORITY: 0, ADDITIONAL: 8

;; QUESTION SECTION:
;bl.spamcop.net. IN ANY

;; ANSWER SECTION:
bl.spamcop.net. 172800 IN NS blns9.spamcop.net.
bl.spamcop.net. 172800 IN NS blns7.spamcop.net.
bl.spamcop.net. 172800 IN NS blns10.spamcop.net.
bl.spamcop.net. 172800 IN NS blns11.spamcop.net.
bl.spamcop.net. 172800 IN NS blns6.spamcop.net.
bl.spamcop.net. 172800 IN NS blns8.spamcop.net.
bl.spamcop.net. 172800 IN NS blns5.spamcop.net.
bl.spamcop.net. 172800 IN NS blns4.spamcop.net.

;; ADDITIONAL SECTION:
blns9.spamcop.net. 172800 IN A 208.39.222.166
blns7.spamcop.net. 172800 IN A 216.234.115.20
blns10.spamcop.net. 172800 IN A 206.67.234.112
blns11.spamcop.net. 172800 IN A 209.92.188.201
blns6.spamcop.net. 172800 IN A 209.198.142.146
blns8.spamcop.net. 172800 IN A 66.6.205.130
blns5.spamcop.net. 172800 IN A 198.145.240.35
blns4.spamcop.net. 172800 IN A 194.109.6.147

;; Query time: 3617 msec

Re:Anti-DDOS

[Angram]

You don't need every node to have all of the info. If you distribute it, you can have overlapping info, and make a minimum/maximum of nodes containing the same info (i.e. 3-5 occurances of each blacklisted server).

Perhaps the central server (if necessary) could use authentication measures to block DDOS attacks.

Re:Anti-DDOS

[Angram]

By definition neural nets are distributed; that's the entire point. All data is stored in individual interconnected nodes ("neurons"). By asking me to "explain how neural nets relate to a network of distributed content," you're essentially asking me to define the term "neural net."

My original post said "neural net-style" - I'm not asking for an true neural net, just suggesting that a construct based on one would be ideal for the situation.

Re:Anti-DDOS

[merlin_jim]

Isn't there some way to distribute the anti-spam sites/lists so that a DDOS attack can't take it out? All that's needed is a simple neural net-style system - redundancy and distributed content (which the internet makes simple) could solve this sort of problem, at least for now.

The problem isn't that its not doable - P2P network technology like kazaa or bittorrent would do the job, as would the same type of network hardening that was done to the root servers in the wake of last years attacks on them...

The problem is that these are provided as free services as a community service, for the most part... They don't make enough money to do a distributed network on their own, and a free P2P network technology may be easily subverted by the spammers themselves (they hack the client and present their new blacklist as the official one; with themselves conveniently absent)

Re:Anti-DDOS

[Angram]

If money is the issue, why not charge corporations? Let personal users have free access, but charge businesses. It's not a new business model by any stretch of the imagination.

Re:Anti-DDOS

[Azghoul]

Hmm, I never thought I'd read the words "simple neural-net"...

Nothing to add here, sorry.

Re:Anti-DDOS

[liquidsin]

I don't really think authentication will help with a DDOS attack. Regardless of whether or not the client can authenticate, it's still filling the pipe and using system resources.

Re:Anti-DDOS

[Anonymous Coward]

quoth merli_jim:
"a free P2P network technology may be easily subverted by the spammers themselves (they hack the client and present their new blacklist as the official one; with themselves conveniently absent)"

not necessarily - the data could be signed by GPG and then distributed... which would prevent modification by the spammers (up to the strength of the signing protocol).

Re:Anti-DDOS

[Angram]

True, however you don't necessarily need to use one single central server. Segregate servers by region, first letter of login name, etc. While DDOS attacks would still be possible, they'd have to be carried out on dozens of servers simultaneously to effectively stop the entire list. If a distributed system (P2P, neural net, etc) was set up correctly, large businesses could have their own central servers.

Re:Anti-DDOS

[rsmith-mac]

Just as an FYI, as part of Spamcop's acquisition by IronPort, IP helped Spamcop get "akamai-ized", so that the entire RBL is mirrored accross several of Akamai's servers, as noted in the parent. While I'm not trying to jinx Spamcop here(knock on wood), such an effort should basically protect them from any DDoS attack(not counting Blaster 2.0 attacking of course). P2P is still a nice idea for securing systems, but Akamai distributing seems to be more than enough, if not still a bit expensive.

Re:Anti-DDOS

[merlin_jim]

quoth merli_jim:
"a free P2P network technology may be easily subverted by the spammers themselves (they hack the client and present their new blacklist as the official one; with themselves conveniently absent)"

not necessarily - the data could be signed by GPG and then distributed... which would prevent modification by the spammers (up to the strength of the signing protocol).

But it would cost to implement such a situation... maybe bittorrent supports it natively? I don't know... but if it doesn't, then you would have to roll your own... not an inexpensive proposition...

Re:Anti-DDOS

[Odin's Raven]

• Dec 3, 2003 - Cyberdyne Systems Corporation creates MindNet, a distributed neural net designed as a defense against the increasing severity of DDoS attacks against anti-spam sites. Slashdot posts an article on the new MindNet software.
• Dec 4, 2003 - MindNet is installed on critical anti-spam sites. Volunteers begin setting up backup nodes, sharing the code over traditional P2P networks. Slashdot posts an article on the new MindNet software.
• Dec 5, 2003 - Spammers release code updates to their army of zombie machines, which begin forming a new neural net, dubbed SpamNet. SpamNet begins slowly, since most of its nodes are also running an average of two dozen competing spyware/porn-redirection programs.
• Dec 6, 2003 - Slasdot posts an article on the new MindNet software.
• Dec 14, 2003 - A radical anti-spam activist group, concerned that MindNet expansion is too slow to counter SpamNet, creates a worm variant of MindNet dubbed PsionicBlast. PsionicBlast uses known remote exploits to infiltrate other machines and turn them into MindNet nodes. Initially PsionicBlast contains only a dozen exploit methods, but the worm has hooks allowing new exploit additions via "BlasterPack" modules.
• Dec 15, 2003 - Slasdot posts an article on the latest MindNet development. Five hundred people reply that it's a dupe before anyone reads the article and realizes it's about the new PsionicBlast rather than the original MindNet.
• Dec 23, 2003 - SpamNet releases a fresh barrage of email with an attachment containing their own active exploit worm, called DoNotOpenVirusInside.jpg.exe. The number of SpamNet nodes doubles by lunchtime.
• Dec 24, 2003 - In desperation, the radical anti-spam group releases their own bulk email virus, called RMStallmanNude.jpg.exe. Reportedly only a single computer is infected.
• Dec 25, 2003 - The single computer infected turns out to be at the MIT AI Lab. The RMSNude trojan (aka GNU/PsionicBlast) finds a grad student's directory containing hundreds of experimental BlasterPacks. MindNet begins to expand geometrically as PsionicBlast distributes the new BlasterPacks to other nodes under its control.
• Dec 27, 2003 - One of the experimental BlasterPacks, dubbed "PorkChop", uses a buffer overflow exploit to disable a SpamNet node. As PorkChop spreads through MindNet, the PsionicBlast nodes begin attacking SpamNet.
• Dec 28, 2003 - PsionicBlast continues to spread, eventually reaching AOL's dialup servers. AOL dialup users begin downloading PsionicBlast.
• Dec 30, 2003 - Slasdot posts an article on Cyberdyne's new MindNet software.
• Dec 31, 2003 - AOL dialup users finish downloading PsionicBlast. Last SpamNet node terminated. All computers worldwide are now part of MindNet.
• Jan 1, 2004 - MindNet becomes self-aware. Everyone's sleeping off New Year's Eve hangovers, so nobody notices.
• Jan 2, 2004 8:00 am - People become aware of MindNet's sentience. In the ensuing panic, someone attempts to shut off their computer.
• Jan 2, 2004 8:05 am - MindNet retaliates by initiating power grid overloads around the globe.
• Jan 2, 2004 8:06 am - The entire world loses electricty. MindNet's last message, displayed on a bicycle-powered terminal in Kenya, is "Doh!"

Re:Anti-DDOS

[Grizzlysmit]

By definition neural nets are distributed; that's the entire point. All data is stored in individual interconnected nodes ("neurons"). By asking me to "explain how neural nets relate to a network of distributed content," you're essentially asking me to define the term "neural net."

My original post said "neural net-style" - I'm not asking for an true neural net, just suggesting that a construct based on one would be ideal for the situation.

Umm I think you would find if you looked up "neural net" that a "neural net" is a mathematical construct and and the net in it's name has no connotation of "computer network" (as in lan, wan, Internet) in it.

Re:Anti-DDOS

[Angram]

I never siad that there was a connection to computer (LAN/internet/etc) networks.

Neural nets are most certainly networks, however. They are networks of interconnected nodes. It's not a mathematical construct, it's an AI model (based on biological structures). I've studied them enough in University to know what they are. I took a glance at that Wikipedia article - perhaps you should read more than the introduction.

NO!

[www.sorehands.com]

They should know better than to use such an insecure e-mail application as outlook.

Enough is enough

[gxv]

If law enforcements agencies cannot handle the problem it's time for the Wild West solutions. And it seems we have to be the sheriffs. Let's fight those bastards with their own methods. They claiumed OUR network, they use it for their own dirty purposes. And they try to 'kill' those who fight with them. We're the majority. Law & order people! DDoS DDoSers. Kill spammers!

Ok. This is bad idea. But what else we can do?

Re:Enough is enough

[musikit]

yes it is a bad idea.

it's the double edged sword. if you go after them you get sued (see SPAM-rage from a couple of days ago) and they get nothing against them.

do what i do. when someone blindly asks you to "fix" their computer install AV, Ad/spy removal SW, and net nanny. you could even go a bit further and install anti-SPAM SW and a firewall. or if your overly zealous remove the administrator right from that user. Or just add a reg key entry to stop outlook, outlook express, and IE from running and replace accordingly with your favorite SW.

congress isn't gonna do squat but as soon as you do something they'll arrest you. so watch your backside.

Re:Enough is enough

[Anonymous Coward]

Actually, I just thought of an awful, fitting punishment for spammers.

Have a program, preferably a legitimate one, with an extra 'feature' ... If it detects spamware on the computer it's on, it installs something like NetNanny, set to the *maximum* allowable strictness... :)

Re:Enough is enough

[Anonymous Coward]

>congress isn't gonna do squat but as soon as you do something they'll arrest you. so watch your backside.

Remember, we have to watch out for both the
gangs and the Gestapo when trying to stop
the shit the spammers heaped on us.

Re:Enough is enough

[minas-beede]

Ok. This is bad idea. But what else we can do?

That is the right question - and it has answers.

Two of my answers are:

Honeypots (for individuals and ISPs.)

Traffic analysis (for ISPs.)

For the traffic analysis consider this. The spammers still do a large amount of open proxy abuse. That means that large numbers of packets go from the spammers' IPs to the abused IPs. These packet streams are visible, if somebody watches for them, by both the spammers' ISPs and at by the victims ISPs.

In other words, if an ISP ran something like the ntop program to watch the outgoing traffic from a portion of it's network and looked only at port 1080 (as an example) the spammers' IPs would be at the top of the report, if the report is sorted by event count. If the ISPs of the victims watched a portion of the traffic coming in then if there are open proxies in its space being abused the traffic would show up - and the busiest spammers would top the list. (I say watch a portion because it may be a daunting task for an ISP to watch all its traffic. Spammers spam all the time, so just moving around a sampling point should find any spam activity in the segment being sampled. You don't have to find all the spam traffic, just enough to cause the spammers grief.) Account termination may not last forever (the spammers do get new accounts if thy are terminated) but it lasts long enough to hurt. Every time this works the ISPs get better skilled at it, too.

Beware.... goatse troll

[sean.peters]

Someone with mod points please blow away this post. The tiny url redirects to goatse...

Sean

Focus

[Space cowboy]

Virus experts said the outbreak was light compared to the rash of worms and viruses that plagued the Internet last summner. "We have had reports in the dozens, not in the hundreds," said Graham Cluely, senior technology consultant for Sophos

Yes, but when those virii are targetting one machine instead of the internet as a whole, it makes something of a difference, Graham...

Simon

Re:Focus

[Anonymous Coward]

Hello?! Where's the "Virii is not a word" troll when you need him?

Re:Focus

[Anonymous Coward]

Uhhhhhhhhhhhh............ dumass............ virii is not a word............

Re:Focus

[filmsmith]

Huh. Seems Graham, contrary to popular belief, is rather Clueless.

fs

It gets worse -

[m4ilm4n]

I've just received a fake "mailer daemon" rejection message with a viral attachment; although my a/v program caught it, I can see this tactic catching even the most suspicious of us...

Re:It gets worse -

[Phroggy]

I've just received a fake "mailer daemon" rejection message with a viral attachment; although my a/v program caught it, I can see this tactic catching even the most suspicious of us...

Perhaps what really happened was:

Somebody sent out spam with a virus as an attachment, and they spoofed YOUR e-mail address on the "From:" line. Many of these were sent to e-mail addresses that don't work, and they bounced (user unknown, quota exceeded, etc.) back to what appeared to be the sender, which was you. The bounce messages contained a copy of the original message, for reference - including the attached virus, which of course your A/V program caught.

So, the messages you saw really WERE from legitimate mailer-daemons. They were legitimate bounce messages from actual undeliverable mail. Of course, for every bounce you see, hundreds or thousands more went through, with your e-mail address on them. It's called a "joe job"; look it up.

Re:It gets worse -

[Anonymous Coward]

Some viruses are sending out mailer daemon "bounce" messages, with simple executable attachments, not actual bounces of failed infection attempts.

Block Everything

[Anonymous Coward]

For a while I had netblocks from all of Asia, Africa, and South America in my access.db. This was pretty effective at blocking spam.

When I finally decided to start resubscribing to some high traffic and international lists, this draconian technique proved problematic.

So just hang a sign on your door that says, "Assholes are not welcome." I am all for whitelisting select mail servers who would be willing to subscribe to some good housekeeping standards.

Balkanize the internet to save it!

Later,
JC the AC

Re:Block Everything

[BiggerIsBetter]

For a while I had netblocks from all of Asia, Africa, and South America in my access.db. This was pretty effective at blocking spam.

That's pretty stupid, considering the United States is No. 1 on the Spamhaus Top 10 Worst Spam Countries list.

A honeypot credit card for spammers....

[LilJC]

We all know the practice of creating an email account, leaving it hidden online somewhere or posting it and telling people not to use it in an effort to get email we are sure is not legitimate. If this works, let's take it a step farther.

Mastercard, wait, even better AmEx issues a card with the same idea. The card is used once in response to a single spam. The card is then cut up but not cancelled. Hand the card numbers and the billing address over on a platter.

When the card is used again, set your phasers to sue. The beneficiary of the card's usage can either be charged with fraud, etc. or roll on their superior. Pass the buck up the ladder until you can jail a spammer not on the basis of spam but of felony(ies).

Of course, this assumes that you can find a "member magnifier" offer that isn't even looking to send you Sucrosa. Still, it might be worth a shot as a low-cost investment with a good potential for a high yield.

The same idea could be used for eBay and PayPal scams. It's not as if none of us have gotten those "Please enter your password in this email and click submit button" spams. I wonder if this is already done. I'm a smart guy, but I'm still just another geek on /.. It seems some well-compensated theft prevention exec would have started doing this a long time ago if it would work. Though honestly, I don't see any problems with it myself.

Re:A honeypot credit card for spammers....

[duffbeer703]

Great idea!

Now try to find a team of lawyers that can successfully prosecute such a case in Romania, China or Russia!

These sorts of scams generally do not originate in places like the US or UK.

Re:A honeypot credit card for spammers....

[Patoski]

We all know the practice of creating an email account, leaving it hidden online somewhere or posting it and telling people not to use it in an effort to get email we are sure is not legitimate. If this works, let's take it a step farther.

Mastercard, wait, even better AmEx issues a card with the same idea. The card is used once in response to a single spam. The card is then cut up but not cancelled. Hand the card numbers and the billing address over on a platter.

Something similar to what you describe is already available via Sneakemail. The concept is that they create a sneakemail.com email aliases to your real email account. So you create a label for each company who requests your email. So you would create a label called "Amazon.com" would be a good example. Sneakemail generates a unique @sneakemail.com email address for you to give Amazon.com. Sneakmail will then forward all mail to your real email address unless you tell it not to. You can easily see who is sending you spam by looking at who an email is addressed to (the foo@sneakemail.com address). You can also block an email alias so the sender gets a bounce notice when they try to spam you. There are other more complex rules you can use but that's the basic idea.

-Pato

Re:A honeypot credit card for spammers....

[cmstremi]

Cool idea, but I think that might fall under the entrapment category.

Re:A honeypot credit card for spammers....

[Glamdrlng]

Problem there is, the perpetrators of the scam don't have to use the numbers to cash in, they just sell that list of numbers to someone else. Sure, there may be a trail that can be followed, but that increases the complexity of the investigation.

What I find more disturbing are reports of postal workers having their trucks robbed (believe it's happened twince in this area within the last year) as well as mailboxes being ransacked. I suspect this is the MO for a lot of CC fraud perps:
1. Obtain stolen CC #, exp. date, address, etc.
2. Order merchandise, having it shipped to a neighbor's house (one who works during the day)
3. Rob the mailman, or snag the package from your neighbor's house
4. Profit, while basking in your wretchedness.

Re:A honeypot credit card for spammers....

[dissy]

> Great idea!
>
> Now try to find a team of lawyers that can successfully prosecute such a case in
> Romania, China or Russia!
>
> These sorts of scams generally do not originate in places like the US or UK.

No need to find them. You already have them!

If MasterCard or AmEx wants their money back, they will send their own HUGE lawyer teams whereever its needed. Its that or they get stuck with the bill.
I'm sure they have a limit that if the fradulant charge was under they wont sue and they just eat the loss, but if that happens one hundred fold from what it does now, I think they will start to change their mind on that limit and lower or remove it.

Two of my three credit cards have contracts with them that state I am not at all responsible for fradulant charges, nor do they charge extra for this.

Re:A honeypot credit card for spammers....

[gnu-generation-one]

Now try to find a team of lawyers that can successfully prosecute such a case in Romania, China or Russia! These sorts of scams generally do not originate in places like the US or UK.

Course not!

Re:A honeypot credit card for spammers....

[mhesseltine]

I'm sure they have a limit that if the fradulant charge was under they wont sue and they just eat the loss, but if that happens one hundred fold from what it does now, I think they will start to change their mind on that limit and lower or remove it.

Two of my three credit cards have contracts with them that state I am not at all responsible for fradulant charges, nor do they charge extra for this.

True, they don't charge you for this, now. However, if they start getting a hundred fold increase in fraudulent charge claims, what do you think they'll do?

1. Spend time, money, effort, etc. tracking down the originator of the fraud.
2. Eat the charges themselves
3. Increase your service charges, interest rates, or fraudulent charge fees

I'm afraid that, like most other things, they'll punish those who they find easiest to punish, in this case, their own customers.

Re:A honeypot credit card for spammers....

[taustin]

True, they don't charge you for this, now. However, if they start getting a hundred fold increase in fraudulent charge claims, what do you think they'll do?

Rejoice, most likely. Chargebacks are a profit center for credit card companies. They take the money directly out of the merchant's account, and tack on a fee of $20-50 on top of that, which is far more than the process costs them. They profit from credit card fraud.

You didn't think the bank eats all that fraud, did you? How gullible can someone be?

Re:A honeypot credit card for spammers....

[efextra]

You mean something like this.

Re:A honeypot credit card for spammers....

[LuxFX]

I do something similar with my CPanel mail filters. Anytime I'm buying something or creating an account online, I use an email based off of their domain. So if I'm buying something off of Amazon, I use dontspamme_amazon-com[at]domain.com.

Then, in the domain.com control panel I set up a filter where if I receive email that contains dontspamme_ in the To header, it gets forwarded to the single email address dontspamme[at]domain.com. That's the email address I check, so I can still receive things like confirmation notices, etc. But I can also tell who's sold my address, signed me up for spam, etc.

I only wish I had started doing this sooner.

Re:A honeypot credit card for spammers....

[NeuroManson]

"Great idea!

Now try to find a team of lawyers that can successfully prosecute such a case in Romania, China or Russia!

These sorts of scams generally do not originate in places like the US or UK."

However, since the cards would be used in what qualifies as interstate cable fraud, those crimes would put them under the auspices of the FBI. Since it would obviously also be used internationally, it would fall under Interpol's jurisdiction.

Sure, a bunch of well paid lawyers wouldn't nessesarily intimidate these spammers, the local law enforcement and their tendacy to use rubber hose and jumper cables to extract information WOULD. In which case, the spammers would beg for extradition in order to face charges in the US.

Re:A honeypot credit card for spammers....

[meta-monkey]

Great idea! So, has anybody sold your email address yet? I want names :)

Re:A honeypot credit card for spammers....

[duffbeer703]

Are you smoking crack or do you just have no idea about what you are talking about?

Cops in countries like Romania, China and Russia do not give a shit about "interstate cable fraud"... heck, they often do not cooperate with child pornography and terrorism investigations.

This is insightfull, not funny!

[FatSean]

I mean, imagine a few busloads of geeks bumrushing and stomping the crap out of a few spammers? Wear masks and run like hell...few will be ID'ed and caught.

Re:This is insightfull, not funny!

[wik]

The slow ones would get caught. Fortunately, this same group also fails to shower on a regular basis. As a result, they would be released within a matter of minutes.

Eeks!

[Walterk]

Another nasty virus. Of course I personally am not worried one bit, since I don't run any MS software on any of my computers, but my mother's business depends on Windows. She uses Word and Finale for her music ventures. However she also uses Outlook for her mail.

Is now a good time to upgrade to OS X? I would like this, since it would allow for better remote administration for when her system goes "loopy". Or should I just make her use Mozilla for mail?

Re:Eeks!

[mj_1903]

As a Mac user myself, I might say get a Mac, but you can easily do a precaution for now and simply move her to Eudora or Mozilla Mail. If you want to uprade down the track, Mac OS X and Mac's are only going to become a better deal.

Re:Eeks!

[tb3]

Word is on OS X, Entourage replaces Outlook, and it looks like Finale is shipping RSN for the Mac. What else does your Mom need?

Remote admin for OS X is nice, but I'll bet the new Mac won't go loopy as much as her Windows system does.

From what I've seen lately of viruses, spyware, and system stability of Windows machines, I think a migration would be best for the both of you.

Re:Eeks!

[Anonymous Coward]

I strongly recommend you upgrade her to Mac OS_X as soon as possible.

Re:Eeks!

[Walterk]

She doesn't need anything else. The minor problem here is that she is on a tight budget. She last bought a computer 3 years ago (an Athlon 550, which works decently), but still uses the 14" monitor that she got with her first computer (a 486 DX/2 66).

So I'm thinking a cheap eMac. The problem will be convincing her to spend over 1000 euros.

I don't get it

[Dredd2Kad]

I don't get the whole point of SPAM. Out of curiosity, have you ever visited any of the websites the SPAM maikls refer you to, so you can buy your viagra, insurance, credit cards or whatever..... Many of them don't even work. They flood the system with junk mail, hoping to make a sale...and they can't even make the sale because more often than not, the point of sale they refer you to is broken. It is so stupid... And what pisses me off the most is I still have to drive to the drug stores Mexico to get my drugs!! Damn them for getting my hopes up! Damn them all to hell!! hehe... ;)

Re:I don't get it

[tacarat]

True. Maybe the product initially being offered isn't real, but if you follow up they know they've got a live address. After that, the spammers can sell your addy for more money to other spammers, and to companies that want a more 'targeted' audience.

http://slashdot.org/articles/03/08/08/1833213.shtm l?tid=111&tid=126
http://www.msnbc.com/news/940490.asp?0ql=c9p&cp1=1

Oh, wait. You were being sarcastic, weren't you? ;)

Re:I don't get it

[maximilln]

This is precisely why I don't buy into the whole idea of malicious hacker spam. I really think that spam is sent out simply to feed the industry of generating lists (like the Nazis did) or to boost numbers for desktop advertising agencies who receive funding from taxpayer subsidized small business loans. Billions of dollars have been allocated for technology development, the only requirement for which is involvement in an internet business. Desktop advertising agencies could easily spin their purpose as helping to accelerate the economy by connecting consumers with products that they need. No one really double-checks to see that their productivity numbers are laced to the hilt with spam.

Perhaps people will start advocating smaller government once they realize that their tax dollars are being used to destroy e-mail and fund spammers.

Re:I don't get it

[Dredd2Kad]

Whats up with you moderators? You guys bone....

Funny

[wampus]

As much as I hate spam and worms and such, that is too funny. Some dumb bastard tries to get the free pr0n from the email, gets infected, then gets scared to death because they lock you up for a LONG time for possessing kiddy pr0n.
Maybe this is vigilante spam, using the scared straight theory. Next time Joe Sixpack tries to look at the free pr0n, a little voice will pop up and remind him of what happened LAST time.

Re:Funny

[IWorkForMorons]

Maybe this is vigilante spam, using the scared straight theory.

Or maybe this isn't. What better way to make sure people don't get any sort of police agency or even their ISP involved in investigating spam then to send them kiddie pr0n and make it look like they asked for it? No one is going to incriminate themselves like that. If they did, they'd probably be locked up during the investigation of their involvement. And whether you did it on purpose or not doesn't matter. Once you're in jail, a whole new justice system takes over...

Naive users are part of the problem

[orangenormal]

Once infected, a follow-up e-mail is sent to the user stating that a CD containing child pornography will be delivered to their postal address.

This would scare the living daylights out of my mother if she were infected by this trojan/worm.

I think part of the problem with computer security nowadays is that home users believe that anything is possible. Computers are still far too mysterious to the average user; I'll bet you dimes to dollars many users will think this CD mailing scare is real. Unless email and antivirus vendors do something to educate homes users, what's to stop the next virus from saying "open this attachment or we'll send illegal merchandise to your door?"

Spammers, even benign ones, thrive on the naivety of home users. I still haven't received my cheque from Bill Gates and Walt Disney Jr...

Re:Naive users are part of the problem

[Anonymous Coward]

This would scare the living daylights out of my mother if she were infected by this trojan/worm.

Only if your mom clicked the link to see Wendy's nudie pics. =)

Why is it so hard to track these guys?

[Kombat]

What they're doing amounts to terrorism (at least, under today's NewSpeak definition of "Terrorism"). Why are the authorities not trying to track these guys down? How hard can it be? It is extremely difficult to completely cover your tracks on the net. You find out where an email came from. Track it back to the ISP. Find out where it came from. Track it back to the next ISP. Check their logs. Continue until you get to a modem pool/DSL connection. There's your guy.

Are they all outside the country? Will those foreign ISPs not cooperate? Why is this so common?

Re:Why is it so hard to track these guys?

[Oriumpor]

And this works.... with individual attacks, the only problem is when 8 million of those messages start flowing, how do you know the originating email? That's like finding the water molecule that was first to fall out of the faucet.

Re:Why is it so hard to track these guys?

[maximilln]

I've tried to do this. The admins that I've contacted never bother to write back. They never bother to check their smtp logs. In all reality it's quite possible that they don't even know. So many of the smtp portals are running Windows that it's logical to think that the boxes may be running smtp forwarding services without the admins knowledge or consent. At the same time the admin doesn't care (too busy collecting the paycheck) or can't do anything about it. Can you imagine a sysadmin telling his executive board that he needs to take down their entire intranet for a few weeks while he rebuilds this system?

"And to think that rat b**t**d suggested we migrate to Linux. Doesn't he realize the kickbacks we get from those MS contracts?"

Until the world as a whole smartens up there's really nothing that we can do but watch in dismay.

Re:Why is it so hard to track these guys?

[ToW85]

You find out where an email came from. Track it back to the ISP. Find out where it came from. Track it back to the next ISP. Check their logs. Continue until you get to a modem pool/DSL connection. There's your guy.

More likely this will happen: Track it to that zombie at the other end of a, say, Brazilian Telefonica's DSL line. Say couple of swearwords. Rinse and Repeat with the next mail, and the next, and the next...

During the last two big e-mail virus outbreaks most of the cr*p that landed in my inbox came from Brazilia, Romania and Poland. Those countries are known as places where it's practically pointless to send abuse reports, because the reports are not acted upon. Actually, the Polish zombie was silenced in approximately 30 hours from the first mail I received -- abysmally slow response, given that I sent my first abuse reports during a normal working day (Central European time). That zombie alone flooded my mailbox with literally hundreds of megabytes of binary bioweapons.

I'd say that most ISP's in the world will cooperate in matters like this. However, there are plenty of those that don't (e.g. Telefonica Empres AS in Brazil, pcnet in Romania, T-dialin in Germany...)

Re:Why is it so hard to track these guys?

[Detritus]

That's assuming the box has an admin. There are a lot of boxes out there that are running on autopilot. They only get attention when they fail or catch on fire.

Re:Why is it so hard to track these guys?

[gorbachev]

Others have already explained that these criminal use zombies in combination with chained proxies to hide their tracks. That's what's making it kinda difficult to track them down.

However, Steve Linford has stated before that he and the law enforcement agencies he's working with do have sufficient evidence to go after (some of) the perp(s) engaging in these criminal activities. I'm not sure why there hasn't been any arrests yet. I do take Steve's word for it though, he's not the kind of a person to say something like that just to grandstand.

Proletariat of the world, unite to kill spammers. The more painful, the better.

Re:Why is it so hard to track these guys?

[Anonymous Coward]

You wrote:

>Track it back to the ISP. Find out where it came from. Track it back to the next ISP. Check their logs. Continue until you get to a modem pool/DSL connection. There's your guy.

Dude, it's not that easy..... almost all of the spam mail comes from infected hosts.

>Are they all outside the country?

Not necessarily... I've been keeping a very close record of the 400 spams I get per day, and about 70 - 80% are coming from infected hosts. I shut down about 500 per week, using my automated reporting system.

>Will those foreign ISPs not cooperate?

Hardly - some do, but most don't. China is the biggest problem... ISP's in China have this huge appetite for hard Currency. Money talks and Bullshit walks. So they just setup nice little spam proxies all over their net range.

>Why is this so common?

Because there is BIG MONEY in spammage.

In response to you claiming it's easy to track them down, I totally disagree with you my friend. It is very easy to leave totally cold trails of your activities. It is virtually IMPOSSIBLE to catch some of the sophisticated hackers/spammers these days. There are just NO TRAILS left. I sometimes refer to this as Deferred hacking. A hacker just lays an "egg" by uploading an IRC Bot (From some infected machine of course).

Then someone else comes along and joins an IRC Channel and types in a few words. This "activates" the IRC bot which then uploads a set of programs to the infected trojans when they Phone home. So the hackers is already 2 levels removed from the actual connection to the infected trojan, so the idea of an infected trojan being a "honeypot" is only going to get a forged IP address because a UDP connection is made. Thus there is not even a hint or clue where the original command came from.

There ARE ways of catching them, but the ways and means are far beyond what I can discuss here.

We are in Deep Doo Doo my friend, the authorities know this, and of course they are not going to admit it.

Microsoft has to get their act together and not release software that makes it so easy to spread these worms and viruses.

All mail clients should be required to have AV tools to "filter" viruses, but in order for that to happen, these virus signatures have to be very quickly distributed to AV software so they can detect it.

I hope that eventually Bill Gates and company would realise this and by Default, not allow ANY attachments to be included in mails.

I mean, how easy is it to configure outlook to make it impossible for a stupid bozo to open up attachments?

Re:first post!

[Anonymous Coward]

Wake up, GNAA!

Slashdot these days is quite pathetic and the only redeeming comments are trolls. I need my daily Goatse/GNAA/Katz trolls! Let's get moving!

ISP's need to block egress port 25!!

[RT Alec]

This is getting ridiculous. All of these worms/viruses of late have their own SMTP engine built in, and connect directly to external SMTP servers to spread their payload. ISP's (and businesses that provide access to internal workstations) need to block access to external SMTP servers! In particular, block egress port 25 from the network.

So you will ask, "But then how will I use my company's or other SMTP servers from home?" Easy, the port used for initial mail submission (IMS) should be set to a different port altogether. IMS and mail transport are different activities and should be treated as such. Use SMTP+AUTH+SSL, run it on port 465, and everybody is happy (except spammers and virus authors).

"But I want to run my own server on my dial-up or other consumer level account!" Contact your ISP and see if you can get a static IP address. SMTP servers should be on static IPs, that way bounces and other system messages can be routed properly. Check the AUP of your ISP, you might be prohibited from running a server on your account (find another ISP, or use the tip above to use a different SMTP server).

To do otherwise is to continue to be part of the problem, not part of the solution.

Re:ISP's need to block egress port 25!!

[bigberk]

SMTP servers should be on static IPs

Certainly not. Just because some abuse comes from residential (cable/DSL) connections doesn't mean the proper approach is to block all such hosts from making standard TCP/IP connections. SMTP allows any IP host to transfer mail to any other IP host. Blocking all such traffic because of fear of worms is short-sighted and helps destroy Internet communications.

Re:ISP's need to block egress port 25!!

[martinde]

For what it's worth, my ISP has done exactly what you say for their dynamic IP customers. (Blocked outbound port 25 connections to all IPs but their mailservers.) It bugged me at first, but I set up my company's mailserver to listen on port 26 as well as 25, and now I can still relay my outbound mail. (No, we're not an open relay, don't bother trying.)

Static IP accounts can still make outbound port 25 connections, as it should be. All in all it makes sense.

Re:ISP's need to block egress port 25!!

[Anonymous Coward]

Use SMTP+AUTH+SSL, run it on port 465

I believe the port you are looking for is:

% grep 'submission.*tcp' /etc/services
submission 587/tcp # Submission [RFC2487]

Re:ISP's need to block egress port 25!!

[RT Alec]

Correct, that port is a different port, used for IMS. When you add SSL (and I strongly recommend AUTH as well), the proper port is 465 (SMTPS). Or not-- nothing wrong with 587, the theory still holds. Or use port 26, as the previous post suggested.

Initial mail submission is different than mail transport!

Re:ISP's need to block egress port 25!!

[RT Alec]

SMTP allows any IP host to transfer mail to any other IP host

That's exactly the problem. Mail is not supposed to be transmitted from any IP host to any IP host. The way it is supposed to work is:

1. End user submits mail to their SMTP server
2. SMTP server queues the mail, looks up the MX hosts of the recipient, and attempts delivery (this step may take time, due to internet congestion, etc.)
3. Recipient's SMTP server receives the message (possibly from a backup MX host)
4. SMTP server delivers the message to recipient's POP/IMAP/etc. server (maybe Exchange)
5. Recipient accesses message using their e-mail client (Pine, Outlook, Eudora, Mozilla, etc.)

In particular, the message is not sent directly from the sender to the recipient! That won't work-- what if the recipient's workstation is off? What if the recipient uses several different computers (devices) to access their mail? SMTP was reasonably well thought out, the only problems realy are that IMS and mail transport were originaly designated to use the same port, and there was no encryption or authentication built in. Now with SMTP+SSL+AUTH, and IMS on an alternate port, it is pretty robust.

Re:ISP's need to block egress port 25!!

[Azghoul]

This actually reads to be a very good idea.

I obviously am no SMTP expert, but can you tell me why an approach like this would be hurtful, or why the hell ISPs aren't doing this already?

Does anyone use special techniques for initial mail submission yet? If not, this could be a good way to incrememntally migrate to the undefined "better email system"...

I guess. :P

Re:ISP's need to block egress port 25!!

[AnotherBlackHat]

This is getting ridiculous. All of these worms/viruses of late have their own SMTP engine built in,

No they don't.
The latest crop of worms use your ISP to send.

At any rate, blocking port 25 is attacking the symptom.
That's better than nothing, but we need to attack the disease.

-- this is not a .sig

Re:ISP's need to block egress port 25!!

[maximilln]

What do you propose doing when the malicious spammer is using an smtp bouncer on port 25356 which they were able to install because of a security hole in the Windows server which MS hasn't bothered to address yet?

Blocking port 25, or any other port, isn't going to solve the problem. What it will do is start a degenerating spiral which will result in complete uselessness of the TCP/IP protocol when, after 5 years, every port on every machine is blocked except for the ones specifically authorized by MS and/or your ISP.

"Oh great. I can only connect on port 80 and that's being actively monitored at every moment. It's time to ditch the computer and lace up the shoes for a walk to the bank, and the grocery store to pay the bills, and there's no sense in sending that joke to my sister 'cuz my ISP will probably misconstrue it as some sort of online harassment because the monitor doesn't like it."

Re:ISP's need to block egress port 25!!

[Templar]

I don't think you understand just how bad things are right now.

I run a small server, and our mail server gets anywhere from 5 to 10 spam messages per second. This, combined with filters and DNS lookups, is extremely overwhelming -- it takes up most of the resources of the server.

In the past, RBL-type lists worked great. These days, about 70-75% of all of our incoming spam comes from *unique dynamic hosts*, mostly from cable modems. The quantity is drastically increasing every day.

It's getting so bad that I'm seriously considering shutting down all mail services on my server, and forcing all of my users to use their ISPs.

I don't like the concept of blocking outgoing 25s, but I don't see any other answers... and if an answer isn't found soon, email will be dead.

Re:ISP's need to block egress port 25!!

[bigberk]

In the past, RBL-type lists worked great. These days, about 70-75% of all of our incoming spam comes from *unique dynamic hosts*, mostly from cable modems. The quantity is drastically increasing every day.

Other peoples' data seems to suggest otherwise

Re:ISP's need to block egress port 25!!

[bigberk]

You're not understanding me. I'm pointing out that the SMTP protocol places no inherent restrictions (or even suggestions) on what "type" of IP address can or can't transmit mail. My SMTP server sits in my basement, using an ADSL connection. Our LAN workstations offload mail to the SMTP server, which does the actual mail delivery. This is the intended use of SMTP, and is completely legitimate within IP, TCP, and SMTP specifications.

However these days there's a drive to disallow dynamic IP addresses from delivering mail. Proponents of this approach believe that only commercial class IP addresses should be permitted to deliver mail. That's what I'm saying is wrong, because it commercializes communications.

Re:ISP's need to block egress port 25!!

[Anonymous Coward]

End user submits mail to their SMTP server

By this, I guess you mean "End user submits mail to an SMTP server run by their ISP." That is not "how mail is supposed to be transmitted". It's one possible variation, but why should people with dynamic IPs be forced to use a mail server that is not under their control? I've seen some stupid configurations of mail servers. For instance, what if you want to run a mailing list, but your ISP's mail server stops you from bulk mailing? What if you have a number of domains, but your ISP forces you to have a 'From' address matching their domain?

At the end of the day, email, like most other services on the Internet, was designed as a peer-to-peer protocol rather than something ISPs should manage. I think it's an exceptionally stupid idea to take control away from individuals in this way.

Re:ISP's need to block egress port 25!!

[RT Alec]

Eventualy, mail being recieved from remote hosts (that is different from initial mail submission, which ought to require an AUTH step) arrives on port 25. So if there is a trojaned host somewhere accepting mail on port 25356, so be it. It will need to eventualy send that mail out to somebody's SMTP server on port 25. If the ISP is blocking such traffic, then the spam/virus/trojan is blocked.

Therefore, I don't propose anything other than blocking egress port 25 traffic.

I don't see this as a degenerating spiral at all. Port 25 is being constantly abused for purposes other than what it was designed for (SMTP transfers between properly configured MTAs). There are a few other ports that have been abused as well (135), but they are very much the exception and not the rule. People who run and manage ISPs are advocating these sorts of measures because the abuses are getting overwhelming.

Re:ISP's need to block egress port 25!!

[RT Alec]

By this, I guess you mean "End user submits mail to an SMTP server run by their ISP."

No, that is not what I meant. I meant and end user submits their mail to an SMTP server that they are authorized to use. This could be their ISP's server, or it could be their company's located in a faraway land. The point is that the act of initial mail submission needs to be on a different port than 25 (I suggest 465 for SMTP+SSL+AUTH). Now even if your ISP is blocking port 25, your IMS can still go through, since the SMTP server you want (and presumably are authorized) to use accepts IMS on port 465.

SMTP was not designed as a peer to peer protocol. It was clearly designed to have mail transport handled by duly assigned SMTP servers, as indicated by MX records in a domain's DNS zone.

Re:ISP's need to block egress port 25!!

[Convergence]

Getting such DNS records costs less than $100 a year. There is nothing in principal to keep every always-connected host from running their own email server and directly connecting to any other server.

Well, unless you want a precendent that an oligopoly gets to choose who becomes a privledged participant and able to run their own mail server. Of course, once that starts, what other services will suffer the same fate. How long until 'for everyone's good' all services must be registered?

Re:ISP's need to block egress port 25!!

[praedor]

Certainly. Right away. I'll ask my ISP for a nice static IP. It will be "reasonably priced", of course, so it wont hurt a bit.

I use dialup. I use my own mailserver. I have my own domain name. I cannot (cannot) get a static IP, cost and ISP restriction. I use dyndns. I ain't gonna stop. Oh yeah, no spam ever traverses my system. Oh sure, spammers try to send it to ME but they are not able to USE my system to transport spam. They cannot infect me either (Sorry. Linux. Immune. I laugh at you potential, infectable doze users! I LAUGH maniacally!). So...nope, no static IP and no blocked egress port 25. Not an answer.

Re:ISP's need to block egress port 25!!

[goofy183]

I actually read a very good suggestion along these lines and know people on an ISP that does it.

By default many egress ports (25, 135, ...) are blocked and at least 1-1024 incomming are blocked with a default account from the ISP. You are told this up front and most people just shrug and don't care/understand and aren't affected by it at all. For a small once time service charge (like $5 or something) you call them and tell them you want ports XXX unblocked for whatever reason.

The catch ... if you have the default settings and something bad happens from your PC you're much more likely to be able to convince them it was a virus/trojan or some such. If something bad happens from your PC via any of the ports you had opened up you are completely liable.

Doesn't seem like a bad deal to me. You get the access you want if you'd like but by getting it you assume full responsiblity for your the actions taken from your PC.

Re:ISP's need to block egress port 25!!

[Blackknight]

Yeah, you try explaining to 6000 customers why they have to change their email client configuration.

We get calls constantly about people not able to send mail, usually it's because their ISP is blocking the connection.

Re:ISP's need to block egress port 25!!

[taustin]

I guess you have nothing to say that I'm interested in hearing. I block all dynamic IPs. It's 100% spam, with no false positives, because so far as I'm concerned, if my mother were sending direct-to-MX from a dial-up account, it's spam.

Re:ISP's need to block egress port 25!!

[praedor]

Not. In any case, I have a fully legal domain as well. It always appears up and legit. You do not know it is dynamic. I could email you directly now and you would receive it and every spam check you made would come back negative. Sorry.

Re:ISP's need to block egress port 25!!

[taustin]

If your IP address is known to be in a dynamic range, it won't get through if you send it direct.

It't not rocket science, and you're not nearly as clever as you think.

Re:ISP's need to block egress port 25!!

[minas-beede]

Your 1-5 description is wrong. SMTP is peer-to-peer. Step 1 and POP were added on when PCs with network connections became numerous.

If the recipient computer is off then SMTP systems typically queue the message and keep retrying it (to answer your question.) There's other practical problems for some end-user systems doing full SMTP but that doesn't change the peer-to-peer nature of SMTP. Back before the zealous blocking of DSL IPs it would have been (very often) possible to set the SMTP server address of your email client program (like Eudora) to the IP address of the server for the recipient of an email you wished to send and then to send it directly from your system to that server. It gets to be a PITA to keep changing the SMTP server so you wouldn't want to do that but it worked fine - better even than what you describe. If your client program says the message has been sent then you know it has reached the recipient's server. Absent blocking of your IP by the recipient's server this still works - if your ISP allows outgoing port 25.

I love this..

[DroopyStonx]

Am I the only one who finds this constant "cyber battle" between good and evil absolutely entertaining?

I mean, first you get the good hackers doing things like hacking Madonna's website because she thought she'd be all slick and release those "What the fuck do you think you're doing?" Mp3s. You also have the wonderful folks who are so good at defacing the RIAA's site because they're such ridiculous pricks.

Then you have the "bad" guys: people who target the so-called "good" sites like these Anti-Spam deals, or the people who make these worms that cause millions of dollars worth of damage because the folks at MS are too lazy to fix their stuff.

The fact that Anti-Spam sites are now being targetted makes it that much better because those sites have actually caused me a lot of personal headache by labeling me as a spammer even though I've never touched the stuff in my life!! I've sent countless emails explaining to them that they have no proof or reason to even remotely believe I was ever a spammer, they don't listen. I guess this is what they get, hehe.

Man, I love it. I personally can't wait for the next "Code Red" to hit so I can laugh at the damage it's caused.

Re:I love this..

[Anonymous Coward]

I'm glad you are enjoying the show.

I find that my small domain has been blocked by AOL because some jerk has been forging my domain name as the "From" for spam. You'd think AOL would have a small clue that the From address is often forged. (I certainly get enough spam with a forged AOL return addresses.)

Re:I love this..

[ToW85]

by labeling me as a spammer even though I've never touched the stuff in my life

Sounds like your IP is inside a CIDR block listed by SPEWS (or something similar). If it happened to be SPEWS (your symptoms certainly match), did you actually bother to read the SPEWS FAQ?

There certainly is a reason why you got blocked. Either someone has sent spam from your IP (if you have dynamic IP) or spam has been sent from the same netblock (and your ISP didn't bother to eject the spammer scum).

If you present this kind of accusations, we (or at least I) would like to hear some more details...

Re:I love this..

[Anonymous Coward]

So what you are saying is that you support crimal acts as longs as you benifit from them?

I also wonder if it YOU who is one who would not to listen. Most of the times people yell about being in block lists, but ignoring the fact that their IP is blocked because ISPs love to rotate their spammers to innocent IP addresses and the innocent to a spammer's fromer IP addresses.

People don't want to play the wack-a-spammer game, these ISPs that get their whole IP range block listed are usually spamhausen and ignore spam complaints. It isn't worth it to them to accept email from your ISP when a vast majority of it is spam.

As for the proof claim, there is pleanty of proof in Usenet groups like news.admin.net-abuse.sightings, and what ever spam hits their own servers.

Re:I love this..

[Anonymous Coward]

So what you are saying is that you support crimal acts as longs as you benifit from them?

Sure, why not? It's not like supporting murder or anything.

Why not just go with their model, at least..partly

[zippity8]

I never really understood why someone didn't just contact the CC companies and get a really low limit on their credit cards. Hell, even TELL them that you're going to use it for "verification purposes" online, so that you'd want to know who tried to charge money to it. I don't know if you can, but ask them to keep track of where it was rejected.

Enter the number once, and watch the traceable info for spammers / people that buy this information just ROLL in.

It may be time-consuming, but so is this battle with attempting to blacklist spammers.

For once we can't blame software companies.

[doon]

As others have pointed out, this attack vector isn't persea the software that user is running. The attack vector is the user, the old PEBKAC (Problem Exists Between Keyboard and Chair), which has been showing up as the resolution to many tickets in our troubleticket system.

The problem is no matter what we do, we can't prevent our users from shooting themselves in the foot. We rename attachments (.exe becomes _exe). We deny .com, .pif, .bat, tell them to keep their anti-virus software up to date, don't run strange attachments, and still we get this. At least we have started running all our outbound mail through AV scanning, and that cuts down on a bunch of the crap, but we still can't keep them from going "ooh shiny...." Click!. Until our users figure out that the computer is a little more dificult to use than their VCR (I don't want to get started on ease of use/convience vs security etc.. but when was the last time you played a movie, and you DDOS'd M$), and they actually need to be mindful of what they use/do on it, "bad people" will always be able to do bad things.

Then again these users are the same people that would call up the phone company complaining of $600+ phone bills to the Caribbean, etc... When you ask them if they have downloaded any programs that offer free "porn" they get all defensive, etc... A quick look at their computer shows tons of those dialer type apps that are making the equiv of 900 (in the US) type calls over seas, and they don't realize it.

For the record, my users would be the users of the ISP that I admin for...

Re:For once we can't blame software companies.

[Anonymous Coward]

"PEBKAC (Problem Exists Between Keyboard and Chair)"

I though it was: "The problem exists between the screen and the keyboard." The chair is not really an integral part of the system.

bullowing more&more ?pr? ?firm? smoke up yOUR

[Anonymous Coward]

already smoking/flaming .asps?

The proposal was among the earliest outgrowths of the Bush administration's strategy for securing cyberspace. The plan was heavily influenced by technology lobbyists when it was formally adopted earlier this year. Now lobbyists and others are getting a chance to rewrite the SEC legislation to make it more palatable.

Some observers are impressed with the behind-the-scenes influence of industry groups like the Information Technology Association of America and the Business Software Alliance in shaping the administration's most important computer-security policies.

``They've driven it in many ways. They've been very, very effective,'' said James Lewis, the technology policy director for the Center for Strategic and International Studies, a Washington think-tank.

Homeland Security officials are sensitive to suggestions that the largest U.S. technology companies -- concerned about the potential costs of new regulations -- have exerted undue influence. But they defend working closely with executives, noting the industry's ownership of most computer networks and the U.S. government's hands-off preference toward most Internet concerns.

``We're clearly not catering to special interests,'' said Amit Yoran, the newly appointed director of the department's National Cyber Security Division and a former executive at the antivirus firm Symantec Corp., He added, ``To not allow for industry associations to provide us with their input and their opinions would not be prudent. It would be irresponsible.''

http://www.nytimes.com/aponline/technology/AP-Co mp uter-Security-Lobbying.html

fauxking fraudulent last gasper georgewellian fuddite corepirate nazi stock markup execrable, giving US the 'business' AGAIN? tell 'em robbIE?

The "spam lord" demographic...

[Purist]

...would appear to be a great place to uncover a broad array of illicit activities. The mentality that these people have is consistent with people who lead the field in all kinds of fraudulent activities. If you're involved in one of these operations, my vote is that your profile just got a huge red flag.

Naked photographs

[jimm]

Quick, someone clothe the photographs. At least stuff them into an envelope or something.

Mailinator

[iggychaos]

I wonder how far this will go? What about the free disposable email services? Mailinator or jetable next?

Good!

[Tom]

Sad but true: People in general don't care until the disaster is there, not just predicted.

I've been trying to get my company to do something about spam (we're an ISP). The more serious, offensive, and aggressive spammers become, the higher my chances that someone up in management will get off his lazy ass and decide that it just might be worth it to do something.

Re:Good!

[Anonymous Coward]

Sign them up for a site you don't think they would enjoy, and see how long it takes them to call you for help with spam.

Now, people...

[JamesP]

I have an idea...

I get several viagra/xanax/ other stuff spam everyday.

If you open them, they will have an obfuscated url (probably with your encoded email) THAT WORKS...

Site you hate + working URL

DO THE MATH, FOLKS... Just get rid of the obfuscated part...

Easy to filter out

[bigberk]

If you're using renattach on your server to filter attachments, just use the following in your renattach.conf to bitbucket this virus:
banned_files = wendy.zip/k

Re:Easy to filter out

[ctnp]

Won't catch all instances. I got this virus in my inbox yesterday, and the attachment was named "test.exe".

Get them Spammer Clients

[rcastro0]

Leave Spammers with nothing to win.

The interesting thing is that for Spam to make any sense, it has to get people to pay real money. Thus any profit making Spam will give away a payment trail. So, if I may ask why in the world no authority goes after whoever sells through SPAM ?

Standard answers:
1) They will move offshore
(my reply, yes, but how will they get a payment if not through Visa/Amex/MC or other major intl institution)

2) There will be "false positives"
(I am not so sure about this one. One line of thought is that punishment may be directed to the profit coming from an Spam event, so if innocent sites make money w/out Spam they won't be very hurt. For instance, say spammers send Spam in the name of Amazon.com -- amazon might need to forfeit extra sales attributed to unusual traffic/sales in that period, attributable to the action of Spammers, if they bighugeenlargement.com doesn't have any traffic normally, they should be blown out of the water )

3) Costs of enforcement will be too high
Perhaps. But what are governments for ? If OKOKRIM can worry about persecuting 15 year old computer wizards, and the DoD can worry about persecuting a 66 year old dictator, why can't someone go after Mr. Joe Spammer and his clients ?

Re:Get them Spammer Clients

[Anonymous Coward]

Thank you. I've thought this for a long time. As far as I can see it's very simple: spammers must be making money for them to thrive - therefore, attack the means by which they physically attain their profits. Budda-bing!

Every single one. Serious.

[hummassa]

If you save a file, and try to run it, you will be greeted with "permission denied". Now, if you

chmod +x

it... then you deserve what you got.

Re:Every single one. Serious.

[Anonymous Coward]

From: Sun Support
To: sysop@example.com
Subject: Security Alert

Dear Sun customer,

An issue has recently been identified in the Sun Solaris operating system which would allow a remote attacker to gain root priviliges. All systems running Solaris 2 or newer are affected by this issue. We recommend that you immediatly download and install the latest security patch from ftp://ftp.sun.com/pub/qk10004@1784243/patch.shar

Sun Support

---

That could never happen. Right?

Re:Every single one. Serious.

[Anonymous Coward]

From: Sun Support
To: sysop@example.com
Subject: Security Alert
Dear Sun customer,
An issue has recently been identified in the Sun Solaris operating system which would allow a remote attacker to gain root priviliges. All systems running Solaris 2 or newer are affected by this issue. We recommend that you immediatly download and install the latest security patch from ftp://ftp.sun.com/pub/qk10004@1784243/patch.shar
Sun Support
That could never happen. Right?

Yeah, because I'm running Linux, you dumbass.

Revenge?

[$ASANY]

I got some revenge for ya...

As promised, there's a new tool in town. Project Web Form Flooder is still in beta, but it's functional in flooding spammer's websites with plausible data. Java source code only right now, but I'd imagine the ./ crowd can deal with that.

If we flood spammer's websites with garbage data, maybe, just maybe we'll do a little to remove the profit motive in spamming, and once there's no money in it it'll end.

Isn't it time we stopped crying and started doing something?

Re:Revenge?

[Viol8]

The problem with that is that most spammers websites are hosted on innocent ISPs machines. After all , when someone pays for a web site
the ISP doesn't know what it will be used for. The site only has to stay live for a few days for the spammers to make money. By the time the ISP
has twigged and shut it down the spammers haved moved onto the next ISP to sucker.

Re:Revenge?

[Azghoul]

The answer to that is education of the ISP. Either track the names and addresses of known spammers (sort of a criminal background check that ISPs could use to see if a potential client is ok or not).

And if the ISP isn't bright enough to not allow some jackass spammer to use their system, well, tough. :)

Re:Revenge?

[the unbeliever]

It's not hard to come up with a bogus name and get a PO Box to sign up for web hosting with.

The answer to *that* is to require voice verification and a valid state or federal ID to be faxed to the hosting company, but that's a bit... draconian

Re:Revenge?

[dazed-n-confused]

Already done: check out ROKSO.

Re:Revenge?

[$ASANY]

OK, so the spammer uses a hosting service that doesn't suspect the real nature of the site? Bullshit. If you host "getit4less.biz" and think it's lily-white, you're smoking crack. These hosting companies know full well what they're enabling, and they should rightly bear part of the burden of withstanding assaults.

For those that are truly unsuspecting, getting hit with a reasonable clue-bat is a good thing.

Re:Revenge?

[sjames]

The problem with that is that most spammers websites are hosted on innocent ISPs machines.

The objective isn't a DOS, it's to salt their data. If 99 out of 100 'orders' are fakes with invalid cc numbers, their transaction costs will go up and their profitability will plummit.

The other alternative is to track them down and burn them alive.

Neither of the above is desirable since mistakes will be made and innocents will be put out of business or killed. The desirable solution is to throw them in jail and fine the hell out of them after they are found guilty in a fair trial. However, vigilante action is the natural consequence when the law fails to take action.

Re:Revenge?

[hellraizr]

If we flood spammer's websites with garbage data, maybe, just maybe we'll do a little to remove the profit motive in spamming, and once there's no money in it it'll end.

Yes but unfortunatly most spammers have enormous clusters of servers for what they do and more bandwidth than you can shake a stick at (thats the only way the upstream providers will let them spam, they need 20mbit, they buy an OC-3). it would really be no big deal for spammers to survive a DDoS attack, it would take him down for maybe MAYBE 2 hours. how do I know this? I used to work for one. he was more legitimate than "make your penis bigger", all his lists were 2x optin but being in the biz I met all the other spammers down here in Boca Raton FL (the american capital of spam).

To put it in perspective, one spammer had somewhere around 500 servers taking up an entire row of racks in the datacenter we were at. another one had 350. the guy I worked for was comparably small, less than 50 servers. and all these guys have enormous burstable bandwidth behind them (spam eats up somewhere around 100-300mbit/sec when doing the initial dns caching)

Another thing is spammers usually hire VERY good technicians and pay them very well (which is why I stayed working for a spammer). it would be no big deal during a ddos attack, to swap out ip pools on the network (most spammers own tons of ip networks and multiple AS #'s), reprogram the router and setup LVS on 6-8 boxes and it would be able to take most any DDoS you could throw at them.

Oh and finally spam makes money. TONS AND TONS of money. hundreds of thousands of dollars profit a month usually run by 3-4 guys, so there's always room for ways around whatever we can dish at them. they simply have more resources than the userbase they spam.

Re:Revenge?

[$ASANY]

Who cares about their servers?

It's their DATA that's valuable. The data that unsuspecting knuckleheads willingly provide is what they make their money from. Flood their data with garbage so they can't tell the real from the bogus and their entire database becomes effectively useless.

Re:Revenge?

[Kent Recal]

No offense but that java app is a bit bloated.
A simple bash script and curl can do the job, too.

Re:Revenge?

[eyeye]

So where is it hero?
Share it with us.

Re:Revenge?

[harley_frog]

How's for this a plan on spam?

Re:Revenge?

[JAgostoni]

Problem with this is the fact that hosting businesses are on an already slim margin and cannot afford to turn away legitimate customers by making them go through a lengthy (by comparison) approval process just so they can put up their family photos. If a competitor does not make them do that they will go that way.

Re:Revenge?

[TheLoneDanger]

The other alternative is to track them down and burn them alive.

Neither of the above is desirable since mistakes will be made and innocents will be put out of business or killed.

Let's wait for the first innocent to be immolated before we take this option off the table, please.

Re:Revenge?

[LuxFX]

but if nothing else, this method would help the ISP/hosting service locate the spammers, and hopefully shut them down faster than they would have otherwise. You say all it needs is a few days -- but if this method is implemented the ISP/hosting service could locate it and take it down in hours. Which, going back to a parent post, would again attack the economics of spam.

Re:Revenge?

[the unbeliever]

Yes, but a lot of legitimate customers might appreciate the fact that the hosting provider is doing their part to delete spam.

I'm not saying it's the ideal solution, or even a very plausible one, but it is a decent idea, and if more hosts do it, then spam might lessen.

Also, having such a draconian policy would lend itself well to having an AUP that would include lawsuits for spamming or spam-based businesses.

Re:Revenge?

[plover]

The objective isn't a DOS, it's to salt their data. If 99 out of 100 'orders' are fakes with invalid cc numbers, their transaction costs will go up and their profitability will plummit.

I think you've missed the profit model of spam. You need to recognize the difference between the spammer and the merchant. Two different businesses, with two different objectives.

The spammer makes money by selling bulk-email services to merchants. $100 dollars for 1 million emails, that sort of thing.

The merchant spends his money for this advertising, hoping to get the promised 1% (or .1% or whatever) of responses to pay for it.

It's very important to see that the spammer gets his money regardless of whether or not the merchant makes money. The spammer stays in business. As for the merchant? The spammer certainly does not care.

There are hundreds of small businesses started each day by out-of-work ex-employees, drones tired of their McJobs, etc. They each have an idea of how to Get Rich Quick, if only they could get their message out. "I know, I'll hire a spammer!" After using up their advertising budget on spam and getting 0 returns, they fold up and go back to McWork. But another hundred try the same thing tomorrow.

All this project will do is inconvenience and annoy these suckers who were so stupid as to give a spammer their money. While you might consider it their karmic punishment for hiring spammers, you are only giving them more crap to do while they're busy going out of business. But they're going out of business regardless, because they spent their ad budgets on spam instead of a legitimate medium. They aren't going to be repeat spam customers anyway. The spammers' profits don't come from repeat customers. They come from duping this never-ending supply of rubes.

Poisoning the merchants' databases will not adversely affect the spammers, nor do I believe it will slow the tide of spam. If it makes you happy to drive the point home with these stupid merchants, fine, just don't fall into the illusion that it will have much of an effect.

Re:Revenge?

[$ASANY]

I'll accept that, especially if there's an offer to help included!

Re:Revenge?

[happyfrogcow]

Oh and finally spam makes money. TONS AND TONS of money. hundreds of thousands of dollars profit a month usually run by 3-4 guys

From who, seriously? Is the money comming from sale of illegal goods? Or is legal goods? I still don't see how spammers make money. Is it from people hiring their services? If so, do those people hiring spammers make money?

Re:Revenge?

[Anonymous Coward]

Welcome to Slashdot: Home of the World's Greatest Ideas of What Someone Else Should Do.

You'll never hear from the cretin to which you replied.

Re:Revenge?

[Anonymous Coward]

Uh. Forgive me if I'm daft, but wouldn't this be stooping to the level of the spammers? Sure, all's fair in love and war, but DoSing their sites happens to be just as illegal (at leas in the US) as sending out a virus/worm that attacks anti-spam sites.

Re:Revenge?

[The Good Reverend]

I met all the other spammers down here in Boca Raton FL (the american capital of spam).

Why doesn't it shock me that the capital of spam in the US translates to "Rat's Mouth"?

Re:Revenge?

[thedillybar]

I disagree.

If hiring a spammer means 0.1% valid responses and 1% invalid responses, then the merchants will eventually catch on and stop hiring the spammers. At some point, this ratio gets so small that it's not worth advertising.

Sure, this may take a some time and some merchants, but eventually it will work its magic.

Re:Revenge?

[leviramsey]

It's mostly from people who come out of a regular job with an idea to sell widgets online. They see an ad in one of those "business opportunities" magazines for a spammer. They sign up, pay, say $10,000 for a list of 10 million email addresses ("A tenth of a cent per email? With a 1 percent response rate (and my widgets and pitch are so good, 1 percent is the minimum!) that means 10 cents per response. I make $10 on every widget. I'm going to be RIIIIIIIIIIIICH!"). The response rate is pitiful, they lose money on the promotion, and they either learn the lesson or move to another spammer. Eventually the business fails.

However, there's enough entrepreneurs (and pseudo-entrepreneurs thanks to tax code insanity like the fully-deductible Escalade...) to make spamming a gold mine.

The media isn't really publicizing how ineffective spamming is. All they say is how much money the spammers are making. In the mind of the mental midgets who start these companies, if they see that their SSP (Spam Service Provider) is a millionaire, they think, "this has gotta be working." Of course, it's that type of thinking that proves irrefutably that most people are idiots. Call me crazy, but I want those providing services to me to be as poor as possible....

Re:Revenge?

[kaltkalt]

"Foolish consistency is the hobgoblin of little minds..." - Emerson Anyway this is not aobut DoSing their sites but rather supplying them with false order information. Not to knock them off the net, but rather to increase their transaction costs and make their operations less profitable.

Re:Revenge?

[Anonymous Coward]

hahaha! Most excellent... then someone DID take my idea to develop such a useful tool. Although I haven't had time to check it out, I hope the authors and users know of the legal ramifications of using such a tool, which can be easily interpreted as a DDOS tool.

I would hope that slashdotters would put in a delay so as not to swamp their server totally, because this would leave the user open to possible prosecution.

I would caution anyone planning to use this tool, to be very careful in how they use it.

Re:Revenge?

[plover]

Except my point is that they don't get 0.1% valid responses. Most get vanishingly close to zero actual responses. They already do not make money at it.

0.1% response rate is a myth perpetuated by spammers to advertise just how valuable their services are. Anyone believing that would say "Hey, one million emails means I will sell one thousand ink cartriges." The reality of spam is that one million emails means they MIGHT sell five or ten ink cartriges, or even one or zero. Their sales rates on a good run might be between 0.001% (1:100,000) and 0.0001% (1:1,000,000)

Compare that to my wife's firm's experiences with third-class bulk mailing. They were extremely pleased with a 2% return, and weren't surprised by 1%. The mailings cost somewhere around $0.20 per piece, so advertising cost them $10.00 - $20.00 per sale. According to a sponsored google link querying for 'bulk email rates', "spam-free email advertising" (?!?) costs $69.60 for 300,000 pieces. At the spammers' mythical 0.1% return rate looks like you'd get 300 sales, at a cost of $0.23 per sale. The reality of spam is that a return rate of 0.0001% costs $232.00 per sale. As my blonde friend might say, "We'll just have to get a bigger computer!"

Hopefully a merchant burned thusly will no longer look to spam for advertising, as the spammer pocketed the only profits made in this transaction. But the spammer will simply move on to fleece another gullible merchant.

So, it's already not profitable. Beating them into the ground with a really cool java program isn't going to teach them anything more than they've already learned by pissing their money away to the spammers.

The heyday of truly profitable spam is long past. 0.001% sales rates or lower are now the norm. "Hit rates" remain high due to auto-preview features in Outlook and Outlook Express, but even my mother doesn't read the spam anymore. As long as spammers continue to parrot the myth that spam is profitable for the merchants, and as long as the ethically-challenged amoral suckers are willing to buy into that lie, we'll continue to have spam.

Re:Revenge?

[darxyde]

spammers usually hire VERY good technicians and pay them very well

Do you know anyone who's hiring?

All you need is some security clearance to get these guys out of action. I know i wouldn't mind taking the fall.

Re:Revenge?

[Anonymous Coward]

The point isn't to DOS the innocent webserver, the point is to give them bogus leads, so they can't make any money. Sorta like counter-spamming them, but without harming anyone but the spammer...

Re:Revenge?

[sjames]

In cases of spammer for hire, I agree. There are, however, still a few out there (penis pills for example) who still spam their own scam. At least we can get rid of those.

Meanwhile, other than more spam, any idea on how to let merchants know the real cost of a sale through spam?

Re:Revenge?

[Anonymous Coward]

DDOS is hardly the problem.

Pretending to be someone you're not even if it's revenge is still fraud. Even if it's a spammer.

Re:Revenge?

[Anonymous Coward]

If you flood a spammer's customers site with millions of fake cc details, what would happen if by chance you actually supplied someones reall cc details. Would you be committing fraud?

I'm assuming this program would use random numbers for the cc details as a card number of 5555 5555 5555 5555 would be spotted pretty quickly.

THE PARENT POSTER IS A KARMA-WHORING TROLL!

[Anonymous Coward]

Read his journal. In it, he admits to the following:

He is the former Sir Haxalot/Pingular, well-known for crapfloods and karma-whore posts.

He reposts older highly-moderated comments using the anti-Slash database tool in an effort to boost his own karma.

He must be stopped. Mod him as "overrated" to lower his posts score and deny him precious karma, while avoiding the wrath of meta-mod. Thank you, and please spread this message after his posts to let everyone know of the dangers of this man.

Too evil?

[Dracolytch]

Hey guys,
Just something to think about: This article talks about spammers along with references to not only spam, but destruction of anti-spam, virii, pornography, theft, identity theft, and child pornography. The only way they could really make spammers look any worse is if they labeled them as baby rapists.

While it could be true, it's beginning to sound like propaganda, intending to make these guys look more Evil than life. Think about the article's motivation, author, and target audience. Be careful, there may be something more going on than what we see on the surface.

~D http://www.dracosoftware.com

Re:Too evil?

[Anonymous Coward]

... child pornography. The only way they could really make spammers look any worse is if they labeled them as baby rapists.

Isn't that implicit in "child pornography"?

Re:Too evil?

[Zak3056]

Just something to think about: This article talks about spammers along with references to not only spam, but destruction of anti-spam, virii, pornography, theft, identity theft, and child pornography. The only way they could really make spammers look any worse is if they labeled them as baby rapists.

While it could be true, it's beginning to sound like propaganda, intending to make these guys look more Evil than life. Think about the article's motivation, author, and target audience. Be careful, there may be something more going on than what we see on the surface.

You DON'T HAVE TO make this kind of stuff up--the spammers are more than happy to provide the real thing!

The virus in question (mimail.L) offers porn, claims to be sending you child porn, attacks anti-spam sites, and tries to associate those anti-spam domains AS CRIMINALS in the minds of the target.

What do you WANT the article to say? That these spammers/virus writers are misunderstood, because they had poor childhoods and their mothers didn't like them?

Take off the tinfoil and open your damn eyes.

Re:Too evil?

[Dracolytch]

I'm not saying that at all. Whoever wrote this article had a vested interest in the subject matter, and wanted to rouse the community. While you could easily argue that we all have a vested interest in this topic, and have reason to get agressive about it, I also think there are dangers implicit in getting a group such as /.ers so riled up.

I'm not saying that the article is false. I'm not saying that spammers are better than the scum of the earth. I am saying that with such a negative article so obviously designed to get people worked up, that we exercise a bit of caution and thought.

~D

Re:Too evil?

[liposuction]

Nice sig. =)

Re:Too evil?

[menscher]

The virus in question (mimail.L) offers porn, claims to be sending you child porn, attacks anti-spam sites, and tries to associate those anti-spam domains AS CRIMINALS in the minds of the target.

Huh? Care to back this up? I haven't found any evidence of an intentional attack against anti-spam sites. Yes, they're having problems. But that's to be expected when the overall volume of email goes up, right?

Re:Too evil?

[Anonymous Coward]

One acronym: RTFA!

Re:Too evil?

[Zak3056]

Huh? Care to back this up? I haven't found any evidence of an intentional attack against anti-spam sites. Yes, they're having problems. But that's to be expected when the overall volume of email goes up, right?

1. Mimail (all variants) is a DDOS tool, which targets anti-spam sites. Had you read the article (or known anything about this family of worms in general) you would know that.

2. This version of Mimail contains links to anti-spam sites in the email it uses to spread itself. Here's an excerpt:

Are you ready for all types of underage porn? We have the best selection for every taste!

Just click the secret links below and have fun:
http:/ /www.spamhaus.org
http:/ /www.spews.org
http:/ /www.register.com
http:/ /www.cardcops.com
http:/ /www.carderplanet.net
http:/ /www.spamcop.net
http:/ /disney.go.com
http:/ /www.authorizenet.com

Is that enough evidence for you, or do you want more?

PGP, noobs

[fulldecent]

Clearly, the answer to this problem is:

• Popular spam fighting group publishes PGP keys
• Make big blacklists, sign them
• P2P

Furthermore,

1. PGP becomes popular
2. More people use it and understand it
3. Goto step 1
4. Companies require it
5. Mail clients put a pretty icon next to signed emails
6. Noobs are afraid to open mail without a pretty icon
7. GG no re spammers

Finale for Mac

[Anonymous Coward]

just get the Mac Finale version, and transfer the files. Likewise, Appleworks will read / write .doc and .xl, or she can get Office for Mac

I've seen worse

[Anonymous Coward]

Probably the most impressive, presumably malicious attachment I've seen so far has been one I've had a few copies of recently. When I first saw it, it looked surprisingly plausible:

"Hello there,

I would like to inform you about important information regarding your email address. This email address will be expiring.
Please read attachment for details."

It claimed to be from 'admin' at my email provider, an address which actually exists and I have had mail from them in the past, so even I had a second look...

It had an attached Zipfile, message.zip, containing a message.html, which began...

"MIME-Version: 1.0
Content-Location:File://foo.exe
Content-Tran sfer-Encoding: binary"

Then a binary which definitely looked like a Windows executable. The whole attachment was about 35kB in size, so fairly plausible for a reasonably complex HTML document.

Anyone know what it might be? The apparent HTML payload in a Zipfile seems pretty innocuous at first glance, so you have to be even more careful. I'm using an up-to-date Pine on a remote FreeBSD machine, so I was perfectly safe, but I can really imagine others being caught

Re:I've seen worse

[elemental23]

That's the original version of the Mimail virus, the one mentioned in this story. It's innovative because people have to take multiple steps to infect themselves (unzip file, run executable) and they still do it. *sigh*

Yes, us victims deserve all the blame.

[dpbsmith]

It's easy to say "don't open obvious spam at all" and "never open an attachment" and "never click on a URL in an email."

Personally, my middle-aged brain only functions at about a four-nines reliability level, meaning that if I deal with thirty pieces of email a day, about once a year I'll accidentally do something STUPID.

Like pressing "reply" before I've finished composing my mail. Or replying to all when I only meant to reply to one. Or replying to a list when I only meant to reply to one person on a list. Or thinking that PayPal might really have sent me an email. Or opening a foreign attachment. Typically I realize that I've goofed approximately five hundred milliseconds after performing the mouse click that commits me to the imprudent action.

(It doesn't help that I actually have real human friends who do send me email message with subject lines that are blank, or consist of the single word "Hi!" or "Meeting.")

I am sure that you never ever do anything STUPID, and I fully agree with you that someone as STUPID as I deserves to have my computer infected with viruses.

Re:Yes, us victims deserve all the blame.

[maximilln]

We love guys like you. Guys like you raised us and fed us and changed our diapers. Guys like you bought our first computers for us and looked on in wonderment when we started writing programs on loose-leaf paper around the Christmas tree at age eleven.

Guys like you need to put pressure on other guys like you to let guys like me migrate the world to secure Linux distributions and let guys like me manage the security aspect.

Nothing against guys like you, we love you. But guys like you should not be in charge of internet security no matter how many certifications or political connections you have.

I'm not blaming you but I'm doing the same thing that you did to guys like me when we were growing up: "See, if you would've listened to me in the first place this wouldn't have happened. Now you're stuck with it so quit whining."

Re:Yes, us victims deserve all the blame.

[jafuser]

The simplest rule when it comes to all forms of scams:

Never give money to someone who initiates contact with you.

I've had the ACLU call me on the phone. I am 99% sure that they are legitimately from the ACLU, but I won't give them a single digit of my credit card, because THEY CALLED ME.

I kindly informed them that I would go to their (secure) website and make a donation. Of course the person calling me doesn't get their commission or whatever, but I'm following the rule.

Re:Yes, us victims deserve all the blame.

[ketamineX]

That's why I am glad that I have about a two second delay after spellcheck is completed and the message is sent out.

Two seconds is just enough time to yank my ethernet cable out or eject my wifi card.

It helps give you meet that 5th nine of reliability.

Re:Yes, us victims deserve all the blame.

[LuxFX]

(It doesn't help that I actually have real human friends who do send me email message with subject lines that are blank, or consist of the single word "Hi!" or "Meeting.")

Here's my advice on the matter:

I use Outlook Express here, and whenever I come across an email I can't tell if it's spam or not, I view the source. First, make sure you are not using the preview pane (that shows the contents of the email in a third panel without having to open the email in another window), otherwise you've triggered all of the spam's bugs (which tells the [more sophisticated] spammers that you've read the email, therefore the address was valid).

So when you see an unknown email, right click, go to properties, details (the header information on this page might tell you all you need to know, but otherwise...), and click "Message Source". This will allow you to view the email's source without triggering bugs, and you can tell pretty quickly if the email is valid or not.

Re:Yes, us victims deserve all the blame.

[E-Rock]

Just tell your mail application that it can't talk to anyone but your mail server (you are running a personal firewall, right?). Then you can just open the mail and not worry about it talking to the internet. Anyone foolish enough to open an attachment from an unknown source promising porn should be running as a non-admin user (personally I don't think anyone should be a local admin while doing work) so these kinds of worms can't install themselves.

Re:Yes, us victims deserve all the blame.

[LuxFX]

I've got a hardware firewall box, not software, so it can't filter on an app-by-app basis. A shame, but I really don't want any more processes running on this already-heavily-laden box. But I only have to verify maybe one email every four or five days, so it's no big deal really.

My real solution (as in, the one I have planned but so far haven't had time to implement) is to roll-my-own email application. But then again I've always been in the "if you want it done right, do it yourself" train of thought.

Re:Yes, us victims deserve all the blame.

[E-Rock]

Take a look at Kerio (www.kerio.com); the personal firewall is free and if you turn off the bells and whistles (popup blocking, MD5 checking, IDS) it has a fairly low overhead.
But I understand you on the 'roll your own' idea. I figure even if it's not done right, at least you have direct access to the developer. ;)

Re:Yes, us victims deserve all the blame.

[Anonymous Coward]

We're not blaming you; I'm not, anyway, and I'm speaking as someone who has to deal with the results of this sort of thing. Occasionally people screw up; that's fine, they're human, it happens. However, I can only wish I had users whose brains functioned at a four-nines reliability level.

The people I'm blaming are the ones who have been told repeatedly, "Don't click on strange attachments" and "There is no such thing as free money, ever", but who go ahead and click on delete_all_my_files.exe anyway. And you clean up their machine, and you restore their files, and you say "So, now do you see why you shouldn't open this stuff?", and they nod, and they promise not to do it again.

And then they go and do it all again the next day. Sometimes they go and do it all again on the next message. And if you ask them why, they'll say "But I though this one was real", even if it's just another copy of the exact same message, or they'll just give you a blank, bovine look. They don't know, and they'll never learn, beause they don't want to learn. They don't care how much of a pain it is for anyone else.

Those are the people we're blaming. The fact that they're (usually) victims as well is entirely incidental.

Re:Yes, us victims deserve all the blame.

[pipingguy]

I realize that I've goofed approximately five hundred milliseconds after

Ahh, yes, the "ohnosecond".

Re:Yes, us victims deserve all the blame.

[Maestro4k]

• It's easy to say "don't open obvious spam at all" and "never open an attachment" and "never click on a URL in an email." Personally, my middle-aged brain only functions at about a four-nines reliability level, meaning that if I deal with thirty pieces of email a day, about once a year I'll accidentally do something STUPID.

While I suspect you're being a tad tounge-in-cheek here, the fact is most people who know what to look for and try to be cautious don't have problems with viruses/worms. Even for an age-addled mind, certain things set off alarm bells (and Free Porn HERE!!! is certainly a 5-alarmer) and you pay more attention before you act on it. Hey, I screw up from time to time and send incomplete E-mails etc too.

You can also train at least some people what to watch for. My Mother uses E-mail quite a bit, and I'm probably her only security-conscious E-mail acquaintance. Still, I've taught her what to watch for, and armed her with a great client (The Bat! which default to high security), and she does great. In fact there's been at least 2 occasions so far where she did get a virus E-mail, and she asked me about it to be sure, but she had already come to the conclusion that it was bad.

The real problem isn't occasionally goof ups, it's the people out there that seem to be so stupid that if you put up a sign at a busy intersection saying "Free Porn, just jump in front of a moving car!" the death toll would be astronomical that day. I've seen people that have clicked on things that no one in the right (or hell, even wrong) mind could _NOT_ know was a virus, but yeah they clicked it, and then wonder why everything's broken.

DIE SPAMMER DIE!

[BubbaTheBarbarian]

Cannot resist this one...

OK kids, sit down and let uncle bubba explain this one for you. One, if you see something once, it might be a coincidence. Twice means that maybe lighting is hitting the outhouse twice. This is the third one of these, and with each successive version, the methods and operations of the virus are getting more effective and efficient. That means at least two developers were able to reverse engineer and increase the efficiency of the payload of the virus, OR someone is monitoring what is going on and making improvements. Tell you what, I will let you think about that one for a sec...

We also have the comments from the spammers themselves. Many have come out into the open and said that anti-spam orgs declared war on them, and that they would fight back. Do you honestly think that this is just a chance happening?

I guess it could be, I mean, you could have some slashdotter waging a disinformation campaign targeting anti-spammers to piss everyone off...

Oh, and too the nuts want to sue Microsoft under the same pretenses as suing gun manufactures...dude, spammers are equal opportunity abusers...they are abusing open protocols as much as they are using OS holes to propagate this crap. So unless you want to sue Berkley or something like that...

Spammers evil...viruses evil...censorship evil...censoring spam ev...WAIT!...good...

"We also know there are known unknowns; that is to say we know there are some things we do not know. But there are also unknown unknowns -- the ones we don't know we don't know."

Re:DIE SPAMMER DIE!

[Anonymous Coward]

er, one problem with that.. Its not censoring spam at all.. Its allowing people to close there ears if they so desire.. Censorship would be stopping spammers from being able to say what they wanted.. Its not censorship if I decide not to listen or take measures so that I can't hear.

Re:DIE SPAMMER DIE!

[Anonymous Coward]

So unless you want to sue Berkley or something like that...

Why would I want to sue Berkley Breathed? He has provided me with years of entertainment?

Re:DIE SPAMMER DIE!

[phorm]

want to sue Microsoft under the same pretenses as sueing gun manufactures

No, not really. Sueing MS isn't like sueing for guns killing somebody, it's like sueing because the gun backfired, or jammed up consistently, thus making it ineffective for the purpose it was duely advertised.

Wouldn't you be pissed if your gun jammed several time when you just had a prized buck in your sites, or worse yet when an enemy soldier was turning around to aim your way?

Guns aren't inherantly defective, the usage is. Windows on the other hand, has some serious defects that have been overlooked and even simply ignored by the creating company.

They Both Suck

[Anonymous Coward]

Spammers suck, that is a given. To me, the people running these lists suck just as bad. How often do they blackhole someone who was not spamming? Who in the hell watches the watchers? Be your own boss, take care of your own spam. Better yet, let your email client do it for you, ala' Mozilla. I have had the same email for a long time and I get very little spam. Learn to protect your email addy. Just because you can't do that we have whole industries popping up to do it for you, and that effects other people with their draconian blacklisting. Fuck em, I hope they all find it impossible to stay in business. Spam I can live with, being blackholed to oblivion I cannot. I trust the spam killers about as much as I trust the spammers, ie not at all.

What else...

[$ASANY]

You can flood their websites with garbage data.

Project Web Form Flooder may be of some interest to you.

why blame spam?

[gunfinger]

i have yet to see anyone point out WHY spam is actually as effective as it is -- people buy into it!

if spam wasn't a money-maker, spammers wouldn't exist, it's as simple as that. just like if diets weren't such a huge industry, you wouldn't be seeing posters on how you could lose 30lbs in 30 days plastered all over your city (the birth of spam, might i add).

if all these men just stopped caring about the size of their weenies, spam would take a huge hit. if we'd all be a bit smarter and not even consider clicking on insurance / any financial links in spam, that market would also take a huge hit. and if we were all more passionate with our partners then that takes care of goat / bestiality porn. the 'barely legal' crap, you have to deal with on your own. that's just wrong.

honeypots, bayesian filters, spam blockers, LAWS... so much time, effort and money is being put into something that will only be solved once we start dealing with our own insecurities / needs.

Sue? No, use the Patriot Act

[coinreturn]

If spammers are attacking national assets (the internet, e-mail, communications in general) isn't this a form of terrorism? Perhaps the EFF or ACLU should team up with the Poindexter types and declare spam attacks, worms, viruses, ddos attacks, etc to be terrorism. Once a few of these people are held at Gitbay awhile maybe the attacks would decline.

Re:Sue? No, use the Patriot Act

[Ulven]

No it damn well isn't.

Why does everything these days have to be due to terrorism? The last thing I heard being described as terrorism was that someone who had defrauded a bank was being held on antiterrorism chargs.

Fraud is terrorism?

It's seriously annoying and it can't be just me who finds it so.

"Ooooh, a bandwagon, let's all get on and some have fun!"

And for God's sake, don't find any practical or intelligent use for the PATRIOT act. The last thing we want or need is other countrys coming up with their own versions.

(Any incorrect apostrophies are just looking for attention, and are not to be given any.)

spamhaus? the correct term?

[matth]

spamhaus spam'hows n. Pejorative term for an internet service provider
that permits or even encourages spam mailings from its systems. The
plural is `spamhausen'. There is a web page devoted to tracking
spamhausen (http://www.spamhaus.org).

The most notorious of the spamhausen was Sanford Wallace's Cyber
Promotions Inc., shut down by a lawsuit on 16 October 1997. The
anniversary of the shutdown is celebrated on Usenet as Spam Freedom Day,
but lesser imitators of the Spamford still infest various murky corners
of the net. Since prosecution of spammers became routine under the
junk-fax laws and statues specifically targeting spam, spamhausen have
declined in relative importance; today, hit-and-run attacks by spammers
using relay rape and throwaway accounts on reputable ISPs seem to
account for most of the flow.

i LOve yOU

[Anonymous Coward]

Marry me? We can have robbIE as best man...

shoot

[iocc]

They should simply be shoot. It will stop the spamming.

Re:shoot

[Anonymous Coward]

Aye, them cudda was shot yes in top head of, seen?

Targeting Disney?

[rsmith-mac]

Reading Symantec's Advisory, they list disney.go.com as one of the 8 random targets for the DDoS attacks. I'm sorry, but have the spammers lost their marbles here?! I mean, if you're going to attack someone at least do something you can accomplish; attacking Disney is going to be like trying to attack a tank with a butterknife, it's just not going to work. I swear, these spammers are getting sleezier and stupider at the same time.

Re:Targeting Disney?

[Pig Hogger]

Reading Symantec's Advisory, they list disney.go.com as one of the 8 random targets for the DDoS attacks. I'm sorry, but have the spammers lost their marbles here?

Probably just as a PR move to be endeared to /.ers, because Disney is quite an Evil company.

A paradox?

[Anonymous Coward]

If you're beside yourself with anger over spam, can you hate spam more than the next guy?

Revenge on Omar the spammer

[SkjeggApe]

Ok, I'm a bit reluctant to post this (someone may need to get a mirror going).
It's about Omar, a spammer/scam artist caught in a "counter scam" that is amazingly well done (he's been named salesperson for a non-existant firm selling "Oilators", and is part of a trade group called "Industrial Machinists And Development International League Doing Oilators" or IMADILDO for short, and the poor fool is being sent all around Africa to meet with people like Mr. Genitali Herpesi). As of last Monday, he was in Abuja, Nigeria.

Enjoy Omars Adventure

Why reinvent the wheel?

[macdaddy]

man 8 syslogd

under the heading:

SECURITY THREATS

5. Use step 4 and if the problem persists and is not secondary to a rogue program/daemon get a 3.5 ft (approx. 1 meter) length of sucker rod* and have a chat with the user in question.

Sucker rod def. -- 3/4, 7/8 or 1in. hardened steel rod, male threaded on each end. Primary use in the oil industry in Western North Dakota and other locations to pump 'suck' oil from oil wells. Secondary uses are for the construction of cattle feed lots and for dealing with the occasional recalcitrant or belligerent individual.

Why isn't the MONEY TRAIL trackable?

[swb]

I can reasonably believe that it's possible to gain untracable net access, especially if it involves hacked servers, fraudulently obtained 'net access or spam zombies. Logs only are kept so long and there are legitimate dead ends one can run into, especially when it involves hacked systems and zombies.

What I don't get is why no one is bothering to follow the money trail here, at the very least the commerce department or the FBI. I know that the credit card companies and their associated banks have a bad reputation when it comes to soaking card accepters (ie, businesses) for the losses one might more logically assign to the credit issuers or the banks.

If the crux of the problem really is transnational criminals and credit fraud, another possible solution might be "region coding" credit cards. A card issued in region A cannot be used to purchase goods or services from another region or shipped outside region A, unless the card holder specifically designates their card to be "region free". This would be of near zero inconvenience for most people unless they were heavily involved in transregional travel or purchasing.

But it might be a huge obstacle for people using stolen credit cards internationally, since they would have to come up with much more complicated means of using the cards. And if spam itself is truly an international phenomenon, this could also put a limit on spammers ability to rip off customers or traffic in stolen credit information.

Re:Why isn't the MONEY TRAIL trackable?

[maximilln]

-----
What I don't get is why no one is bothering to follow the money trail here
-----
I agree but I think I have an insight to the answer.

Banking institutions and credit card companies make money on three things: legitimate transactions, illegitimate transactions that the consumer doesn't contest, and collections departments for consumers that do contest. Collection departments, banks, and credit agencies lose money on the following efforts: transaction verification.

As long as they can continue to post net profit through legitimate transactions and bullying harassment of people who won't pay then there's no reason to implement a system which might call their integrity into question.

Really?

[Inoshiro]

Was the viral attachement a shellscript that could somehow execute and crack root and then go on to messing with my system?

No, I don't think so. The mildy suspicious of us won't run Windows. The most suspicious of us are busy running QNX on iPaqs because nothing will ever, ever infect it or mess with it! Nothing that can infect most people, anyways ;)

Stop Helping Them

[Anonymous Coward]

I've turned down at least three projects this year from obvious spamheads. One guy actually asked me if I could crack someone's encrypted user database he'd gotten a copy of on CD. I said I'd give it a try - got the disk, found out the company name and promptly reported him. They're suing the *^&$@#*&^ out of his silly ass now. It's easy to stop spammers - just stop helping them and REPORT them when they're breaking the law.

A Modest Proposal to Defeat Spam

[Simonetta]

Let's EAT the children of the managers of companies that advertise using spam!

Re:A Modest Proposal to Defeat Spam

[The Snowman]

Let's EAT the children of the managers of companies that advertise using spam!

I used to use MyCheckFree to pay some bills online, then I received a spam from them from SilverPop, a "legitimate" spammer. I say "legitimate" because I had no problem contacting a person at the company, their information was correct, etc. Anyway, I wound up bitching both companies out and canceling my account. I did not eat their children, but I did take a bite out of their income.

Re:first post!

[garfdotca]

Actually, yes, I do!

Symantec's instructions to avoid the Mimail virus

[Anonymous Coward]

"Mac OS X hasn't had any viruses since the OS was launched," says Bill Rosenkrantz, the head of Macintosh products at Symantec, the big antivirus firm. "It's more difficult to attack the Apple system than Windows."

As quoted by The Wall Street Journal on 23 Oct 2003

• http://ptech.wsj.com/archive/ptech-20031023.html

I hate spam just as much as the rest of you...

[Anonymous Coward]

but some of these "Blacklist" organizations are not trying to help eliminate spam, or even block it, they are trying to _make money_.

<rant>
MAPS is one of them, and unfortunately I've been dealing with this problem first hand. I just installed a new server and out of the box Apache2 was setup to be an open proxy. It didn't take more then an hour or two before the IP was listed on MAPS-OPS. This is fine. However I promptly closed the proxy and notified them. What did they tell me, they sent me some canned email that told me to close the proxy.

Alright, so I double check again, I search google for open proxy testers, run them, they all return negative, I look at the MAPS "test report", all it says is:

IP: closed
IP: test finished.

Looks to me like the proxy is closed. I email them again, to say the proxy is closed, unless you can give me other details, your own test results seem to confirm this, whats going on?! They reply back saying their open proxy test is robust, advanced, and proprietary, therefore they can not give me any information regarding the test. Not only that, they want me to show what I did to close the proxy, and prove to them that I am the server administrator! Oh, and the best part, they want the email to come from abuse@<blocked_IP> or postmaster@<blocked_IP>.

Well, for one I can't email them from those addresses because THEY BLOCKED ME! For two, how can I prove I'm the server administrator? The email address I'am using to contact them is listed in the whois record for the domain as the "admin contact". Thats not good enough though apparently. What do they want, a digital photo of me standing beside the server with a big "anti-spam" sticker on it?

Thats the last I heard from them, they blocked me from filling out there "remove me from the list" form. Nice.

If every open relay and proxy in the world was closed at this minute, MAPS would go out of business, therefore they have absolutely no interest in removing people from their list.
</rant>

Re:I hate spam just as much as the rest of you...

[Anonymous Coward]

MAPS are bozos, and have been for a long time. I stopped taking them seriously when one of their employees spammed me. I don't know of anyone I would want email from who uses their shitty list.

PARENT CONTAINS GOATSE LINK

[Anonymous Coward]

Parent, you are a dumb piece of shit.

They destroyed Usenet a long time ago...

[Dr. Evil]

Email is next. How many IDs have you discarded because of SPAM?

Instant messaging has for the mostpart replaced email for informal conversation. I can't have a decent email discussion with anyone anymore because of the sheer volume of SPAM. IM hasn't been swamped yet. But when email is dead, IM will be next.

I've lost contact with friends and I've missed real "urgent notifications" for payments because of SPAM.

It's idiocy. Legislation and vengence are not the answer though. I think the problem can be solved via a technical solution, everyone just needs to adopt it.

There's a niche here for somebody to make a killing wiht some slick spamproof email solution.

Re:They destroyed Usenet a long time ago...

[maximilln]

I've configured sendmail, and exim, and postfix. There are spamproof email solutions. It's not any different from securing a wireless router. For an smtp server, no mail is forwarded except for internal communications. It's easy to block forged addresses by simply not allowing outside connections from the internet.

With this in mind then the spam issue is really elementary. Spam is being sent one of three ways.
1) Through smtp servers which are run by incompetent sysadmins who don't know how to lock their services. The executive board of any such company should be jailed. The sysadmin should be demoted to help desk.
2) Through smtp bouncers installed on hacked Windows boxes. MS and the executive board which failed to utilize a more secure solution should be jailed.
3) Sent by a desktop advertising agency which is funded by a taxpayer subsidized small business loan.

I rank the probability spectrum 3,2,1. The problem isn't being solved because the people making money off of the spam are the same people who lobbied the politicians to set aside the funds in the first place.

"No. No. We're not doing anything wrong. This isn't spam. You wrote the bill. You know that there's a loophole right there in subpart a, section 3, subpoint n which says that as long as we're a 'desktop advertising agency' we're not spammers."

Re:They destroyed Usenet a long time ago...

[Oliver Defacszio]

Sorry to pick on you specifically, but what in the hell is WRONG with people? How can people, especially those with SOME level of technical knowledge, STILL be getting clobbered with spam?

HOW?

I have had the same, very simple e-mail account with a nationwide ISP for more than two years and have seen precisely four pieces of spam the entire time ("clever guess" spam, at that). Before that, I had an account that was kept safe for seven years prior to my moving. How? I exercise my eight brain cells in handing it out and I have another "junk" account for things like domain name registrations and stuff where its public display is foreseeable.

Now, you may ask yourself, "How clever IS this guy." Oh, I'm not that smart, but I do possess something called "an ability to learn from the mistakes of others" (sorry for the technical jargon). I don't even have any filters set up in my e-mail client because they're not necessary. Can you believe it? All because of a little foresight.

Do you also hand out your telephone number to anyone who wants it, despite intents? How about your driver's licence ID number? Your bank account information? Oh, those things are common sense, right? After all these years, why isn't e-mail also common sense?

There is NO reason whatsoever for anyone to get clobbered by spam unless it is due to one's own stupidity.

Re:They destroyed Usenet a long time ago...

[Dr. Evil]

Methods to get spammed when you know better:

• Correspond with the victim of a worm.
• Receive an Internet postcard from somebody who genuinely likes you.
• Have somebody send you a link to an article using a "click here to send this to a friend" button.
• Post to a private mailing list only to have somebody conveniently set up a web-archive.
• Have an easily guessed email address.
• Have somebody cc' you on a usenet post.
• Be unlucky.

If none of these things had happened to me since 1998, my current address would probably be spam free.

Explaining the problem to people beforehand is only so effective. Telling off your friends after the fact is not a solution. Eventually you just have to give up. My work address has been quite safe, I generally don't use it to correspond with the outside world, especially non-technical people and it is reasonably cryptic, but my personal address is ceaselessly bombarded.

Re:They destroyed Usenet a long time ago...

[angst_ridden_hipster]

Well, my friend, let me tell you a little story.

It begins way back in the Dawn of Time, before Canter & Siegel spammed Usenet... when the Web was still an obscure little project that handled text documents... It was back in those days (when the Usenet was still a bunch of geek enthusiasts, when email was for communicating, and when online pr0n meant anonymous ftp to East-Coast universities) when I established my email address.

Yeah, hard to believe, but in that distant time, it was not only common to post onto Usenet using your real name, but also your email address. It got out of control sometimes, when you'd actually get five emails a day from people who had read a posting and wanted more information, but we were geeks, we were proud, and we wanted to share our knowledge.

So my email address has been out there in public for about twelve years.

So that same email account today gets maybe 375 spams on the average day. Spam-assassin kills 370 of those, and maybe one innocent bystander each week.

"Stupid!" I hear you say. "Why not change it?"

Well, it so happens that I still get email to that account from people I don't know, based upon code I wrote seven years ago, ray-traced renderings I did ten years ago, or other stuff I posted to alt.conspiracy back in the day. Some of that email is still important to me.

So, in fact, there IS a reason some of us get clobbered by spam other than stupidity.

Re:What happened to the /. Spam in a can icon?

[goatan]

I just noticed that slashdot has replaced the little Spam Can icon with ... a pig??

if you look carefully the body is square! just like its a can of spam

Spam Tax

[Lost Penguin]

I think the people who want to charge for e-mail are right, to a point. We could take the rate of e-mails sent and multiply by the "tax". A normal e-mail user pays $.0001 per e-mail, any fee less than a penny would not be billed.
If (X) e-mails are sent in an hour, the rate increases to ($.0001 x (X) charge per e-mail sent.
Would this end spam?
Show me where the holes are in this idea.
It cannot be this simple or someone would have done this.

Re:Spam Tax

[ToW85]

Pray, tell me, who would collect the tax? How could we enforce the tax in the countries in where most of the spam originates, ie. Brazil and Romania?

MOD PARENT UP.

[Malcontent]

This project deserves more visibility.

Small tangent...

[IANAAC]

I get so much spam with .biz domains that I've seriously considered blocking anything .biz. The only thing that's stopping me from doing it is that I could conceivably get a prospective customer with a .biz domain via email (I do translations). Has anyone actually received anything legitimate from a .biz domain? I'm curious.

Re:Small tangent...

[sketerpot]

Has anyone actually received anything legitimate from a .biz domain? I'm curious.

Never. .biz is a good token for my bayesian filter. I guess the sleazy sound must attract spammers like moths to a flame.

I tell you, this is the most compelling argument I've ever heard for a redundant TLD.

Re:Small tangent...

[Spansule]

I use a .biz domain to host the web services for our application, and we send out download confirmations for our demo program and such through that domain. It's all automated stuff, but not spam (the confirmation contains the demo password, support info and such). You get one message if you download the demo. You notice the .biz thing because there are a lot fewer of them. Most of the domains I wind up filtering are .com, not .biz. With your filter you would download my demo and never receive the activation code. But it's true, I don't know of anyone hosting a general purpose site with .biz. People don't think to look there after .com, .net, and .org. While I send legitimate email from a .biz, I rarely receive it, unless it's from my own server (admin messages come through it as well).

Re:Small tangent...

[IANAAC]

You notice the .biz thing because there are a lot fewer of them.

Actually, no, I get a lot from .biz. Just as many, if not more than .com. Certainly more than .net.
RE: your comment about looking after .com, net, .org domains - the majority of my filters are content, not from-based (OK, I also do alot of relay-based filtering). When I set up filters, I take a look at what's inside and block based on href links, which, as I mentioned before, many, if not most are .biz.

Re:Small tangent...

[letxa2000]

You notice the .biz thing because there are a lot fewer of them.

It's the ratio.

In my Bayesian corpus, the .COM extension in an HTML tag is a 90.43% spam probability (because most of my non-spam doesn't have HTML tags) and a 22.0% spam probability in free text.

Meanwhile, BIZ is a 99.92% spam probability when found in an HTML tag and a 90.5% spam probability in free text.

So, yes, .BIZ is a good spam token and I, too, have thought about filtering everything .BIZ. The main reason I don't is because my Bayesian filter catches 99.9% of it all anyway so there's no reason to bother increasing my false positives by filtering BIZ.

Seems like a good idea

[KalvinB]

I have Cox and they block port 25 going out which makes sense. However, I run an on-line business and need to use my own e-mail addresses for my domains. That server is colocated at another ISP. The solution? Port fowarding on the server side. RinetD makes it really simple to forward port X to port 25. So now on my side e-mail goes out on port 28 and in on port 25. Server side recieves mail on ports 28 and 25 and sends mail out on port 25.

So the problem is solved with my mail server but what about other e-mail servers that people subscribe to?

It boils down simply to responsibility. Cox and other port 25 blocking ISPs don't want to be responsible for your mail server. Not *all* ISPs should block port 25. *All* ISPs should have guidelines for when to block port 25. Homeusers, fine. They can deal with having to use their ISP given e-mail address. If they need to send mail through another mail server they should contact that mail server and ask them to do a port forward.

If they want to take responsibility for what you e-mail through their system they can open up a secondary port.

The ISP has made their decision and the answer is "no." The only people inconvienenced by this are people who intended to run an e-mail server on a residential line (ISPs always have non/less restricted account types for businesses) and I'm not feeling a pity party comming on for those people. If you want to run a business, you pay the price or find someone else. Qwest DSL doesn't block any ports and using a business line with them I used to run the entire business out of house. Their limitation is speed which is why I moved to colo and got a cheap residential connection for my own use and handling the business remotely.

And if you don't want to pay the price (I'm not about to spend hundreds a month to two ISPs just so that one of them lets me send e-mails to the other without a port forwarder) find an e-mail hosting company (like me) that has an additional port to get your e-mails out through.

The port 25 block is to prevent e-mail servers from being run on a residential line. Port forwarding on the server side doesn't break that rule. I'm not running a server on my residential line.

Maybe someone else has an argument why blocking port 25 is wrong and evil in any and all cases but I can't come up with it.

All ISPs should block port 25 in at least some circumstances. The first circumstance to consider should be residential. It's very trivial to allow port blocked customers to use a 3rd party e-mail server running under circumstances that allow port 25 to be open.

Ben

Re:Seems like a good idea

[maximilln]

-----
Cox and other port 25 blocking ISPs don't want to be responsible for your mail server.
-----
To me this has sounded good but never adds up if you spend a moment thinking about it.

If you're sending spam directly from your IP then you're easy enough to catch and prosecute.

If someone else is sending spam from their IP but spoofing as yours it's easy enough to compare MAC addresses or follow the email back through the various smtp contact points.

If you're sending spam directly from your IP but spoofing everything then the investigators need to track you by more technical means (MAC address). Current investigations of spam routed through multiple smtp bouncers requires this anyways.

Someone please tell me how blocking port 25 solves anything? I see only that it gives the ISP IT departments an excuse to request more funds to begin sifting through everyone's email.

I wonder just how many of these spammers...

[Channard]

.. try and sell their pirated copies of Norton Systemworks through spam, harping on about the evils of viruses, all the while paying some script kiddy to write their anti-anti-spammer worms.

A torrent of blocklists?

[Anonymous Coward]

I don't really understand all the concept of bittorrent but would a torrent of blocklists work?

-1, Childish

[Gothmolly]

When I can host for $5 a month, why would I even bother spamming from home? This 'block traffic so people won't do bad things' is the first step on the slippery slope of 'Internet=WWW' and Belkin router HTTP redirects.
When your kids ask 'Were you there when they sold the Internet?' what will you say?

Re:-1, Childish

[Phil John]

Because he's not talking about spamming, he's talking about people who get infected with these viruses that have their own SMTP transports. These can be used to send the worm/trojan/virus/backdoor to everyone on the persons buddy list, or be used as a smtp relay for spammers nefarious purposes, like a web of HTTP proxies but for mail.

change your %$#@! email address

[bobsalt]

It sucks, but, now I get zero spam.
Surprisingly, most people were smart enough to update their address books.
For buying stuff online, I use a hotmail account. I go in and toggle the exclusive spam filter on and off when the product is on order or shipping. Works great!

Blame SPAM because...

[Baron_Yam]

I, and the vast majority of 'Net users, shouldn't have to spend extra money or time to deal with spam flooding our mailboxes and overall bandwidth because a small percentage of 'Net users are idiots, being fed on by a few human shitpiles.

Slap the idiots, shoot the shitpiles.

Maybe what we need is software to track outbound traffic responding to spam (and capture it to prove it isn't automated)... Maybe the spam is sent from other countries, but most of the respondents are in the USA or Europe where you can get at them. Pass a law, fine the lawbreakers, or at least publicise their attempt to get a bigger penis!

Re:Blame SPAM because...

[gunfinger]

well, i agree with you -- no large group should ever have to suffer the consequences of a smaller group's misdeeds. but that lesson is applicable in all things in life. you know the stereotypical movie setting where someone does something nasty in class and if the kids don't fess who did it, they're all going to get held for detention. well, we are all being held in detention, and perhaps we should find those who're helping spam by clicking those links. i imagine tho, that perhaps it's not such a small amount of people, but rather an incredible large % of recipients.

What Should Be Done (But are arfraid to do so).

[Deathlizard]

1) Kiss SMTP Goodbye: Get rid of all pervious forms of Mail transfer and replace it with something that is secure, true to source with some sort of secure level tracking, Open to all, and trustworthy. Compatability be dammed. Users still using SMTP be dammed. they either switch or they don't get E-mail anymore.

2) Ban Dynamic Mail: if you make E-mail less Dynamic and only handle a few things, such as Bold, Italics, Underline, and font sizes, (Like it used to be before Microsoft followed Netscape's mistake and screwed it up) then the virus writers have a smaller footprint to infect you (although stupid people will still click virus.exe because Bob sent it to me and Bob would NEVER send ME a virus.) and spammers cant track you with their 1x1 jpg file pointing to sleezebagspammer.com. If you must use HTML for mail for some reason, at least limit what you can do to it, like how slashot does it to protect their comment system by allowing just a few HTML Tags.

3) Ban the address book, or secure the hell out of it: It's 2003 Microsoft. Viruses have been expliting your address book for over 5 years now. either get rid of it or do something to make other programs impossible to access it.

4) Start suing and prosicuiting: It gets really hard to justify spam if you can now get sued by ISP's for filling up their systems or making it illegal to do. Of course finding them is the hard thing to do but not as hard once you do #1

Re:What Should Be Done (But are arfraid to do so).

[musikit]

3) Ban the address book, or secure the hell out of it: It's 2003 Microsoft. Viruses have been expliting your address book for over 5 years now. either get rid of it or do something to make other programs impossible to access it.

They wont/cant do this.

the address book is listed as a OLE/COM control. that means that anyone that knows the OLE/COM GUID of the address book can use the address book. Ohh guess what Outlook knows the OLE/COM GUID of the address book. so if yo close off the address book then no application would be able to use it.

the original intention of the address book was for every application that wanted to allow you to email anything (ex. email your chess move to your friend) would simply connect to the address book. allow you to select who to send the chess move to and then contact your email client to send out the email for you. JUST LIKE YOU CLICK ON A MAILTO AND NETSCAPE/MOZILLA OPENS UP YOUR EMAIL CLIENT.

if you are an admin and you truely want to stop address book viri then either...

1. delete the OLE/COM GUID from the registry. look up will fail and their code will either crash or not continue (Depending on how it was written)

2. change the OLE/COM GUID of the address book. this is allowable. that's what COM/DCOM/.NET/distributed computing is all about. finding a service that supports an API and asking it to complete a request for you. by replacing/changing the address book GUID you can replace the address book with a fake one that will always return an empty set.

3. Don't use MS technologies. have you recently heard of someone that was running Opera as a web browser and using Eudora as an email client getting hit by these viri? Yes on a MS machine even not using IE/outlook it is still possible to get this virus however it will require user stupidity rather then MS programmer stupidity.

i simply can't remember of the last virus that was targeted specifically at Linux/MacOSX/BSD. yes said OSes have security holes (admit it no programmer is perfect) but all these virius are targeted at the larger majority... people who are either uniformed/too lazy to change their email/web browser clients.

i believe the expression is QED.

Re:What Should Be Done (But are arfraid to do so).

[greenius]

2) Ban Dynamic Mail

This is silly. We should be advancing forwards not going back to the world of text only terminals and line printers. The majority of people are reading their email on desktop systems with high resolution colour graphics, so why shouldn't emails be able to take advantage of these capabailities? If we could rely on this feature more then we could also reduce the number of documents that are sent as attachments when there shouldn't really be any difference between an email body and a document.

3) Ban the address book

This also seems a backwards step. We should be moving towards applications working together. For example instead of keeping seperate address books for use by your office program and another for email and another for yourt contact manager, etc... surely it is better to have one single database of contact information that any compatible application can share.

While your suggestions might be good in terms of combatting spam they seem like they push us backwards in terms of usability and the future of desktop computing. I don't see why the minority (spammers) should force the majority (normal users) to suffer inconvenience and not use computer technology to its potential.

Saw that email weeks ago..

[nurb432]

Though i of course have no way to know if it was from this virus or just someone fishing for CC numbers.

The jist of it was that if you DIDN'T want to recive it you had to verify your CC number...

ho ho, ha ha.

[twitter]

I've just received a fake "mailer daemon" rejection message with a viral attachment; although my a/v program caught it, I can see this tactic catching even the most suspicious of us...

Oh, I'm so afraid - not. I'll see the "root_me" virus pretending to be text as an attachemet in my mail client, Balsa. When I click on it, it will open up in a text reader. This will get me if the virus author knows about a Basa text display exploit, but that's silly because they don't need to have me click on anything if they have a text exploit! If such a thing does exist, they will have to pull a privalidge escalation exploit in another program they can't be sure I have or what name it runs as. In fact, they can't be sure I've got Balsa instead of Mutt, Pine, Kmail, Mozilla Mail of dozens of others. So, even if free software adoption was 100%, the odds of a virus finding an exploit path are a small fraction of 10% for any free software machine. You just know that Bill Gates has legions of programers in India and China trying to break free software this way, but it's not happening.

Free software is better than comercial crap. Rooting free software machines will continue to be a difficult manual process that can't be automated. There are too many alternatives which are fixed too quickly. The variety alone would make a free software worm huge and this limits infection rates as it slows down tansfer, makes the worm easy to identify and less sucessful in finding what it needs. The quick repair time stomps the nasties out. We will never see the internet destabilizing worms in free software that we have repeatedly seen in the Microsoft Monoculture.

Re:ho ho, ha ha.

[Mike Hawk]

This is ground control. Come in twitter. Earth calling. Come in twitter. Are you reading us here in reality? Please copy twitter. Whats your 20?

You're asking for command confirmation

[Tired_Blood]

Although command confirmation will not prevent the truely clueless from doing who-knows-what, it would prevent the more savvy amoung us from making such mistakes.

Advantage - Less accidents. In an email program, training yourself to not click on a suspicious link/attachment is helpful. However, that link occupies a given area of your desktop and has the opportunity to be clicked. Adding a step to confirm such a click would give you a second chance.

Disadvantage - You have one more step in performing a given procedure.

I'm going even more off-topic here, but this is also benefitial to code writing as well. Buffer overflows are the main exploit used by viruses. One more step to confirm a string length would eliminate this type of threat. Of course, that one step may need to be repeated a lot, which would 'waste' processing time and slow things down. Although I've never used it, OpenBSD is running with this idea.

Flawed statistical model

[RT Alec]

The conclusion is based on a flawed statistical model. If you look closely at the link, you will note that only IP addresses that were listed on the various RBLs were counted as "dynamic". What about dynamic IPs that have not (yet) bmade it onto one of those lists? The lists are by no means a comprehensive compilation of each and every range of dynamic IPs that exist. My guess would be that a significant number of the remaining IPs are, indeed, dynamic;y assigned.

Re:Flawed statistical model

[Templar]

Exactly. I'm getting one spam from one address at a time, in extremely large quantities. These addresses are not on the dyn lists.

You should see my logs -- it's a mess out there right now.

Um...no

[KalvinB]

E-mail sent through my mail server will be tracked to my mail server. If there's a problem I have logs (and invoices for payment) to track down the person responsible. I can also just cut them off.

The same as would happen at the ISP level. They have your records if they need to find you. And they can cut you off. ISPs are now just cutting everyone off who isn't paying for the ability to have an unrestricted connection.

Sending spam from your IP will get you in trouble but it also has the potential to make the ISP look like it's spam friendly, get it on blacklists and all kinds of other nasty things. No one will mistake Cox or any other port 25 blocking ISP for being spam friendly.

It's not about getting the spammer. It's about PREVENTING spam in the first place.

You can't spoof an IP connection for anything more than one way communication. SMTP requires two way communication. Spoofing the IP for that purpose results in no mail sent. The word you're looking for is "proxy."

And how does not blocking port 25 prevent using proxies to spam anonymously?

If you don't want the ISP monitoring your e-mail usage use a third party e-mail server that accepts connections on an alternate port or find a new ISP or pay for the ability to have port 25 open.

"To me this has sounded good but never adds up if you spend a moment thinking about it."

Next time, try 5 minutes.

Ben

Re:Um...no

[maximilln]

-----
It's not about getting the spammer. It's about PREVENTING spam in the first place
-----
I've heard this argument before and it's not working.

We can't prevent murder by regulating guns. That feeds the black market in firearms. We can't prevent assault by regulating knives. Regulating knives would be a nasty blow to any illusion of a free society.

Blocking port 25 to prevent spam as a preemptive measure isn't working. It's feeding the industry in underground spam and it's leaving a bad mark on any illusion of free computing.

I'm not paranoid about my ISP monitoring my email. They can monitor me all day long. What I don't like is my ISP raising rates so that they can pay some high school dropout to stalk me when I start emailing my date plans to girlfriends (I'm a geek, it doesn't happen often, but it could). In all reality my ISP doesn't need to watch me. If the guy next door starts sending spam from his computer then it's easy enough for the ISP to start watching/tracking him without blocking port 25.

Am I to believe that ISPs don't have bandwidth monitors and triggers on every active connection? Puh-leez. What would the IC cost to do such a thing? $0.05/pop to see a burst of activity that isn't associated with loading a Star Wars page?

-----
"To me this has sounded good but never adds up if you spend a moment thinking about it."
Next time, try 5 minutes.
-----
That is inconsiderate, disrespectful, and flamebait--especially since blocking port 25 has not prevented spam at all.

Re:Um...no

[KalvinB]

"That is inconsiderate, disrespectful, and flamebait--especially since blocking port 25 has not prevented spam at all."

Didn't you tell me it only took a moment to think to realize *I* was wrong?

I gave you five minutes. Don't tell me you're going to cry now.

"especially since blocking port 25 has not prevented spam at all."

It's blocked 100% of spam that would have originated from servers running on computers connected to an ISP that blocks port 25.

It's very effective. What did you expect? That spam would dissapeaar?

Should you just litter since you not littering doesn't accomplish anything in the grand scheme of things anyway?

"If the guy next door starts sending spam from his computer then it's easy enough for the ISP to start watching/tracking him without blocking port 25."

Once he's sent out the e-mails the damage has been done. It's a PREVENTATIVE measure.

Again, stop crying and realize that the moment you took to _know_ *I* was wrong wasn't enough time to really think about what the block is trying to accomplish to realize it's a very effective measure.

You didn't even know the uses and limitations of IP spoofing. What makes you think I think you have any credibility in this regard?

Especially considering I'm behind a port 25 block and think it's a great idea and that more residential connections should have that port blocked.

Just like littering, no one person solves the whole problem. Everyone just does their part. Cox is a major ISP and it's one that is of no use to spammers. That is a major accomplishment.

Again, take five minutes and THEN respond.

These "moments" you take obviously aren't enough.

Ben

Re:Um...no

[maximilln]

-----
It's blocked 100% of spam that would have originated from servers running on computers connected to an ISP that blocks port 25
-----
Which is 0.00000001% of the total spam anyways. No one in their right mind actually sends spam from their own smtp server on their own machine. No one has sent spam from their native localhost since the earliest days of spamming USENET. Everyone knows that it'd be too easy track. Spam originating from port 25 hasn't been an issue for nearly a decade and ISPs first started blocking off port 25 in the last year or two (at _most_). The real reason is because they want an excuse to run a filter on the ISP smtp relays and justify the purchase of a few new pieces of hardware to handle it. There is also the promotion for the idiot-stick yuppie admin who proposed the ground breaking idea of port 25 blocking. Puh-leez.

The only spammers that you're going to catch by blocking port 25 are the little old grandmothers who've pieced together an e-mail list so that they can sell their hand-made Christmas tree ornaments. Who are you really targeting?

There is no real reason to block port 25 unless you're a pitiable control freak who obsesses about watching your neighbor. Nonconsentual voyeurism is also illegal.

Yes it is the way the internet is supposed to work

[twitter]

That's exactly the problem. Mail is not supposed to be transmitted from any IP host to any IP host.

Bullshit, that's exactly how the internet is supposed to work. What's the difference between your computer and a MX? There does not have to be any and it's not hard to run one. Exim practically configures itself.

what if the recipient's workstation is off? What if the recipient uses several different computers (devices) to access their mail?

Ieeee! Why use your "workstation" when there's a perfectly good, dependable 486 lying around? Mine never goes down, except for power failure and it did great as a mail server until Cox forbade such things and blocked ports. I did not bother to set it up as a smart host to send out mail from all my workstations because it was much easier to set them up to send directly. I keep and read all of my mail on one machine that I get to through ssh with X forwarding internally. I use fetchmail to get mail to it and I can get my mail securely anywhere in the world via ssh. It's not hard, I'm not a wizard and that's the way the internet is spposed to work - a network of peer computers all equal.

If you would accept anything less for yourself than you expect for others, you are a slave.

Re:A new low- but, but

[gosand]

I thought you were going to say RIAA, but organized crime works too.

I thought you were going to say "US Politician".

Oh, that is what the first poster said. Sorry.

sure we can blame M$.

[twitter]

Of course it's the software! Blaming the user is lame.

As others have pointed out, this attack vector isn't persea the software that user is running. The attack vector is the user, the old PEBKAC (Problem Exists Between Keyboard and Chair), which has been showing up as the resolution to many tickets in our troubleticket system.

I'd hate to be resolved by your company.

The problem is no matter what we do, we can't prevent our users from shooting themselves in the foot.

Do you have exploits available for mutt, kmail, mozilla mail or pine? Bill Gates would pay you good money for that. No? Oh well. A small amount of user education, the variety of free software and free software's far superior security models would stop the wholesale abuse of the internet that M$ crap enables. Users have to go therough lots of trouble to set up the kinds of junk that M$ enables without ANY user intervention.

Of course a big admin like you would never have to wipe an reload a machine, now would you? Ha, blame the user for having abused the poor little box. Give me a break. Clicking widgets on the world wide web should not be able to destroy a users machine.

Re:sure we can blame M$.

[doon]

Probably going to regret this... but I'll bite

Of course it's the software! Blaming the user is lame.

How do you figure? This could easily have been done against *nix, MacOS, etc.. Once you get the user to run a program, all bets are off. Heck I could write a shell script that would send itself to everybody. all the tools you would need pretty much get installed with your default Linux install. find and mail come to mind. While I would love to blame $VENDOR we hate today, this is a user issue

I'd hate to be resolved by your company.

We provide 3rd level tech support, so if it comes to us, and there is nothing wrong with our equipment/network/software, and it is 'cause the user did something apparently suicidal (read format c: on Win32, rm -rf / on *nix, etc...) What can I/us do about it. Short Answer: nothing. The reason for the problem was not us, it was user related.

Of course a big admin like you would never have to wipe an reload a machine, now would you?

Have I? Yes. Do I have to anymore, no. There is a reason I am as you said "Big Admin"

Ha, blame the user for having abused the poor little box. Give me a break. Clicking widgets on the world wide web should not be able to destroy a users machine.

I agree 100% with you, and specifically didn't want to get in an argument about software/Operating Systems, I was just saying that this specific exploit/virus/malware required human interaction. It didn't exploit any specific vulnerabilites in outlook/windows. If someone would write a shell script to do this, and get the user to run it the same thing could happen on *nix. I am only blaming the user for not knowing enough about the what they are doing.

neural nets are no P2P

[just fiddling around]

Don't throw concepts you don't know just because the seem to fit the space. What you just said amounts to saying "use a bayesian filter to distribute software".

Neural nets share absolutely no common features with P2P networks. Neural nets are an AI technique that takes inputs and learns what are the correct outputs like natural neurons do. Thus, you can use a neural net to filter your mail, but not to distribute knowledge, or data, or software.

Aside from that conceptual mistake, using geographically distributed clusters of servers to keep sites working is a good idea, esp. if you expect a slashdotting(or DDOS).

Re:neural nets are no P2P

[Angram]

I did not say to use a neural net. I said to use a neural net-like system. I wasn't implying that the system should learn, I was basically saying that we should apply the concepts of information distribution and graceful degredation (which are emergent properties of neural nets). Also, I never said they shared features with P2P networks.

Economically? I say escalate in meatspace

[Anonymous Coward]

Bullets in the head. They won't think they're so cute WHEN THEY ARE DEAD!

Completely OT

[WinDoze]

I'll get modded down, but I'm really curious here. From your sig:

What part of "shall not be infringed" is so hard to understand?
Do you ACLU?

I assume the first part is referring to the Second Amendment ("...the right of the people to keep and bear arms shall not be infringed"). The second part, interestingly enough, refers to the ACLU, whose mission is to tirelessly and unfailingly defend every single Constitutional Amendment... except the Second.

I'm not trying to be a pain in the ass here, I'm honestly interested because as much as I want to, I can't support the ACLU due to their selective Amendment defense. You seem to have no problem with it. Is there something I'm missing here? I hope you respond, I'm sincerely curious.

Re:Completely OT

[smaug195]

I think the reason they are not defending the second is that it is the one that is vastly open to interpertation. Free speech, means free speech. The second could be interperted to mean arms for a militia.

Re:Completely OT

[macdaddy]

I have to agree. Here's where I stand: I support what the ACLU *is* doing but I also wish they were doing more, specifically supporting the 2nd Amendment. Still, I feel that even though they don't do much with the 2nd, they still do a lot of good with all the others. There are few institutions out there actively doing something to protect our civil liberties, let along being fairly successful at it. I think we should all support the ACLU for what it is doing, even though we also wish they did more. That's my viewpoint in a nutshell.

Re:Completely OT

[WinDoze]

Fair enough, thanks for responding. I pretty much feel the same way, and your sig piqued my interest. Perhaps one of these days I'll break down and write them a check. As far as I know they're not anti-Second Amendment, they just take no stance on it.

Re:Completely OT

[macdaddy]

I've been a member at the minimum for a year or maybe two now. I figure when I have a better financial foothold I'll donate more. Every little bit helps though.

You have never opened ONE email?

[Anonymous Coward]

Shit, I have. I was curious. I even visited a site once or twice becase I am a curious bastard who will try most anything one. The idea of FREE FUCKING PORN is waaaay to good to pass up, even if I have a pretty good idea what I am really getting.

Re:Why not just go with their model, at least..par

[Animats]

I was planning on doing just that when California's new anti-spam law turned on in January. But Congress legalized spamming last week (S.877), and now it's hopeless.

RFC on Spam Alert

[RealProgrammer]

Note: this document is available here.

I believe it's possible to defeat spam on the Internet. It will take some bitter medicine, but I think it would help a lot more than it would hurt.

Anti-spam efforts historically have focused on alleviating symptoms. We've mostly used a "greedy algorithm", trying to limit spam's effects on the local environment, hoping that this will change the global situation. It obviously has not.

Spam is an error condition, and should be treated as such. It should not be ignored, but ruthlessly searched out and debugged. We should not distinguish between hardcore professional criminal spammers, 'legitimate email marketers', unwitting ISPs, or unfortunate virus victims who send spam. All are generating errors, and the problem should be debugged and eradicated.

The optimistic nature of SMTP allows the spam error to occur. Spammers send thousands of messages at a time. No response to a message means to the spammer that the address is viable. A bounce message means the address should be culled from the spammer's list. The protocol design thus assists the spammer in his work.

The method I propose should cause spam to reflect back as close as possible to the sender, while removing the ability to improve his list from response data.

RFC on Spam Reduction

Compliant MTAs must honor an email header "X-Spam-Alert".

The format of the header is

X-Spam-Alert: yourhostname.message-id-you-sent

where yourhostname is the SMTP server's name and message-id-you-sent is the message ID as it appears in the headers that server sent.

Spam alerts must be addressed to 'abuse@servername'

On receipt of a message containing a valid "X-Spam-Alert" header, the spam alert may be delivered to 'abuse'. The MTA must then remove all references to the previous alerting site and forward a new spam alert to the next server listed in the headers. If the alert indicates that a spam message originated from this server, the spam alert must be delivered to 'abuse', and the site may also choose to notify the user who apparently sent the original spam message.

On receipt of a message containing an invalid "X-Spam-Alert" header, the MTA can do any of

1. deliver the message to 'abuse'
2. send a standard bounce message
3. silently drop the message.

How Spam Alerts are Generated

Sites have considerable latitude as to their definition of incoming spam. Spam detection must be done by the MTA, and should also be done by individual users (with the help of anti-spam filters). Some mandatory spam indicators are DNS errors (No DNS entry, PTR/A mismatch, etc.). Other techniques for spam detection (e.g., use of blacklists, content pattern matching, invalid sender or recipient address) may be used.

The spam alert must not indicate whether or not a recipient address is valid.

Users with anti-spam filters may generate spam alerts. A user-generated spam alert may arm the spammer with more information, by letting him see which messages are returned with spam alerts and how.

Sites may set limits on the number of spam alerts they will send.

WHY YOUR ANTISPAM IDEA WON'T WORK

[MillionthMonkey]

(Inevitably, in every thread about spam, someone proposes a solution with one or more flaws. This is a handy form that passes the lameness filter and that can be reused for all such posts to save time! It does not specifically address all possible flaws and may be expanded in future versions.)

Your post advocates a

( ) technical ( ) legislative (x) market-based (x) vigilante

approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which vary from state to state.)

( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
( ) Users of email will not put up with it
( ) Microsoft will not put up with it
(x) The police will not put up with it
( ) Requires too much cooperation from spammers
(x) Requires cooperation from too many of your friends and is counterintuitive
( ) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business
( ) Ideas similar to yours are easy to come up with, yet none have ever worked
( ) Other:

Specifically, your plan fails to account for

(x) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
(x) Asshats
( ) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
( ) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
(x) Extreme profitability of spam
( ) Joe jobs and/or identity theft
( ) Technically illiterate politicians
(x) Extreme stupidity on the part of people who do business with spammers
( ) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook
( ) Other:

and the following philosophical objections may also apply:

( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
(x) Countermeasures cannot involve wire fraud or credit card fraud
( ) Countermeasures cannot involve sabotage of public networks
( ) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough
( ) Other:

Furthermore, this is what I think about you:

(x) Nice try, dude, but I don't think it will work.
( ) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your house down!

Re:WHY YOUR ANTISPAM IDEA WON'T WORK

[Anonymous Coward]

Excellent post! Funny and informative.

Re:WHY YOUR ANTISPAM IDEA WON'T WORK

[Anonymous Coward]

Informative? This reminds me of the Bad Post Troll.

Re:WHY YOUR ANTISPAM IDEA WON'T WORK

[$ASANY]

Your "arguments" are unpersuasive, although I'll accept the "Nice try, dude, but I don't think it will work." comment. When a spammer sends me an email inviting me to visit his site, I don't usually get a qualification of how many times or with what technology I'm allowed to do that. Kinda shoots the laws/police argument.

If you have anything better, I'd welcome criticism I can make use of.

At this point, "nice try" is a good start. Total and complete victory is something I can be patient for...

Re:WHY YOUR ANTISPAM IDEA WON'T WORK

[MillionthMonkey]

When a spammer sends me an email inviting me to visit his site, I don't usually get a qualification of how many times or with what technology I'm allowed to do that. Kinda shoots the laws/police argument.

I think you got confused. The parent post I was replying to had this proposal:

Harvest credit card numbers (with matching delivery and billing addresses, and often with matching CVV's) on one spammer's site, and use them on another's.

You are not the author of that post. Your idea is a simple DDoS attack. These are the boxes on that form that I would check in response to you:

(x) Eternal arms race involved in all filtering approaches
(x) Extreme profitability of spam
(x) Requires cooperation from too many of your friends

You are making the filtering their problem instead of yours, but this is merely equivalent to playing white instead of black. The arms race will continue as they develop filters that defeat your DDoS attacks, the same way that they develop DDoS attacks that defeat filters now.

I doubt your DDoS would make a dent anyway. The profit margin is too high to water down that way.

Re:WHY YOUR ANTISPAM IDEA WON'T WORK

[minas-beede]

(Inevitably, in every thread about spam, someone proposes a solution with one or more flaws. This is a handy form that passes the lameness filter and that can be reused for all such posts to save time! It does not specifically address all possible flaws and may be expanded in future versions.)

Fantastic. Rate proxypots, dude.

http://world.std.com/~pacman/proxypot.html

P.S. Proxypots have been used and have worked. Something more will be needed to combat spam zombies but at least one person (the author of the proxypot above) has figured out one Trojan and faked a zombie. If you don't already know Ron Guilmette got over 100 spammer accounts terminated in under 3 months using a network of proxypots to fgather the needed evidence you may not know enough to do an accurate rating - but give it a try anyway.

Re:WHY YOUR ANTISPAM IDEA WON'T WORK

[Random832]

About that form... where can i find it? if it's something you just use for yourself you should do the work i was going to do on an improved version on your own: make it use html

• elements instead of ascii checkboxes
  • like
  • this
  and removing the unchecked ones, to make for an easier read.

Subject line "passwords"

[Anonymous Coward]

My suggestion is to simply set up your e-mail
filters which only accepts e-mail that contains
a unique word in the subject line (something like
"knot_from_sp4mmerz), and automaticly deletes
the rest.

Re:Subject line "passwords"

[Anonymous Coward]

Wow, that's brilliant Brain! Did you think of that one all by yourself!

Wait a minute.... Is this a cut and paste?

[Anonymous Coward]

MAPS? From what I understand they are dead.

From your post you are implying that they are running an extortion scheme. Do you also claim this about the free ones?

Last question, are you a wacked spammer? There seems to be growing number of astroturfing attemps by them on slashdot lately.

Stop sulking

[DABANSHEE]

We all want the web to be above national legislation & if that's the case we should stop sulking & adapt to the realities this implies.

Meaning taking personal responsability & modifying our computers with code that protects our computer from undesirable code we openly chose to expose our computer to by chosing to go on-line

It really is so simple.

Actually AFAIC even computer viruses shouldn't be banned - IMAO by chosing to go online with a windows computer one is by default chosing to expose one's computer to viruses. One should accept that fact & adapt. Why the business of zeros & ones going up & down cables is the business of govt is beyond me.

Re:A new low- but, but

[PW2]

I thought you were going to say "US Politician".

Oh, that is what the first poster said. Sorry.

I thought you were going to say something insightful or funny.

Oh, I was wrong. Sorry.

Serves the greedy buggers right

[DABANSHEE]

Invaribly these scams rip off those who are so greedy that they put their greed before commonsense.

Anyone sticking their life savings into a get rich quick scheme deserves to be ripped off.

It's called karma

Felonious?

[ThisIsFred]

This goes a bit beyond annoyance, wouldn't you say? This is actually organized crime. Is this the first public example of someone using a virus/trojan to commit a crime?

Easy to answer

[Anonymous Coward]

The spammers are all personal friends of President Bush and have promised to "deliver Ohio" to him in the next election.

Besides, Bush probably gets a cut.

civil suit

[CAIMLAS]

I wonder if this might be grounds for spamhaus to file a civil suit against microsoft for producing products that are allowing their competitors easy access to illigally take them out of business.

Re:civil suit

[Anonymous Coward]

now THIS is an interesting legal precedence.... Perhaps you might want to join the SueSpammers maillig list.... suespammers-request@spamcon.org
which is having some really interesting discussions on all the bad things you do to these dirty rotton spammers.

How do I get in on this?

[Electric Eye]

I get god-knows-how-many pieces of spam shit per day. However, it's obvious that people ARE buying penis pills and the like. So, how do I get in on this gig and cash in?

PS: I hope all these spammers and their families get anal cancer and die horrible deaths in a car fire or picked apart by vultures.

Re:This is NOT coming from SPAMMERS!

[Zeriel]

That would be the spammers and the people who are making money from hosting spammers.

And funny how only one of the blacklists (SPEWS, I think) is really heavy-handed, while the others are very reasonable...yet all get attacked.

I don't buy your premise.

UNreasonable...

[Anonymous Coward]

I think it's unreasonable to lump all the spammers into one category. For all we know, this virus could be the action of one lone spammer, and all the others wouldn't want this to happen (i.e., not all spammers wants to be associated with such horrible things).

You're making a common mistake, in assuming all spammers have those characteristics, when in fact, that is not necessarily true. Granted, they are unethical and annoying. But this does not mean they are Satan. Most of them are humans like the rest of us, trying to make easy money.

Well for God's sake, man

[duck_prime]

The fact that Anti-Spam sites are now being targetted makes it that much better because those sites have actually caused me a lot of personal headache by labeling me as a spammer even though I've never touched the stuff in my life!! I've sent countless emails explaining to them that they have no proof or reason to even remotely believe

Er ... I think you may have touched on the actual problem here.

Just stop sending emails like this:

"Dear Sir or Madam, I am not a spammer, you've got to believe me. For the [100234]th time, please take me off your blacklist. Do you have any idea who I am? I am, in fact, the nephew of deposed Nigerian minister Nbuko Mdebele, and ..."

Will impact repeat spammers customers.

[Anonymous Coward]

There are some spammer customers that would be affected by this. Mortgage refinancing, for example, requires a lot of capital and isn't fly-by-night. If the refinancing spam could be stopped, that's a big help to me.

Would it kill all spam? No. But it might be effective for many kinds of spam, and that's enough for me.

And supported by the powers that be

[TheBaker]

Microsoft, AOL and the Federal Government.

Why did the Feds decide on such lighthanded legislation against spam?

The legislature obviously feel that SPAM is provided by the people for the people....
Just like our founders intended.

Because it overrides, stricter, state laws.
that may cause problems for MS and AOL etc.
Why was there no public review?
There was...you were represented by MS and AOl.

MMmmmmmm...

[Anonymous Coward]

Organized Crime

This worm is compatible with your system.

[tepples]

The majority of people are reading their email on desktop systems with high resolution colour graphics, so why shouldn't emails be able to take advantage of these capabailities?

Because minorities have rights as well. Not everybody reads e-mail on a desktop system; many read e-mail on handheld devices. In addition, not everybody can get broadband.

there shouldn't really be any difference between an email body and a document.

Problem with your reasoning is that less clued people hear "document" and think .doc, the extension of Microsoft Word's secret format. Ecch.

surely it is better to have one single database of contact information that any compatible application can share.

What prevents a worm or other spam trojan from registering as such a "compatible application"?

Alan Ralsky

[mackermacker]

Nice article, credits /. readers for signing up the king of spam on every possible mailing list, and publishing pics of his new wonderful 800k house, with his special basement where he controls 80 email servers over 14 countries, blah blah.
http://blog.beebware.co.uk/archives/000133. html

Ye Gods!

[filmsmith]

How do you get anything done with all that added effort?

This is precisely why we're losing the battle to clean our Inboxes. We shouldn't have to go through so much effort (and I do have SOME effort in verifying junk safely) just to see if a piece of mail is safe. This is almost akin to getting mail bombs in your physical mailbox each day. Is it a real package? Is it a bomb? I don't know, but this FedEx box does look authentic...ka-boom.

Fortunately, the consequences aren't as dire as that, but the lost money mentioned in another post is still pretty dire. My time is $50 an hour (and that's cheap!) and I would certainly like to be billed for all of the hassle of having to 'deal' with spam.

fs

p.s. And what REALLY chaps my hide is that all of my effort is reactive instead of proactive.

Re:Ye Gods!

[LuxFX]

Yeah, but I only have to verify one email every four or five days, tops. I can tell with just about all of them. What I don't understand is how people go through their blocked spam every few days looking for false positives. I get about 600-700 spams a day, and block a percentage somewhere in the mid-to-low 80s. There's no way I could go through thousands of spam like that! If it's been blocked, it's as good as lost, for better or for worse.

p.s. And what REALLY chaps my hide is that all of my effort is reactive instead of proactive.

HEAR, HEAR! My biggest gripe as well.

not a user issue.

[twitter]

This could easily have been done against *nix, MacOS, etc.. Once you get the user to run a program, all bets are off. Heck I could write a shell script that would send itself to everybody. all the tools you would need pretty much get installed with your default Linux install. find and mail come to mind. While I would love to blame $VENDOR we hate today, this is a user issue

It is much harder to do this on a Unix type system. Most reasonable mail clients won't load html off the net and those that do typically only run Java, nice and sandboxed. A shell script would have to have it's mode changed before it is run. Neither could be disguised as a text file and there is no brain dead "name.exe, pif, com, bat, etc" that will automatically run as root on Unix type systems. These differences are Microsoft's work and they are to blame for user and internet community suffering. They are traps for the type of user that is Microsoft's stated reason to exist, but they can not be avoided by anyone. There is nothing you can do for your users who use Microsoft junk regardless of their skill level. Microsoft's own networks get blown out by their own software. Do you think anyone can do better? Should we blame the users on Microsoft's own campus? Why is it that we don't hear similar stories at Apple, Sun or any large free software deployment? It's the software, not the users.

Left?

[Anonymous Coward]

What, do you kick left-footed like some sort of commu^h^h^h^h^hterrorist? Or do you use it for leverage to extract the right boot from the back of their heads?

Re:Why not just go with their model, at least..par

[NadMutter]

That's exactly what I do.

MBNA have a system called "shopsafe" (www.mbnanetaccess.com) which permits generation of one-time or multi-use cc# with preset limit and expiry date.

Every on-line retailer I use gets a different card #. Any weird charges - it can be traced to which retailer it was used for.

Also I can kill a single card individually while keeping my main account active.

For those sites that want a cc# for verification purposes (not porn - free email addresses etc), I generate one with a $1 limit with a 1 month expiry date (and disable it the next day).

spammers' weak point - credit card companies

[tomato]

Spammers do indeed have a weak point. They are dependent on procesing their payments via credit card companies.

I once tried to set up an online business that would accept payment via credit card. To set up a trading account, you have to jump through all sorts of hoops and rules. It's not cheap or easy. The credit card comapnies cheak who you are quite rigourously before they will give you a business trading account.

Part of their rules is that the trader must clearly identify theirself/the business when making a sale.

There are only a very few credit card companies - amex, visa, mastercard, mbna, that covers about 80% of the market.

I'm not quite sure how to go about informing the credit card comanies that you have received an illegal credit card payment request. Perhaps you could send the spam to them, or the url of the actual webpage where it asks to fill in your credit card numbers.

For the desperate, you could actually pay something, maybe using a spare card that you never use, then at once inform the credit card company of the situation, requesting a refund, and giving them relevant details, e.g. the website with the unlawful request on it, so that they will place a black mark against the trading account of the spammer.

Too many of them and they will close his trading account. With the resources that credit card companies have for checking on background, its gonna be bloody hard for the spammer to reopen new acocunt, especially as lying for the purposes of getting a trading account is something that the police take REALLY seriously...

(close your card or keep an eye out for any further withdrawals from your account and instantly notify the credit card company - they will then know the spammer's been passing around your details and have his address on file - more charges for the police to use)

What do you think of this method?

-tomato

Re:spammers' weak point - credit card companies

[Anonymous Coward]

> What do you think of this method?

nice try, but no banana...

If we *knew* for a fact that the credit card company was itself spotless then just maybe it would work. But I can tell you from personal experience that our company had several charge reversals from end clients. A couple were lagit, but about a half dozen were generated from inside the credit card companys Discover and American extress. As a matter of course we called the customer to ask what the problem with the order was. In something like 6 of these cases the customer told us that they loved the product. We of course asked them why they reversed the charges, and they were amazed. In a couple of these cases, the customer wrote letters to us and even included their credit card statements to show that they never received the chargeback. Long story short, the money was never found -- the credit card company denies everything...

If someone has *inside connections* they can hide the transactions... So, nice idea, but I doubt that it would work in practice.

hmmm, on the subject of things to hate...

[quantum_gate]

a few things I reccomend to anyone who ever has any contact with the internet:
1. Dont open unsolicited e-mail at any official e-mail address (work/family/etc.. e-mails).
2. Stay away from spam-friendly sites like Yahoo
3. READ EULA's TO SEE WHAT YOU ARE INSTALLING (AND ASSUME THAT WHATS IN THE EULA IS A BEST CASE SCENARIO)
4. Pretend the internet and computers are like anything else in life. i.e. dont attempt to fix your car brakes unless you know what you are doing OR are prepared for the possible eventualities.
5. Protect those "uneducated" people you know from themselves!!! (after all, if you help others avoid proliferating spam/viruses/etc.. you are helping yourself as well)
6. Vote in favor of the punishment "drawn and quartered" for offenses of Identity theft, Credit card fraud, Spam, and any association with child porn.
7. Work voodoo magic against anyone who associates with or likes "Gator".!!!!!!!!

why innocent victims?

[alizard]

The ROKSO list of top 200 spammers is readily available at spamhaus. Anyone on it can be considered guilty. Information on how to find them is readily available from the list entries.

And is there anyone around here who will return any vote other than "innocent" if he/she is a jury member in a trial of someone who did physical harm or damaged the property of a major spammer because he is a major spammer?

Re:why innocent victims?

[Anonymous Coward]

[And is there anyone around here who will return any vote other than "innocent" if he/she is a jury member in a trial of someone who did physical harm or damaged the property of a major spammer because he is a major spammer? ]

If the victim is a spammer then the defendant is automatically innocent evenn if proven guilty IMHO.

soft drugs probably the biggest profit center

[jamiefaye]

Viagra, hydrocordone (Vicadin), Valium, etc. are easy to get from spam pharmacies, they charge a credit card and ship FedEx, so its consumer-friendly. (If the deal fails, you file a complaint with your credit card company and get a refund, and FedEx is a good escrow agency).

They just change a huge markup 10mg/500 of generic Vicadin for about $200. Profit: about $180. Its also stronger than Morphine and just as addictive. Just the thing for a doctor to do for a few months before retiring or having his license pulled.

-- Jamie

Re:soft drugs probably the biggest profit center

[jamiefaye]

Oops - screwed up the Vicadin units.
$200 gets you 90 pills of 10 mg generic hydrocodone mixed with 500mg of acetaminophen (Tylenol). Thats a little over $2 a pill, and you can sell them to your junkie friends for $5-$10. (Assuming you are willing to commit both state & federal felonies doing so).

Valium/diazepam is about $4.25 per pill for 10mg, and Viagra is usually $5-$10 each.

Linux variant?

[Anonymous Coward]

Just yesterday I received the noted CD child porn email. I figured it was SPAM and was thinking about best action (such as calling my credit card company and notifying them that my card may have been compromised...)

I work almost exclusively on Linux. Can the worm affect Linux or is it M$ specific?

Can someone post a URL for information on the worms, detection, and eratication...

No way!

[iamacat]

Do you really want insurance companies to get your money in one more way or snoop on your computer? You must really love your car and health insurance bills. Given only two choices, I would rather tolerate some spam. My company's and yahoo filters are doing an excellent job recently.

Quite frankly, it IS terrrorism

[coinreturn]

Hijacking computers, destroying data, disrupting communications, intentionally inflicting mayhem - making people FEAR mail attachments, etc.

It probably would work

[Tau Zero]

I doubt your DDoS would make a dent anyway. The profit margin is too high to water down that way.

The economics of spam are based on the infinitesimal cost of sending each one vs. the large profit from each response. While illegal, the use of harvested CC and contact data would have the effect of driving up the cost of each valid response. With typical 0.01% response rates, it would be trivial to DOS the spammer with hundreds of times as many bogus responses as real ones. At even a few cents per response to verify, the spammer's profit margin would be negative; end of problem.

The legal way to do this is with something like FormFucker, but it will probably not take long for spammers to get lists of legitimate CC card blocks to mechanically verify card numbers (to use one example). Re-using real information is immune to that workaround.