Spamholes Fighting Spammers

mike9010 writes "A person named I)ruid has come up with an ingenious way to combat those spammers. His program, spamhole, creates a false 'open relay' that the spammer thinks he/she can send messages through. The messages then get sent nowhere, and the spammer has no idea. "spamhole is an open project. Hopefully, through user's and developer's contributions, we will amass a collection of spamhole implementations spanning all commonly used platforms, programming languages, etc. Ease of configuration and use are the primary objectives, for the easier to use by the non-techical layperson the implementations are, the more widely adopted and used spamhole will become.""

Comments

How can this work?

[corebreech]

Spammer will just send email to himself to make sure relay works. The author claims that the defense against this is to allow the spammer limited access in the beginning, but there's no way to uniquely identify the spammer, and in any case, the spammer can just continue to include himself in the mailings, so he'll know when the relay has been configured to deny him access.

This system will only increase the number of open relays out there.

The story of the hare and the briar patch comes to mind. Is this the idea of a spammer who is pleading with us to please not create all these open rel..., er, um, spamholes?

Re:How can this work?

[Amiga Lover]

As the article says


When an SMTP client connects to our spamhole, we note the number of times it has connected before. If this number is below a configurable threshold, we simply redirect it's connection through the spamhole to a real SMTP server and allow it an unmodified session. This provides for any potential 'test' email the spammer may attempt to send through the 'open relay' to verify successful delivery to successfuly pass through the system and be delivered. Many spammers do this to validate their open relays prior to attempting bulk mailings. The downside to this is that a few SPAM emails may actually be delivered by your spamhole. Such is the price to pay for tricking the spammer into continued use of your 'open relay'.


So it's not quite just a dumb smtp receiver, but acts as a real one until the spam starts being sent.

Re:How can this work?

[Anonymous Coward]

If Spamholes became widespread they would become their own downfall.
If only a low rate of emails are allowed through, then surely a spammer could send only a few mails to a huge amount of spamholes resulting in the same amount of spam being sent out??

Re:How can this work?

[B1ackDragon]

They're been relying more and more on trojan'd XP machines as well, they'll probably just stick to this method because they can have more machines than they ever wanted, and they can be sure it works (for some time at least.)

It makes me sort of sad. I'm in a unix sysadmin class, and we had a guest speaker in from a major ISP the other day, and to quote him "we've seen our email traffic quadruple over the last year, all spam" "spam is killing the internet."

Doubt if its as bad as all that, but again, the internet would be a heck of a lot better without it.

Re:How can this work?

[Anonymous Coward]

Spammer will just send email to himself to make sure relay works.

Most spammers use automated tools to fire off a huge amount of messages. They wouldn't likely bother with sending a message to themselves.

But if the spammer did decide to validate the server, it means he has to find another open relay. If there are a ton of spamholes out there, and few real open relays, then the spammer will have to waste an enormous amount of time searching for a relay he can use.

This system will only increase the number of open relays out there.

How is that? The spamhole isn't relaying anything... that's sort of the point.

Re:How can this work?

[rf0]

If the spammers just bounced of a number of open proxies and keep rotating around them I can see how it will just become worse.

Rus

Re:How can this work?

[kinnell]

but acts as a real one until the spam starts being sent

Yes, but if the spammer sends test emails alongside the spam, they won't get through, and he will know it's a spamhole. This system will likely work well until the spammers realise that it is being used, after which it will be easy for them to hack their way around it.

Re:How can this work?

[Anonymous Coward]

Sophisticated spamware sends periodically control messages to a dropbox in hotmail/yahoo/whatever and alerts user if the open proxy appears not really working.

Open relay isn't the problem of net anymore, sophisticated spamware uses open proxies.

Open relays are these days hard to find as most smpt software ave sane defaults these days. OTOH With idiots like analogX proxy authors creating proxies with "default open world wide, not even dangerous ports closed" configuration, there is no sortage of open proxies.

If you really want to blackhole/track open proxy/relay abusers, look at BuggleGum proxypot instead. And prepare to hack it as as spamware tries to adapt the traps setup by people.

Re:How can this work?

[arcanumas]

So, if it will allow a few "tests" to go through, i am afraid that if it were to become popular then a spammer could use many many different servers to send his spam. A few mails each.

Distriuted spamming of some kind :)

Re:How can this work?

[KDan]

Most spammers use automated tools to fire off a huge amount of messages. They wouldn't likely bother with sending a message to themselves.

Actually I would think any half-arsed spam tool will periodically send messages to itself to check that the relay is still working... So this spamhole idea, while neat, won't work with any but the most basic of spammers.

Daniel

Re:How can this work?

[the_mad_poster]

Doubt if its as bad as all that...

I don't. Spam eats up bandwidth just being delivered, even if it gets filtered at the end anyway. Then, you have the idiots that sit and open it and wait for images to load in their HTML-enabled mail clients. Despite this, from a technological standpoint, although it chews up and wastes valuable resources, it won't bring the Internet to a complete screeching halt.

However, look at all the time and money AOL puts out trying to block incoming spam. People always talk about making spam unprofitable for the spammers and someone invariably bitches about the ideas put forth, but how long will it be until there's so much and so varied spam that it's unprofitable to allow users to use e-mail? Eventually, we may well need so many people and tools that it will chew away profits just fighting spam.

That's why I think spammers need to be treated exactly for what they are - a parasitic infection. They just chew up resources but provide nothing in return. They must be inoculated. Make sending unsolicited e-mail a crime (our illustrous guvmint morons took a step in the totally OPPOSITE direction with their "yea, let's legitamize spamming" bill yesterday). If you're convicted of sending mass, unsolicited messages (that is, you can't prove that you were given EXPLICIT permission to send them), make it a felony and make one of the required sentences that you're not allowed to ever tough a computer again. The trick after that, of course, is to get all the spammy Asian and S. American countries to go along and punish spammers as well.

Re:How can this work?

[Anonymous Coward]

It won't work, so instead of commenting on it, I will propose something new. We have tons of ways to know something is spam, but we just block it when we can. Some have suggested that we reply to spam, so spammers have to sift through more responses. I think we should combine these 2 efforts, and create a distributed spam clogging system. When you recieve spam, a window pops up with many possible replies to the spammer, submitted by other users. You pick one you like, edit it slightly, and send it in. In the case of bad return addresses, it posts the question to the web server of the spammer, loads (but doesn't display) their web page (the amount of times you specify) to waste bandwidth, and things like that. Lets turn this into a war. We can destroy this business model!

Re:How can this work?

[Urkki]

• I don't. Spam eats up bandwidth just being delivered, even if it gets filtered at the end anyway. Then, you have the idiots that sit and open it and wait for images to load in their HTML-enabled mail clients. Despite this, from a technological standpoint, although it chews up and wastes valuable resources, it won't bring the Internet to a complete screeching halt.

Don't count on it. There are worms that spread to create spam relays, and then those relays send spam. Potentially this leads to exponential growth in traffic...

Re:How can this work?

[Anonymous Coward]

I agree that open relays are hard to find these days. A few months ago I did some research into an open relay DOS described here:

http://slashdot.org/comments.pl?cid=5410886&sid= 55 502

Out of the thousands of candidate relays that I tested, only a tiny handfull seemed to be open. I never proceeded beyond the scanning stage because there just weren't enough, and there are ethical issues too...

Re:How can this work?

[zerocool^]

This system will only increase the number of open relays out there.


Plus, for some of the more nazi-esque spam block lists, it can cause MAJOR havoc for your network. I can tell you that this will not be implemented on our network. We've delt with this already... One computer on our network had an open relay for a couple of days, and it caused *.rr.com (road runner cable, HUGE ISP on the right coast) to block ALL MAIL from our /24. It was horrible, we have hundreds of customers who could not get email from us or their clients.

And it was pulling teeth to get us off of that block list. Send email, get response "contact your ISP", sent email explaining we were the ISP, got email "contact your ISP", sent email madly declaring that we can fix it if they'd tell us what was wrong, but with more than 100 computers in that IP range, it was kind of hard to tell who was in trouble, got email "contact your ISP"... etc.

I'm NOT going to put anything on the network that deliberately sends spam, or even looks like an open relay. My business is too important to me.

Thanks, but, no thanks.

~Will

Re:How can this work?

[Anonymous Coward]

And those spammers will always use the same IP address (or same IP address block) right? WRONG. This project is really a lot of misaimed effort.

Re:How can this work?

[glassesmonkey]

Talk about arms race.. Now spammers will maintain blacklists for spamholes!

Re:How can this work?

[Anonymous Coward]

Talk about arms race.. Now spammers will maintain blacklists for spamholes!

They already do, and they do for proxy "holes" as well.

Re:How can this work?

[pipingguy]

Spam eats up bandwidth just being delivered, even if it gets filtered at the end anyway

Yeah, but just think of all the extra bandwidth we'll have once UCE, viruses and scammail are finally banished by the Spamish Inquisition (nobody expects the Spamish Inquisition)!

Re:How can this work?

[OYAHHH]

I'm,

Not so sure that Asian and S. American countries contribute much to spam.

I noticed a SIGNIFICANT decrease in the number of spams I received over the Thanksgiving holidays. Do asian countries celebrate Thanksgiving also?

Re:How can this work?

[vawlk]

Then I wonder why I still get 10s of thousands of attempted relays every day on my 8 user mail server. Most spammers aren't that sophisticated and just use published lists of open relays.

Sure there are high tech spammers, but wouldn't a reduction of 10% of spam still be a good thing?

Sitting here watching the spam pile up won't make it any better.

Re:How can this work?

[sLaSh_N_bUrN_(.Y.)]

When has ALL (I mean every last one) other countries ever agreed on anything? If there is just one country that does not agree, passing a law would only effect you and me.

I guess we could just black list that country, but then some good people will be unhappy.

Re:How can this work?

[Anonymous Coward]

Two years ago i placed a fake formmail script on my website. Since then i've had over 100,000 emails attempted to be delivered through it. Sure, it's but a trickle in the grand scheme of spam, but it's a trickle worth stopping.

Re:How can this work?

[Anonymous Coward]

So if there are 9,900 spamholes out there and 100 true open relays, the chances of a spammer picking a spamhole on their first shot is 0.99. Now after a short while, they realize it's a spamhole so they move to another "open relay". Now they have 9,999 choices, of which only 9,899 are spamholes. Their chances of again picking a spamhole is 0.9899 (repeating) and so the chances of them hitting a spamhole on both of their first attempts is 98%.

Now consider a spammer who's hit 100 spamholes searching for the real open relays (this will happen about 36% of the time in this example -- still better than a third of the time.) They've wasted a decent amount of their time trying to send their spew through the spamholes, and they've still got a 0.98 (repeating) chance of hitting another on their 101st chance, assuming they continue.

This system would work not by making it impossible for spammers to find open relays, but by making it improbably for them to do so and therefore forcing them to do more work.

Re:How can this work?

[Marcus Brody]

This is a total Arms Race.

The initial test email would highlight the spammers test email address. All email to this address would then be allowed through the spamhole, giving the impression to the spammer that everything is hunky dory.

However, the spammer may use multiple test addresses, and the spamhole would not then be aware of these.

Therefore the spamhole could check for any addresses that were used frequently/periodically, and mark these as test addresses.

But the spammer could use a more complex set of test addresses.

The spamhole could use a combination of Bayesian filtering with Hidden Markov Models to renumerate potential test addresses with exponentially decreasing returns, such that the k-tuple value Z1 was never equal or above the Nth degree of reductionist SPAM (SPre). This would thus allow network strategist to implement a theory-based approach to network spam usage, thus continuing ad-infintum the ARMS RACE.

The result of this is that both spammers and anti-spammers remain in bussiness, spending exponentially increasing efforts attempting to thwart the efforts of the oposition.

Definition of a game: "A constructed conflict with quantifiable outcomes"

Ever get the feeling that the anti-spammers enjoy this whole malarky just as much as the spammers?

Maybe the answer to spam is this:

STOP wasting money and resources on using incresingly sophisticated anti-spam techniques. Re-direct this money into basic education for users, including short courses on:

1. How to identify a spam (People are proven to be far better at pattern recognition than Bayesian models).

2. How not to click on a spam.

3. How to delete a spam.

If AOL, MSN, and all other involved parties put a concerted effort towards this, then spam would soon get diminishing returns, and hence become increasingly unprofitable.

Re:How can this work?

[Anonymous Coward]

How the hell is this 'Informative'? It doesn't quote anything new from the article that wasn't already acknowledged by the GP poster.

Re:How can this work?

[Syberghost]

Spammer will just send email to himself to make sure relay works.

Yes, and then when all the spamhole users compare the addresses attempted to send through them, they'll have a valid email address for the spammer.

Re:How can this work?

[letxa2000]

So what? This is news? People have been opening up "black hole" open relays for spammers for years.

Re:How can this work?

[FiloEleven]

How about redirecting money into the hiring of Hit Men to get at the root of the problem? After two or three spam queens get knocked off, I think it may dawn upon the rest that spamming isn't such a good idea anymore...

Re:How can this work?

[ATMAvatar]

How hard would it be to modify the program so that any emails sent to the originating address go through?

Re:How can this work?

[Morosoph]

Yes, it's an arms race, but each new level makes things pricier for the spammer, making the model less tenable.

IMO, we should ramp the race right up, and make email encrypted by default. Think of the CPU cycles required to send every recipient encrypted mail!

Okay, that seems excessive at present, but this is a "tax" that cannot be ducked. Naturally, the problem remains that such a solution would in fact be illegal in France, and so might be impossible to implement.

Re:How can this work?

[defile]

How about redirecting money into the hiring of Hit Men to get at the root of the problem? After two or three spam queens get knocked off, I think it may dawn upon the rest that spamming isn't such a good idea anymore...

This is probably what it's going to come down to. But think ahead. Once spamming becomes this dirty a business, the only people fit to do it will be the mob. And no one wants to mess with the mob. :(

Re:How can this work?

[Marcus Brody]

Taking these thoughts further, 99% of spam bussiness is based around "Trolling for Newbies".

We have to think outside the box with the spam problem, and this fact may be a novel way to counter spam. Almost all people i know who have been "conned" by spam had been new and naive email users who had got excited becuase they had recieved email.

We may look down on such users, but we were all naive once, its just that spam wasnt around when most of us lot started using email.

Therefore, I suggest, all email services should provide a useful "introduction to spam" tutorial BEFORE users are given an email address.

Re:How can this work?

[Anonymous Coward]

It would be nice if webmail services has an option "Bounce this message", so the spammer will receive more and more bounces of actually good accounts.

Think about...

on yahoo mail "This message wasn't for you? Is it SPAM? _Bounce it_."

Re:How can this work?

[eugene ts wong]

Please don't interpret my question as argumentative. I'm asking because I'm not as technically inclined in the area of relays & mail servers.

Why don't people publish fake email address lists? This reminds me of that plum killer spam thing, where it would allow spambots to harvest fake email addresses. Isn't it possible to distribute fake lists?

Re:How can this work?

[Darth23]

I saw going to suggest a bullet in the brain myself, though I think some broken bones might work as well.

Re:How can this work?

[InadequateCamel]

I think it is definitely that bad. In the last few months I have noticed a large increase in loading times at home. Even the university connection is slowing down...

Re:How can this work?

[msgregory@earthlink.]

Maybe the answer to spam is this:

STOP wasting money and resources on using incresingly sophisticated anti-spam techniques. Re-direct this money into basic education for users, including short courses on:

1. How to identify a spam (People are proven to be far better at pattern recognition than Bayesian models).

2. How not to click on a spam.

3. How to delete a spam.

I think you're underestimating the difference in the average computer user between the strength of will to intelligence and the strength of belief in something for nothing by a longshot.

Re:How can this work?

[Markaci]

STOP wasting money and resources on using incresingly sophisticated anti-spam techniques. Re-direct this money into basic education for users, including short courses on:

1. How to identify a spam (People are proven to be far better at pattern recognition than Bayesian models).
2. How not to click on a spam.
3. How to delete a spam.

Add to that 4. How not to give your email address to spammers.

We have to protect our email addresses. The email-obscuring feature on Slashdot is one way to do so. Another is to teach users that not all websites which request your email aren't going to use it to send spam.

For further reading, "Why Am I Getting All This Spam?"

Re:How can this work?

[_anomaly_]

...yeah, because having a turkey dinner and laying around for a few hours watching football is going to cause spammers to take a break from what they do best. get real, you think the major spammers only do so "hands-on"? yeah, ok...
maybe they use cron or just maybe they even let their applications that search for relays and send their spam run continuously!?!

Re:How can this work?

[Anonymous Coward]

The worst part; people running the spamholes can use them to collect email addresses that the spammers are sending to.

Re:How can this work?

[b0d0]

Naturally, the problem remains that such a solution would in fact be illegal in France,

the french getting all the spam?

i could live with that! :-)

Re:How can this work?

[cyberchondriac]

Maybe the answer to spam is this: STOP wasting money and resources on using incresingly sophisticated anti-spam techniques. Re-direct this money into basic education for users, including short courses on: 1. How to identify a spam (People are proven to be far better at pattern recognition than Bayesian models). 2. How not to click on a spam. 3. How to delete a spam.

Forgive me, but educate end users ? Not being facetious, but it sounds like you haven't worked in an IT position that requires much contact with the end user :-). That's pie in the sky, most end users won't learn because they simply aren't motivated to.
I'm often (well, not so much anymore) amazed by the almost hostile response I get from end users when I've offered to show them a tip or shortcut - they often feel that they can barely remember how to do what they're doing now much less add more to their repertoire; it's not that I'm rude or condescending around them, and I try to make my enthusiasm contagious, but they just don't have the interest.
Naturally, there are always some who are eager to learn and pick things up quickly, but I've found that they don't fit the title of "end user" for long, those people usually have an affinity for IT and progress into an IT based role sooner or later.
I think the biggest piece of the SPAM problem is that people actually buy from the spammers, knowing full well that it's spam ! How do you stop that ?
The first step is getting people to care, then maybe, just maybe, they can be educated on the technical aspects.
What we need to do is raise awareness that SPAM really is harmful to the health of the internet, and show how that affects the costs of ISPS and other services that create a domino effect of higher costs out in the "real world".
Basically, tie the big "E" word (Economy) to it, and people will listen !

Re:How can this work?

[AuMatar]

Except that the mob has better ways to make money. One drug deal gets more money than weeks of spamming.

Re:How can this work?

[Anonymous Coward]

It would be nice if webmail services has an option "Bounce this message", so the spammer will receive more and more bounces of actually good accounts.

I used to think this was a good idea, but almost all return addresses are not to the sender. Just ask anyone who has been Joe-Jobbed.

Re:How can this work?

[elemental23]

Apple Mail already offers this, but I think it's a bad idea. Spammers often use forged return addresses. They'll usually pick one at random off the list they're sending the spam to, so bouncing the mail will most likely only annoy the person whose address was used.

Re:How can this work?

[beebware]

And how many times is the From: header correct? I've been joe-jobbed myself in the past (where a spammer has faked my domain name in the headers) and woken up to over 10,000 "Message to spammers@target.tld is undeliverable" style messages.

Re:How can this work?

[frazzydee]

It won't increase the number of open relays- it'll just make more fake ones- which is a good thing (for users)! I don't think that the spammer would include his own email in the mailings, however, or else people could easily trace who the mail came from.

Re:How can this work?

[Anonymous Coward]

Yes, but if it's only the "mob" is involved, think of how much less of an ethical challenge it would be to kill or torture them, their spouses, children or immediate relatives to "send a message" about their spam. Complete proactive genocide sounds like an excellent deterrent. Given how few spammers it takes to create so much havoc, we long ago passed the economic benefit/cost ratio for summary, extra-legal executions. Perhaps the time has finally come?

Re:How can this work?

[focitrixilous P]

It would be nice if webmail services has an option "Bounce this message", so the spammer will receive more and more bounces of actually good accounts.
Because forged from fields are impossible, right?

Seriously, a 12 year old could code a php script to spam anything with a forged from field.

Re:How can this work?

[haraldm]

STOP wasting money and resources on using incresingly sophisticated anti-spam techniques. Re-direct this money into basic education for users, including short courses on:

Right, and maybe educating congressmen as well.

But while we're at it - why don't we set up a couple of opt-out master servers where users can send their spam, and some mechanism (maybe human) picks out the opt-out URLs. Users could then enter their e-mail address and spammer's e-mail addresses (they need to use real addresses now, right?) to have them sent to all the opt-out URLs automatically. Well, I would not send my address there, honestly. But I think this idea is fun, and far more reliable than the do-not-email-list that will never work. Because if it did, CAN-SPAM lost its primary purpose to legitimate and promote spam.

Far more fun than setting up more open relays. Although CAN-SPAM explicitly forbids the use of open relays now. But since an individual can't sue, this is bogus.

postscript: CAN-SPAM is an interesting, and unintendedly ironic name for a law that is supposed to limit the amount of spam. Another good example where corporate America eats up the world's resources.

Re:How can this work?

[OYAHHH]

Just one point on the curve. Take it anyway you like.

But on Thanksgiving Day I saw zero spams and the day after about two.

I usually get about 15 to 20 a day.

Re:How can this work?

[Anonymous Coward]

Not to mention the number of servers that will get Blacklisted because they seem to be a relay server. This will stop a lot more legitimate email than it will SPAM.

Re:How can this work?

[Imperator]

No, that's a terrible idea. I'd wager 99% of the {From,Reply-To,Return-Path} email addresses in spam are fake. I know this because my address has been used as the From: address in several spam mailings. I typically find out about it when I get a deluge of NDNs from yahoo.co.kr or something. Encouraging bounces like this would only increase the proportion of SMTP bandwidth used up in relation to spam. It's far better to just /dev/null the spam than to bounce it.

Re:How can this work?

[Anonymous Coward]

"it caused *.rr.com (road runner cable, HUGE ISP on the right coast) to block ALL MAIL from our /24."

But some of the *.rr.com are a bit anal and put a block in place even if they only half suspect something. I had email forwarded to my *.rr.com account that suddenly started bouncing, because the /24 of the forwarding server was blocked. It was quite a big provider of websites and email services that was blocked. When I contacted rr.com to ask to remove the block, they did respond within hours and told me that they had removed the block, because their log didn't contain any information why the block was put in place to begin with... Translation: rr.com has a rogue admin around who enters blocks when he feels like it with no specific cause...

Re:How can this work?

[gilgongo]

STOP wasting money and resources on using incresingly sophisticated anti-spam techniques. Re-direct this money into basic education for users, including short courses on:

While I agree with your "arms race" analogy, you completely miss the point with your answer to the problem.

Spammers spam because they MAKE MONEY DOING IT. The way they make money is to generate actual sales (or traffic, or leads etc.) from the spam. This means that a tiny minority of people LEGITIMATELY click on the links! The cost to the spammer of sending out 10 million emails is so low that even if it converts a handful of sales they can turn a profit.

So unless you're confusing spam with worm/virus infected email, then educating users to recognise spam would do utterly naff all to cure the problem.

Re:How can this work?

[Anonymous Coward]

Now, why would the big ISPs want to do that?

How many years now have spammers run rampant at UUnet? How many years have spammers had free rein at AT&T and Sprint? For just one example, Sprint has been the bandwidth provider for the Rackspace.com spamhaus for four years now. And how many years has MicroSoft allowed spammers to run wild all over their bCentral.com service? How many years now have Hotmail and Yahoo.com been the favored drop boxes of spammers? Don't try to tell me that Bill Gates doesn't have the money for a decent abuse staff Hotmail.

I don't think the big ISPs WANT to fix the spam problem, because technical fixes that would almost eliminate it already exist (hello, SPEWS, hello, Vipul's Razor, hello, open proxy blacklists). Do you think that perhaps pink contracts are so profitable for the big ISPs that they're willing to throw more hardware at the mail load it creates?

If I were a conspiracy theorist, I'd be wondering right now if the big Old Media companies that bought up so much of the Internet during the dot-com boom had something specific in mind for all of us. I'd be wondering if there were an unspoken agreement between all the rat-bastard greedheads at AOL/Time Warner, UUnet, AT&T, Sprint, and all the rest.

It wasn't just DMA money that bought the new Federal "YOU CAN SPAM" law; the DMA is small potatoes, they don't have the money to get Congress to sit up and beg like that. Do you think maybe MicroSoft and AOL/Time-Warner spread around plenty of "soft money" campaign contribution money to buy it, too? The campaign contribution records won't be updated until election time but I think looking at them would be enlightening--and M$ and AOL/TW did send representatives to the Congressional hearings, to speak on behalf of the finished form of the "YOU CAN SPAM" law. Do you wonder why the nation's biggest ISPs wanted Congress to pass a neutered, powerless, unenforcable "anti-spam" law that not only won't slow Alan Ralsky down one iota, but also overrides considerably stricter state laws, laws that had actual teeth, like California's, which might have had the power to make a difference? I wonder too. And I think I know why.

I suspect that they WANT spammers to ruin email for everybody. Maybe they WANT email to be useless, because destroying email opens the door to greater profits for them. Maybe, just maybe, the bewildering array of instant messaging software and text messaging software for cell phones that, you may have noticed, has all appeared almost simultaneously, is an effort to get people to ditch email altogether.

My prediction is that the business model for Internet communication is already changing, first from "email is free" to an "instant messaging is free BUT we get to shove gigantic ads in your face while you use it AND we will sell your personal information and address to our 'marketing partners (you know, legitimate businessmen like Eddy Marin)'" model, then a "We swamp your connection with pop-up ads while you use it AND sell your address to Alan Ralsky unless you pay extra fees every month to be a Premium Luser," then finally to the business model that greedhead rat bastards REALLY love, the "We shove ads in your face AND you pay through the nose for the privilege AND we sell your address to spammers" model, which is how cable TV works now.

Notice how many big cable companies like Comcast and Verizon have made themselves ISPs. This is the business model that they created, remember. This is how they've done things for years and years.

Are Alan Ralsky, Tommie Cowles, Eddy Marin, Scott Richter, and all the rest of the thieving sociopathic spammer scum being allowed deliberately to turn email into a smoking hole in the ground, so you'll have no alternative but to become an AOL SuperDuperUltraMegaPremiumPlatinum member for $199.99 a month plus $10.49 an hour just to keep in touch with Grandma, if you can find her message under the blizzard of pop-up ads?

Re:How can this work?

[JumperCable]

How about something a bit better than that? There always seems to be some idiot out there that is tempted to buy one of their products or services (otherwise they would not put forth the effort).

So we need to put out some Public Service Announcements about the real dangers of responding to spam i.e.
- credit card theft,
- bank account theft,
- identity theft,
- malicious web code,
- spyware,
- malware,
- viruses,
- trojans etc.

Now I know most of us (I hope) are smart enough not to order something from some unkown company that doesn't even want to list a phone number or mailing address. But I think there are several novice & young users out there who don't quite fully understand.

There are plenty of horror stories out there. I say we need to collect some video of explaining how they got scammed and what happend to them. Add these videos to some of our websites and make it a giant public service campaign against spam.

Spam won't stop until we get the idiots to stop buying their products.

Re:How can this work?

[DuckStorm]

You're making this much more complex than it needs to be. Here's the simple approach: + Create a spamhole. + Since this it won't be a legit SMTP server, nobody but spammers should be using it (especially if they attempt relay). + Every time someone attempts to relay through your spamhole, report it to a central internet blacklist. + After the central blacklist gets X reports, the ip attempting to sendthrough the spamhole is labeled as a spam host or relay. + You never have to let email through the hole, so there is zero risk of getting blacklisted yourself. In other words, use the spam holes to detect spamhosts rather than to waste their time. Sure, they can still go about detecting these spamholes and avoiding them. But in the process of doing so, they'll already have gotten that probe host blacklisted. And then they won't know of the server rejected them because they are blacklisted or because it was a spamhole. The spammer simply won't be able to tell. Easy as pi.

Re:How can this work?

[Popageorgio]

Wired ran a graph that showed how spammers can profit from 1 buyer in every 40,000 failed spams. Run public service ads like "When you buy from a spammer, you choke the internet." Like "when you buy drugs, you support terrorists," but more honest, like "when you buy oil, you support terrorists."

Re:How can this work?

[Marcus Brody]

Amen.

Re:How can this work?

[oobar]

...And with that statement you demonstrate a total lack of understanding of how email works. As the other posters have said, all you'd be doing is bothering some innocent person whose email address the spammer decided to place in the headers.

Who modded this garbage up?

Re:How can this work?

[vldmr_krn]

Spammers don't care. I had an email address which I nuked due to a spam problem. I revived it several months later because I had used it on some website and forgot my password, and during the time I had the address alive, I received more spam to it than at any such time period before nuking it. So months of bouncing messages didn't result in spammers discontinuing sending to that address.

I don't think this will work..

[bonez_net11]

This sounds like a pretty interesting project. One question though, what happens when the spammers themselves get word of this? They will just relay a message through each open relay they find to an account they can check, to see if the message went through. If the message doesn't go through then its a 'blackhole' relay and they will find another one. I just don't see something like this working. Maybe it should save all of the spam and use the messages to update spamassassin filters or something like that. Otherwise it'll be useless. Just my thoughts.

Re:I don't think this will work..

[milosoftware]

But what if there are millions of these spamholes? That would give em spammers a lot of trouble finding the real holes out there.

No place to hide a diamond like in a pile of glass sherds. Finding the diamond is slow and painful work...

Re:I don't think this will work..

[cgranade]

Stopping spam is never the point of any prudent anti-spam action. Instead, anti-spam actions work by reducing the value of spam to spammers. This can be done by reducing click-through, reducing traffic and filtering that traffic which is out there. Always, spam will get through. The only way to combat spam is to reduce the profit margin and increase the time expense so much that it is worthless, and simply bad business to spam.

Re:I don't think this will work..

[bonez_net11]

Yes, that is true. BUT, it would be quite easy to write a script that sent itself messages through a relay, then when/if the message is recieved it would start spamming and sending itself a message every 10 or 50 times or so. If messages start getting lost it would mark that relay as dead and move to the next one. After a few people write this script (there are always many) it would work like clockwork and nobody would really even notice it happening. Remember, there is always a work-around.

Re:I don't think this will work..

[AndroidCat]

Relay honeypots (spamhole??) usually have to play a careful game: Pass the single test message by the spammer checking to see if it works, but block the spam run.

There's endless debate about where to draw the line on email relaying between none and some.

Re:I don't think this will work..

[Frisky070802]

One question though, what happens when the spammers themselves get word of this?

Oh, you mean like when they read about it on Slashdot?

Re:I don't think this will work..

[Anonymous Coward]

> One question though, what happens when the spammers themselves get word of this?

What, you mean *right this minute*, as they read Slashdot?

You hear the same attitude when watching TV shows about crime. "The criminals don't know this". Uh huh?

Re:I don't think this will work..

[lynx_user_abroad]

If the message doesn't go through then its a 'blackhole' relay and they will find another one.

You give up too easily. If even one message gets through, you've at least found a system which is not firewalled-off from sending email. Root the system and install a custom SMTP agent and ignore the fact that it also runs a spamhole. At the very least, a system running a spamhole is a better target than your average box, because you know it can send mail.

Re:I don't think this will work..

[Pedersen]

then when/if the message is recieved it would start spamming and sending itself a message every 10 or 50 times or so

And then, as an added bonus, spamhole could be written to watch for these email addresses. Now we've got a real email address for these bastards...

Re:I don't think this will work..

[RobertB-DC]

reducing the value of spam to spammers. This can be done by reducing click-through, reducing traffic and filtering that traffic which is out there.

That points to an interesting idea. What if you left your relay open, but modified the messages slightly? Munge the URLs, kill the scripts and web-bug images, change all the phone numbers to 800-876-7060. You could even try to de-l33t the subject lines (turn V*1*A*3*R*A back into "viagra"), if possible.

Of course, you'd be violating any number of standards, plus you'd still get blackholed. So take it a step further... create a trojan that looks for open relays and turns them into spam-breaking open relays. Maybe you could then get someone to turn you in to Microsoft and split the reward.

Re:I don't think this will work..

[Savagemutt]

Spam isn't the problem. Fraud is the problem. Legitimate companies don't send spam (or if they do, they usually learn their lesson). What's left is the criminals peddling worthless herbal cures, penis enlarging regimens and committing outright con games like the Nigerian spam. So lets spend a bit more money in the short term on law enforcement. Let's follow the money and put these scumbags in jail. Once the two bit operators understand the seriousness of their offenses, I think the volume will fall off dramatically.

Ok. So it won't stop the garbage coming from countries too poor or too indifferent to enforce the law, but it would help a great deal.

Re:I don't think this will work..

[techiemac]

Ahh but what about this...
Keep a table of all the email that gets sent out. Use some sort of algo to determine the spammer script address (i.e. similar address n times with x distribution, relay email, else don't)
Spam script writers will get smarter but this is reality. We can adapt. There's more of us than there are of them.

Re:I don't think this will work..

[Smallpond]

Yeah. The address will be ajksajkshs@yahoo.com, now what?

Even if the spamware doesn't detect this now, it will by tomorrow. As a mail admin, I current use 2 RBL blocklists, + hardcoded addresses for serious offenders telesp.net.br and shawcable.net + Bayesian filter. I still get spam in my inboxes.

Spammers aren't stupid, just evil.

Re:I don't think this will work..

[fubar1971]

They will just relay a message through each open relay they find to an account they can check, to see if the message went through

RTFA

From spamhole.net:
When an SMTP client connects to our spamhole, we note the number of times it has connected before. If this number is below a configurable threshold, we simply redirect it's connection through the spamhole to a real SMTP server and allow it an unmodified session. This provides for any potential 'test' email the spammer may attempt to send through the 'open relay' to verify successful delivery to successfuly pass through the system and be delivered. Many spammers do this to validate their open relays prior to attempting bulk mailings. The downside to this is that a few SPAM emails may actually be delivered by your spamhole. Such is the price to pay for tricking the spammer into continued use of your 'open relay'.

The thing that concerns me, is how much of my bandwidth is going to get chewed up receiving all of this spam that does not go anywhere. I mean it is a great idea to trick the spammers, but it is till going to cost me money in bandwidth.

Re:I don't think this will work..

[glassesmonkey]

The obvious trouble with this, is spammers will re-double their efforts and send twice and much traffic if filters reduce their spam by half.

Re:I don't think this will work..

[Anonymous Coward]

There's more of us than there are of them.

Exactly. If that weren't the case, they would stop sending spam. :)

Re:I don't think this will work..

[ceejayoz]

Easy solution for the spammers - their spamware will send out a test e-mail every 1000 or so spams and check that it went through.

Spammers may be obnoxious, but they're not all stupid. They'll figure something like this out pretty quickly.

Re:I don't think this will work..

[Zutroi_Zatatakowsky]

But still, that's 1,000 spam emails into /dev/null. Making the spammers waste a few thousands emails every day due to spamholes is still a small victory.

Re:I don't think this will work..

[ceejayoz]

Making the spammers waste a few thousands emails every day due to spamholes is still a small victory.

So's winning fifty cents in the lottery.

Re:I don't think this will work..

[Anonymous Coward]

Just changing links would be a great boon.

First, it would go largely undetected by spammers. They would have to check their 'test' email to make sure all the links lead to the right place. This is something they may overlook, as long as the 'test' email LOOKS fine.

Then, assuming they send the spam, all the links people get are fudged. So, the spammer can get no business, and they still have to pay for all the bandwidth all the images use up, as well as the bandwidth they use to send the spam in the first place, with ZERO response.

Now what we need is a virus to attack open relays and modify them in this way.

Re:I don't think this will work..

[mikewolf]

i think what would be better would be to convert the email to text only and strip all of the graphics...
then spammers wouldn't be able to have web images in there HTML email that validate email address, and most users wouldn't care enough to copy and paste a url into the querystring...
better yet, convert all of the HTML into its HTMLEscaped equivalent, so that people see all the html markup and can't read it!

Re:I don't think this will work..

[autopr0n]

But what if there are millions of these spamholes? That would give em spammers a lot of trouble finding the real holes out there.

Then spammers would send millions of "test messages" that are actually Spam.

Re:I don't think this will work..

[beebware]

Alas, sending the same email to 1000 email accounts will probably take just a few seconds on a standard ADSL connection nowadays :(

Re:I don't think this will work..

[lynx_user_abroad]

I'm curious; was this moderated a Troll because:

1. the moderator believed SPAMMers are too dumb to figure this out themselves, and was trying to prevent them from seeing it,
2. the moderator figured only a SPAMMer would be smart enough to spot this weakness and I must, therefore, be a SPAMMer who deserves to be moderated a Troll
3. the moderator is a SPAMMer who understands how valuable it would be to have thousands of systems deployed like this, and marked this post as a Troll to prevent the spamhole authors (or potential users) from realizing how such a system makes them more vulnerable.

Re:I don't think this will work..

[Zutroi_Zatatakowsky]

Yes, if the ticket costed you $0.05. ;)

Re:I don't think this will work..

[Zutroi_Zatatakowsky]

But let's say it takes "average" people 2 seconds to open an email and figures it's spam. Well, you just saved 2000 wasted seconds from innocent people! Wooo! This should be a Scout Badge! :)

Re:I don't think this will work..

[beebware]

Believe me, I've just received over 2,500 spams in a little over 3 hours so I want to everything possible against spam. Unfortently, most of it is directed at my "main-been used for 7years+" nodename on my ISP so it's very hard for me to "drop" those mailboxes and I can't do any server side filtering (even though I've got my own server in a datacenter with SpamAssassin on it). Coming home to 10,000+ emails everyday isn't fun - even with my automated "kill spam scripts". Blarg :(

Re:I don't think this will work..

[Anonymous Coward]

Mortgage spammers work for banks, which are as legitimate as it gets. There's nothing ethical about it, but they're certainly legitimate. And then there's Kraft, with its never-ending Gevalia Kaffe coffee maker spam campaign.

I'm not worried about lowlifes in Nigeria. It's simplicity itself to cut Nigeria (or China, or South Korea, or...) off from the rest of the Internet until they clean up their problem.

I'm concerned about "legitimate businesses" seeing the "YOU CAN SPAM" law as a green light to mailbomb every Internet user on Earth with thousands of "great new mortgage offers" and "amazing coffee maker" and "Jim Nabors sings Christmas songs" spams an hour. You know the evil greedhead rat bastard marketing departments are already salivating over the possibility.

Nice spinoff...

[Glock27]

Now I've got some new invective:

Stick it in your spamhole, pal!

Perfect...

Re:Nice spinoff...

[nickyj]

I thought that my bosses mouth was a spamhole. I guess I was wrong.

Re:Nice spinoff...

[Channard]

Now I've got some new invective: Stick it in your spamhole, pal! Perfect...

Perhaps some sort of joint business venture with the Goatse guy might be in order. Spamhole T-Shirts, maybe?

Re:Nice spinoff...

[chiller2]

Wow! Minutes elapsed and no goatse link yet. People must be busy today

We're talking about spamholes, not assholes but then again, they're evidently both willing to accept as much 'mail' as the spammers can supply ;)

Re:Nice spinoff...

[Glock27]

I thought that my bosses mouth was a spamhole. I guess I was wrong.

Which orifice it happens to apply to is only obvious through context, for instance:

Shut your spamhole!

That's equally acceptable...and you'll keep 'em guessing that way... ;-)

Re:Nice spinoff...

[lylfyl]

Stephen Hawking: "I call it a Hawking Hole."
Fry: "No fair! I saw it first!"
Stephen Hawking: "Who is the Journal of Quantum Physics going to believe?"

Does it help?

[ObviousGuy]

Wouldn't a law making spam illegal and punishable offense be more effective?

Re:Does it help?

[Leffe]

Nope, but having Al Gore block all foreign hosts would prove quite effective. Especially if all countries did the same, and additionally issued spam laws.

Of course, this would only hurry WW3 up.

Re:Does it help?

[FatAlb3rt]

only until it all goes offshore.

Re:Does it help?

[AndroidCat]

It might, but the US got the CAN-SPAM law instead.

Re:Does it help?

[Steve Cox]

> Wouldn't a law making spam illegal and punishable offense be more effective?

In which country? All of them? Making spam illegal and punishable in just a few countries will barely dint the tide of spam arriving in our inboxes.

Re:Does it help?

[Steve Cox]

> only until it all goes offshore.

It already is. I live in the UK and the majority of junk emails I receive come from the US, or contain 'offers' from US based companies.

Re:Does it help?

[Steve Cox]

Hmmm. Actually got hung up on a sore point after deleing loads of crap emails wanting $$$ rather than for products this morning.

I kind of missed out the point that a large portion of junk emails originate from servers in the Far East already so from your perspective (presumably US perspective, since you said 'offshore' without thinking) it already happens.

Re:Does it help?

[FatAlb3rt]

since you said 'offshore' without thinking

mmm...ok. whatever.

offshore, regardless of perspective, pretty much means "not here."

Re:Does it help?

[SuperMo0]

Wouldn't a law making spam illegal and punishable offense be more effective?

But then people wouldn't be able to learn about the wonders of wang and bust enlargement! O_O

Re:Does it help?

[armando_wall]

It's been offshore for years.

I've received spam from the US here in Venezuela. I got friends in other countries (Spain, Norway, Denmark, Argentina), and they've received spam from the US as well.

Re:Does it help?

[TiggsPanther]

I also find (or did a while back) that a lot of Spam originated in Taiwan.

I just started auto-killing anthing from .tw (or, at least from @yahoo.tw).

Re:Does it help?

[smpierce]

What's really required are laws that attack the advertiser and not the spammer. The laws probably don't even require a criminal penalty, a substantial monetary penalty would have a greater effect.

The point of spam is to make money. If you assure that spamming is a loosing proposition (say a mandatory $100,000 fine per email), you can be certain to take the profit out of spamming. The fine must be substantial enough that everyone gets the point that spamming is the quickest way to bankrupt your company. Once the profit is gone, so are the advertisers. Once there are no advertisers, the spamhouses of the world will follow quickly.

I realize that this will only effect companies in the US, but from what I can see, the spam may be coming from elsewhere, but the companies are largely US based. Force them back to legitimate advertising methods and the spam problem will be greatly reduced.

Re:Does it help?

[Hoser McMoose]

Only if the law is enforced. Just look at all the fraudulant spam, the unlicensed pharmacies selling prescription drugs, the scams, the bestiality porn, etc. etc. that gets spammed to us now. Most spam is already blatently illegal, but as long as the law is not being enforced, it isn't going to help anything.

That being said, I really doubt that this spamhole project is going to help much either. Open relays are so 1990's for spammers! These days it almost all comes through open proxies. A similar project that used open proxies might be more effective, though it would need to do a little bit of trickery (ie pretending that the receiving mail server is accepting the message while not even trying to connect to said server).

That being said, I'm not sure that more open proxies on the internet is what we need, regardless of any good intentions behind them.

Re:Does it help?

[Lord Apathy]

Make spam an act of war punishable with a 20 megaton fine....

Re:Does it help?

[ceejayoz]

20 megatons per e-mail?

Ouuuuuuuuuuuuch.

Re:Does it help?

[mikerich]

It already is. I live in the UK and the majority of junk emails I receive come from the US, or contain 'offers' from US based companies.

Dropping a hydrogen bomb on Boca Raton, FL. would cut my inbox by half.

I'm sure its a very nice place - warm, sunny and everything Britain isn't in early December, but first of all it gave us the IBM PC and now spam.

You don't think Buffy put the Hellmouth on the wrong coast do you?

Best wishes,
Mike.

Re:Does it help?

[mikerich]

Make spam an act of war punishable with a 20 megaton fine....

Bye, bye Boca Raton, FL.

Best wishes,
Mike.

Re:Does it help?

[singleantler]

Thing is, you'd have to prove the advertiser wanted it sent out, otherwise a competitor could pay for spam to be sent out in a company's name so they get banned. This means if someone's good at covering their tracks, they can still spam and take the orders off the back of it.

Also many, many spams are for scams. Who are you going to fine when the people mentioned don't exist, and the websites are all controlled in countries which don't particularly care if people are getting ripped off or not, as long as the hosting bills are paid?

Really, the answer for this, as several others have mentioned, is to stop people clicking on spam and ordering things. Once orders are down, people won't use it any more.

Re:Does it help?

[Anonymous Coward]

presumably US perspective, since you said 'offshore' without thinking

You're a whiny cunt, aren't you?

Re:Does it help?

[beebware]

Try - most of the spam I receive is routed through/has sites hosted on servers in China (china-network.net IIRC) but if you trace things back, you'll find out the spammer him/her/themselves are actually in the US. What you've got to remember is the goods have got to be shipped from somewhere and the credit card debited from somewhere: both of which will give a physical address.
Hang on - I've just had a brilliant idea. Let's start buying stuff from spammers on our credit cards - and a week later getting our CC companies to issue "chargebacks" and we can quite legitimetly claim that the advert was fradulant ("it claimed it came from billg@microsoft.tld who I trust, but I've since found out that's faked"): high number of chargebacks=spammers merchant account yanked. Of course, this does however mean giving your CC details to somebody you do not trust....

Sounds good

[johnburton]

It's not a cure but it's another small tool which might help a little.

Re:Sounds good

[Seraph]

It's not a cure but it's another small tool which might help a little.

I have some spam which promises to remedy that!

Spamming method

[rf0]

This is not a bad idea though it could be abused. However what the author doesn't seem to realise that open relays may only account for 25% of spam. The rest comes via open proxys which mask the connection and mean that the mail server is receiving an SMTP session from a valid IP address. It might help a bit but at the end of the day the only good solution to fix spammers is hit them where it hurts in the pockets.

Of course that is easier said than done

Rus

Re:Spamming method

[Mirk]

at the end of the day the only good solution to fix spammers is hit them where it hurts in the pockets.

Well, I'm told hitting them in the kneecaps can be quite effective too.

Re:Spamming method

[rf0]

Kneecaps are to quick and not painful enough. You want something more drawn out. Prehaps electrodes attached to the testicals

Rus

Re:Spamming method

[swordboy]

Alternatively, you could hit their house. It really is amazing that a spammer would use their home address to register their spam business. In case you were wondering, the delivery joints in this area won't deliver stuff to this address anymore. Mr. Ralsky apparently didn't pay for *any* of the last 500 large with pineapple and andchovie pizzas that were ordered.

Re:Spamming method

[Anonymous Coward]

I hear hitting them in the sack is even better.

Re:Spamming method

[Zocalo]

Kneecaps are to quick and not painful enough.

It's slow and painful enough if you do them from behind with a drill like you are supposed to, but if that's not good enough, then there is always the power sander for the truly discerning and sadistic knee capper. Of course, if anyone can provide some spammers, I'm sure there will be no shortage of volunteers to perform the necessary testing to provide some empirical evidence...

Re:Spamming method

[AllUsernamesAreGone]

But not quite as effective as tying them up underneath a rocket engine.

Re:Spamming method

[herrvinny]

I wonder if I can "borrow" one of those newfangled tactical nukes you can fit in a briefcase.... I think everyone agrees that a tactical nuke would be useful against this location....

Re:Spamming method

[Anonymous Coward]

While electrodes to the testicals has its merits kneecaping is a time honored tradition. I thik that traditionally a 45 is used but a 9mm should do nicely.

It's really simple ritual you see. You just ask them thier name, when they answer you blow both kneecaps out. The you inform them of their crime. Simple. The good part about this is causes lifelong injury and pain giving them a good reminder for the rest of their lives where thier error in judgement was.

Of course dragging them from thier homes, setting fire to them and dragging them down screaming donw the street has merits too. Then you hang the bodies from lamppost to remind other would be spammers of the problem with this business motto.

Re:Spamming method

[Anonymous Coward]

That's odd, only one package of dog feces.

Maybe the other ones were too badly burnt to be recognized...

Re:Spamming method

[Zutroi_Zatatakowsky]

Then install Bubblegum Proxypot, which is a Proxy Honeypot, doing the same thing as Spamhole but for ports 3128, 1080, 8080, etc. I'm getting hundreds of probes every day on ports 3128, trying to connect to other proxies or open relays.

Re:Spamming method

[Anonymous Coward]

I run my SPAM through SpamCop.com and take the resulting parsed spammers web site and put them into my spammers.txt file and run the following.

wget --wait=1 --random-wait --tries=1 --delete-after --no-directories --recursive --level=2 --ignore-length --user-agent="Internet Explorer" --limit-rate=2k --non-verbose --output-file=spammers.log --input-file=spammers.txt --referer=http://fbi.gov

This puts a load on their server with little load on my network. If many people did this, it would be slow death for the spammers.

It's not going to work...

[SuperDuck]

Just watch the RBL's and ISP's shut down your IP block for having an open relay...

How are they supposed to know the difference between a spamhole and a real open relay?

Re:It's not going to work...

[aborchers]

Just watch the RBL's and ISP's shut down your IP block for having an open relay...

How are they supposed to know the difference between a spamhole and a real open relay?

Don't they test that the relayed mail is actually delivered? ORDB does:

http://www.ordb.org/faq/#mail_accepted

Any tester that doesn't isn't very intelligent...

Re:It's not going to work...

[dorward]

Don't they test that the relayed mail is actually delivered? ORDB does:

http://www.ordb.org/faq/#mail_accepted

Any tester that doesn't isn't very intelligent...

... but as this system lets the first few mails though from a source before blocking them, the tester will be able to send the test message through it - and welcome to RBH.

Re:It's not going to work...

[SuperDuck]

The RBL's might, but having worked for some ISP's (*koff*@home*koff*), I know that they only scan for the open port on 25, they don't actually bother to check the SMTP functionality of the relay.

Re:It's not going to work...

[John3]

His program delivers the first relay attempt to fool the spammer. That means that an open relay test might identify your machine as a spam source.

That may not be a big deal since you wouldn't run this on your actual email server anyway. Most blackholes only list specific IP's and not entire blocks (at least the reliable blackholes don't list entire blocks) just because one IP in the range runs an open relay.

Re:It's not going to work...

[Alphix]

Yes, and if you read the article the relay does let the first 2 messages or so trough in order to convince the spammers that the relay is actually working

this technique won't work

[Anonymous Coward]

...because spammers will (or already do) use an actual sample mail address to see that the mail isn't getting through.

Re:this technique won't work

[jon3k]

Which means that if they do this, or begin doing this, you can capture the actual name of the spammer based on the first email sent through the relay.

So, either you catch them, or you stop them from sending millions of unsolicited emails.

Seems like a win/win, no?

Typical five minutes h4x0r fix

[Rogerborg]

+ Five minutes to implement.
+ It will fool spammers for five minutes.
+ Your ISP will disconnect you after five minutes.

Let's chalk this one up as yet another "nice try, shame about the lack of planning".

Watch out for your ISP

[Anonymous Coward]

I ran a very similar program to see what I would catch.. I caught my ISP, or rather they caught me - they thought I was running a deliberate open relay and sent an email warning me to shut it down. I was pretty surprised they were on to it so quickly (less than 24 hours).

Re:Watch out for your ISP

[Anonymous Coward]

You see.. I have a much different problem. I keep finding open relays created by worms that are spoofing my e-mail address (I get the bounced back replies). I report it to my ISP, they do nothing. Then the spammers start using these open relays, again my e-mail gets spoofed (my e-mail username is 3 characters and a very obvious one). I report it, nothing happens. Fucking lazy shmucks.

will my head sysadmin allow it?

[dummkopf]

i think it will not work for two reasons:

a) as mentioned before, it is easy to probe the hole to make sure it really works.

b) i seriuosly doubt that the security team of any university and / or company would enable such a hole because then they might get blacklisted and no more email for them...

Re:will my head sysadmin allow it?

[Zapman]

This is a brain dead and stupid idea from the world of fixed cost bandwidth. If you start paying for the megabit over a threshold, you're going to get screwed in a hurry. Even if you don't and your idea works well, you're going to loose most of your bandwidth to this idiocy.

Re:will my head sysadmin allow it?

[dummkopf]

and this is relevant to the original post because....?

Nahh, spamd.

[grub]

OpenBSD's spamd actually tarpits the spammer down, then after a looooong held connection sends a 450 (by default) to the spammer to have the spammer-machine retry. I have it running with various autoupdated blackhole lists and very little spam sees my server anymore.

Re:Nahh, spamd.

[arkanes]

I have to say, if I were a professional spammer I'd be using custom SMTP clients that didn't bother with stuff like "standards" and waiting on long timeouts and resending after a 450. All that matters is getting as much mail out as fast as possible, so just skipping hosts that aren't keeping up at a reasonable level would probably be the best option.

HoneyPots

[tomstdenis]

This is basically a honeypot. Various other forms of this exist [like TCP keepalives for as long as possible]. The basic idea is you want to make sure the user thinks its working while wasting their time.

The trick is much like the polution on P2P. People often complain that the stuff they download off P2P is either renamed [e.g. no the thing they were looking for] or of very low quality. This dissuades people from using P2P.

Likewise if lots of people setup fake SMTP servers that don't do anything it will polute the "scene". Possibly make it less attractive for spammers.

Of course what would be nicer is just to snipe the spammers and auction off their property for Quiznos money ;-) [this last comment is aimed at the jerk who is sending the same spam twice to me about all sorts of increased sex crap. It's bad enough you send it once but twice in under 5 mins? In the ban list you go!]

Re:HoneyPots

[Anonymous Coward]

Wow, Tom. What a bunch of trite, shallow, obvious blathering. You're really branching out: from anal whore to karma whore!

Not going to work

[heironymouscoward]

Spam is moving off open relays and onto pirated home computers. Spammers and virus writers together have already designed a distributed architecture in which they can send emails from hundreds of thousands, possibly millions of 'owned' personal computers.

The solution is to accept that email will become 99.9(n) junk, and that the challenge then becomes to extract the signal, not filter the noise.

One solution I foresee is "data clearing houses" which store-and-forward email, using a reputation management system to rank and score email (and other data, for the problem is general).

Re:Not going to work

[rf0]

Isn't this the sort of thing outblaze.com does and has some very good filtering

Rus

Re:Not going to work

[Leffe]

Spammers and virus writers together have already designed a distributed architecture in which they can send emails from hundreds of thousands, possibly millions of 'owned' personal computers.

I won't beleive it until I see the RFC.

Re:Not going to work

[Urkki]

Just go on blacklisting every ISP who can't stop spam originating from their customers. Soon you'll see that ISPs will find ways, such as allowing at most X mails from single user per day, blocking SMTP traffic going elsewhere than their own mail server etc.

Then have a system where an ISP can automatically get themselves removed from the blacklist after 1 day, when they think they've solved the problem. Next time make it 2 days, if they get to the list again, then 3 days etc, perhaps maxing out at about a week.

Oh, and obivously universities etc are ISPs in this context.

Ta dah, no more spam from home PCs.

All it takes is somebody powerful enough deciding that this should be so, and it would happen. There are plenty enough pissed off ISP admins who are itching for an official permission to limit spam traffic to and form their network. A requirement would be even better, then their customers could not even complain or change to the competitor.

For example if EU and US decided this, everybody else would have to follow or lose e-mail communications with economically most important portion of the world.

Sure there would be initial perioid of chaos in e-mail delivery. But then, isn't it a chaos already, if people are talking about internet getting totally broken. Better this than shutting down SMTP port completely at root level routers at some point to prevent complete collapse under the load of SPAM and worms looking for new SPAM hosts...

Re:Not going to work

[Lumpy]

Spam is moving off open relays and onto pirated home computers.

Arr me maties! there be more com-puters to be pillaged!

Raise the Skull and Crossbones! Music and Movies are small stuff... it's Spam that has the largest Booty!

Re:Not going to work

[Seraph]

it's Spam that has the largest Booty!

And here the spam I've received has problem to eliminate Large Booty. Filthy liars!

Re:Not going to work

[WuphonsReach]

Spam is moving off open relays and onto pirated home computers. Spammers and virus writers together have already designed a distributed architecture in which they can send emails from hundreds of thousands, possibly millions of 'owned' personal computers.

The majority of which is using forged domains...

This is where the Postfix/Sendmail crews need to get behind one of the reverse MX proposals and start pushing. When the e-mail software can reliably answer the following (2) questions, the destination servers will have another good data point with which to classify e-mail as junk.

1. Does the sender's domain have a reverse-MX list?
2. Is the IP address of the server trying to delivery mail on behalf of domain X listed?

Right now, a spammer with zombied home computers can forge my domain's address onto an e-mail and spam the world (who then comes and knocks on *my* door). At least with reverse-MX I can force all of my domain's e-mail through a central set of servers that I have control over.

The other side of the coin is whether ISPs should be allowing outbound connections to port 25. But if you have a 3rd party POP3/SMTP mail account somewhere then you need to be able to connect to port 25 outbound. (Workarounds would be to instead connect to a secured alternate port or setup a SSH or VPN/IPSEC tunnel.)

Re:Not going to work

[Anonymous Coward]

A big problem is that so many people have home computers with no firewalls whatsoever. A typical conversation:

me: You really should have a firewall, to keep your computer from getting cracked

them: oh, I'm not worried about that. There's nothing important on my computer anyways

me: but that's not the point - the point is that once they crack your computer, they can use it to launch attacks on other computers

them: oh my! I don't think anyone will bother with my little old computer - besides, I wouldn't want to spend any money on this, and I wouldn't know how to install your wallfire anyways

me: (slapping forehead, rolling eyes, trying to maintain...)

Dmeographic of cracked home computer owners: ignorant, learn the bare-minimum to get by, doesn't give a shit how their actions (or inactions) affect others ...

What was that Douglas Adams reference? The B Ark? Yeah, put these people on that one.

Please do not run this

[Erik Hensema]

It won't work.

On a small scale it has no impact.

On a large scale the spammer will just send a few 'test' messages through your system and move on to the next. With a million spamholes, a spammer can send a million mails at the least. Great.

Also, you'll get yourself blocklisted by every major DNSBL very soon. They scan for open relays too...

Re:Please do not run this

[Mourgos]

Not to mention that some ISPs will disconnect you for this.

Re:Please do not run this

[patbob]

Also, you'll get yourself blocklisted by every major DNSBL very soon

Not to mention be opening a potential way for someone to get into your machine. Once in, there's no reason they can't just run something to relay spam.

At the best, the spammers detect the signature of such a product and ignore them. At worst, they utilize holes in it to take over your machine and initiate spam directly form it. Neither is good for you and neither hurts them.

He's reinvented proxypots.

[Chip Salzenberg]

This is nothing new. For example, see Bubblegum Proxypot.

Slashdot, on the cutting edge of last year.

Re:He's reinvented proxypots.

[AndroidCat]

More like the year before that. This is a relay honeypot long after most spammers have moved on to open proxies and beyond.

I can't remember when I last received an actual relayed spam.

Re:He's reinvented proxypots.

[Anonymous Coward]

open proxies and beyond

There's a beyond. Please no.

Re:He's reinvented proxypots.

[AndroidCat]

Infected zombie proxies. If you can't find an open proxy, make thousands! That way you can have them do more than just proxying: like direct emailing, scanning, DDoS attacks on anti-spam utilities or just more infecting. (Best of all, they don't have to be open proxies. You can restrict them to you and your spammer buds. i.e. the ones that paid you.)

Maybe this is just me being cynical...

[CaptainTux]

I can see this being a great "live" email harvesting tool for some spammers. Setup a spamhole and just sit back and collect the addresses that other spammers try to send to. A good majority of the addresses will be good and you don't even have to waste time harvesting. This could be a windfall for technically savvy spammers with a little time to waste. Good God. Here we go again...

For all of you who will say "This won't work"

[TechnoVooDooDaddy]

for whatever reason you say it, I ask you this "What solution have you thought about and coded?"

Re:For all of you who will say "This won't work"

[Chip Salzenberg]

Some plant, some weed. All farm.

Re:For all of you who will say "This won't work"

[IamGarageGuy 2]

That is a fine and good attitude but if the problem isn't sorted out before it goes live, there may be problems. If you notice the posts about "spamholers" (whoo-hoo new word!) getting cut off by their ISP, you have to think that letting this loose to joe public may get them cut off and cause havoc on the internet as a whole. I am confident that a solution that is easy and will work is out there. The way to find that solution is to discuss and debate. The people that shoot down current solutions are not the problem - the problem is the problem.

Re:For all of you who will say "This won't work"

[Skater]

Just because a person can't think of another solution doesn't make him/her incapable of analyzing this proposal.

Example: A friend's solution to overcrowding: "Have lots of children." If I can't think of a better solution to overcrowding, that doesn't mean that he automatically has a good idea.

--RJ

Re:For all of you who will say "This won't work"

[pridkett]

Well, here's what I've done and it hasn't gotten me on any black lists for running an open relay because I don't.

First, my mailserver runs OpenBSD, this allows me to use pf for my port filtering software. Then each user on the server has a copy of CRM114 installed. This is a very powerful and extremely accurate bayesian classifier. I've gotten 1 piece of spam in the last three months, 0 false positives and it blocks about 150 pieces of spam a day (for my account alone).

For each piece of mail that I receive, the relays involved are entered into relaydb. This wonderful little program logs each mail relay listed in the message. When a relay has 3 times as many bad messages as good messages it is added to the black list. Because I'm using pf, this blacklist is updated in real time to the mail server's pf configuration, which causes spamming hosts to be sent to the tar pits.

I'd estimate the total accuracy rate (defined as non-Type I and non-Type II errors) to be somewhere around 99.95%. User interaction is zero for most of the time, I've got a nice corpus that I train the accounts with. On the off hand that there is an error the user mails the message to themselves and it gets fixed.

So, to summarize:
This idea won't work, you'll get your host marked as an open relay.
This is what I did to kill spam and it does work.

Re:For all of you who will say "This won't work"

[Anonymous Coward]

The point is not to think about something and code it, the point is to think about something and only code it if it's worth coding. 99% of things you think about won't be worth coding, and the trick is figuring out which ones are which in advance. This is known as "design".

Hmm....

[Alphix]

...has anyone been the target of a spammers affection?

I guess that as soon as they decide that your mail server is open to relaying they will pump their mails as quickly as possible trough to the server...

Wouldn't the bandwidth consumed while pumping all those pr0n mails trough to your server slow your xDSL (or whichever connection you have) to a grinding halt and thus make the project more suited towards those with a fat connection and something to prove?

Re:Hmm....

[Space cowboy]

A client of ours was rootkitted before the wisdom of keeping the system up2date was finally received.

They have 100mbit of dedicated alloted bandwidth at a Co-Lo with a fibre connection back to the office, and the spam saturated that 100mbit up to about 70% capacity for about 12 hours. Eventually I noticed mrtg on the main router had a well-defined "hump" on the graph and we quickly shut it down.

Complete re-install of all their public machines (5 of them). No internet access (their gateway was a linux box) for a day or so for the company, and complete rebuilds of their public servers. Ouch. Suddenly, paying the up2date fees seemed an easy decision :-)

Simon

Re:Hmm....

[Goldenhawk]

Just last weekend... this mea culpa might save someone in /. land some pain.

Had a form.pl script handling all form submissions on our web site. The form submitted its info via sendmail, as well as logging to text files. While the address checking was pretty robust, someone figured out how to overload the contents in a manner that fooled the sendmail into thinking that the contents contained BCC: data.

Fortunately I caught it within about five minutes, thanks to the fact that all submissions are CC:'d to a real address, thus starting a flood of mail. I saw the classic pattern: a test message, a couple revisions, a final draft test message, then the flood of "real" messages. Since I saw it start, I was able to shut down the script (I just killed the Execute permissions).

After the initial test messages, I saw submissions from dozens of different IPs - I assume zombied PCs. It seems that the zombies were programmed to relay form POST submissions, instead of trying to relay mail directly. Smart, since that puts the mail load on a fast server, not a slow dialup PC.

But the really interesting thing was, even after shutting down the script, the flood of submissions continued. I tweaked the form.pl to bounce the requests to another page but the bounce was never followed - indicating to me that the program didn't bother to check the server response to the submission, even for a 404 or 302 response! This continued for around 14 hours, at a rate of about 20-40 hits per minute. Based on the first messages that got through, several hundred addresses were included in each BCC: field.

Suddenly at about T+14 hours, it simply stopped - cold. For the next several hours a few sporadic hits popped up. Haven't seen any since about T+18 hours.

Apparently the spammer assumed his script would succeed once it was successfully started (it WOULD have unless I'd been at the PC). He obviously ran through his entire mailing list "blind". I'm happy to say 13.8 of those 14 hours were wasted, preventing about 7 million spams (14 hrs, 40/minute, 200 addresses each).

As lessons learned, although I'm sure this is old news to most of the /. folks, I'd like to pass along some tips based on my experience.
1) The spammer used our web site's form to build his attack, but then took it to another machine. All subsequent submissions were using a POST method but not from our site's page. No surprise there, but simply checking $ENV{'HTTP_REFERER'} could have prevented 99% of this attack - if not making it pointless to begin with.
2) Sendmail can be fooled into reading BCC: addresses from information after the start of the message body. I don't understand the details, but an obvious preventative is to =~ s/bcc://gi on the message before sendmail gets it. Probably wouldn't hurt to do the same to To: and CC:.
3) Sendmail can be fooled into sending encoded text from an otherwise text-only form. Filter out "Content-Type:" or "Content-Transfer-Encoding:" or "multipart/mixed" or "text/html" before sendmail gets it.
4) If you're watching for abuse, don't rely on looking for multiple hits from one IP - it seems that once you become a target you will likely get a distributed attack.
5) Consider replacing all @ signs... do a s/@/-at-/g on all message fields before sending to sendmail (except of course whatever hard-coded To: is at the start of the message). If all other measures fail, at least you won't get blacklisted, although you might get 7 million "undeliverable" replies.

Re:Hmm....

[Saint Aardvark]

Ah, Formmail.pl, the spammer's friend. Used to work at a small ISP where, sadly, we had copies of Matt's formmail around that would get exploited periodically. Trying to figure out which website was being hit, on a server w/maybe 100 websites and very few of them being logged (that was an extra the customer had to pay for), was nigh-impossible until I was given the root password and tried ngrep. Then I'd replace it with the NMS formmail, which I can recommend w/o hesitation. --Well, almost no hesitation...it's been a while. But it was great: drop it in and everything would work except the spamming.

I've written before about writing a fake formmail. Right now I've got my web server set up so that all requests for formmail (m/formmail/i) get directed to the script; as you can see, I still get hit about once or twice a week. I'd really like to figure out how to tarpit them, but I'm not sure I can do that on a running webserver.

Re:Hmm....

[happystink]

Just one note, HTTP_REFERRER can be faked easily using any tool that anyone would use to write a script lik this guy did.

Re:Hmm....

[Anonymous Coward]

A webserver should not be allowed to make new TCP connections.

Mine has a packet filter stopping outbound SYNs.
The webserver runs as non-root in a chroot so has
no way to run sendmail or disable pf.

Re:Hmm....

[oobar]

What your spammer probably did was supply a value for one or more of the form elements containing a "\n". For example, if one of them is supposed to be the user's email address so that you can reply to them and your script naively uses this to set the "reply-to" header, then the spammer can supply his own headers and force the body part to start. For example, if he provided an email address of "foo@example.com\nBCC:spamvictim@aol.com\n\nthis is the body" then the spamvictim recipient will get sent a copy of the spam.

I had someone try this multiple times with an email form script that I had written. Fortunately, I used Perl's Mail::Mailer module, such as the following:

my $mailer = new Mail::Mailer;
$mailer->open( { To => $to_addr,
'From' => "feedback.pl <nobody\@example.com>",
'Reply-To' => $q->param("email"),
'X-Web-Feedback' => 'YES',
'Subject' => "feedback submission form"
} );


By doing it this way rather than just opening a pipe to sendmail and spewing fields, his attack had no effect. The lesson learned is to use the abstractions that others have carefully written. For example, don't parse URL parameters yourself or read from CGI input from stdin, just use CGI.pm where all these things have been worked out already.

I bet...

[hookedup]

They (spammers) just start putting one of their own emails on their list. Once they finish their spam sending fest, they check their inbox, if they see nothing, then do it again on another relay.

PLEASE DO NOT READ THIS IF YOU ARE A SPAMMER :)

Re:I bet...

[AndroidCat]

Spammers with quality control? Nooooo! Next they'll get an independant auditing firm to confirm the amount of money they always claim they make in those "Spam King", "Spam Queen" or "Spam We're Not Sure" news stories.

Re:I bet...

[UCRowerG]

if they see nothing, then do it again on another relay.

But the spamhole will have already done its job: waste the spammer's time and bandwidth.

I agree this may not be the ultimate solution, but every little bit helps, right?

Re:I bet...

[hookedup]

Yup, like it's been said, if one person can waste just a couple of minutes of their time, imagine what tons of us could do. But then there were the other points, ISPs getting angry with users, people getting blacklisted, etc...

Re:I bet...

[Anonymous Coward]

The website says it lets some email through until a threshold is reached. Then it spamholes future messages.

The spammer would have to have several of his emails embedded in his spam list to know that it isn't working out. After which, he has to look for another relay... which could be another spamhole. Rinse and repeat.

Running an open relay may piss off your ISP, letting a couple of spam mails loose at the beginning, and where most spam is sent today (open relay numbers are probably fewer than assumed) is the downside (downfall?) of this idea.

Logically, though, I still like the idea.

Been there done that...

[SlightOverdose]

We had a spammer exploiting an incorrectly configured formmail.pl on one of our servers. We didnt actually use it, so I replaced it with a fake version that accepted pretended to accept the mail and return 100mb of data as a reply.

Our provider gives us unlimited upstream bandwidth, so it had no real effect on us- however here would have been at least 50gb worth of data used by the time the spammer caught on, so hopefully that cost them some cash. (Although in all likelyhood it was only a minor inconvenience).

Re:Been there done that...

[Anonymous Coward]

Assuming the unlikely scenario of the spammer actually using his own bandwidth! You cost sombody some money, that's for sure.

Re:Been there done that...

[electric_penguin]

And assuming that the originating IP wasn't spoofed.

Re:Been there done that...

[SlightOverdose]

... It's not possible to spoof an ip address in a full tcp connection.

Re:Been there done that...

[SlightOverdose]

It wasnt the SMTP server doing it, it was formail.pl, which noone has any reason to be using. All the connections were from a single subnet known to be a spammer (that entire B class is now in my hosts.deny) Besides- if you get infected with a mail relay trojan its not my fault. I'll do whatever it takes to make life difficult for whoever tries to spam through me.

Re:Been there done that...

[Anonymous Coward]

It may have been a connection from an open proxy. Still, I don't mind punishing those fools either.

Re:Been there done that...

[Anonymous Coward]

I like that vigianteism, though! Once a week you should send a not-so-random 50MBs of data. One week it could be the Spam sketch from Monty Python's, the next week a 100 GigaPixel image of goatse.

It's a great idea, but I have one question.

[Infernon]

Isn't the spammer going to know that the supposed relay is a spam hole if he includes an account that he accesses on his list and checks to see if he's received a message from himself afterwards?

Your netblock is at risk

[Space cowboy]

If you put this on your site, and people complain about those 'let through' spams at the start, your entire netblock will be marked as a spammers paradise (and rightly so - how can the RBL's tell the difference?). Goodbye email.

Some RBL's do not allow changes to be made unless you pay a big fee, and you lose the fee if they consider the complaint genuine.

This sounds real risky to me ...

Simon.

Re:Your netblock is at risk

[Tjp($)pjT]

Any RBL that charges a fee to remove you is not working in the best interest of the Internet. IMNSHO they are just practicing extortion. Phat -- Remember when that was the noise Bill the Cat made caoughing up a hairball.

Tarpitting

[isa-kuruption]

This is still the best method to "slow down" spammers. Having a listener on port 25 on un unadvertised box waiting for a connection from some random person, knowing this to be a relay checker and/or spammer, then holding onto the connection forever. This is what LaBrea does, but LaBrea does it on a larger scale, for entire subnets w/ open IP addresses, and any port.

Sorta makes you wonder...

[StringBlade]

if a bunch of spammers collect IP addresses of these spamholes and create a blacklist, does Spamhaus have a right to complain then?

Strange way to combat Spam

[fruey]

While the concept is somewhat interesting at first glance, the people who run spamholes might end up with it costing them a lot of bandwidth and system resources.

• While they are not relaying mail outbound, they are targeting their IP for blacklisting by allowing tests through
• The spammers that do think their relay is valid will then proceed to send thousands of emails via this spamhole, leading to incoming connections peaking very high and a lot of incoming bandwidth being saturated. Outgoing bandwidth will be used in all the ACK packets.
• Most spammers will have some kind of bounce statistics processing, and the really good ones might even seed bad addresses deliberately. So they'll know quite quickly when they get no bounces back at all
• The machines are going to be targetted not just on port 25, as they likely get port scanned, and so be very very vulnerable to other attacks. Running a half-baked spamhole on port 25 is one thing (see above reasons why I disagree with the idea) but then all your other ports had better be locked down... unless of course you're running a honeypot.
• But then, once a honeypot has been attacked once or twice, you better have some time to do serious forensics on it before leaving it open to more and more exploits, you'll find that it's been hacked to run a REAL open relay on some other port!!!

In short, this idea might only work if somehow you could get more spamholes on the net than open relays, and even then it would have to be coordinated by real sysadmins who know their stuff. Clueless admins are (probably) in the majority and whether or not you agree with that little flippant comment, they will surely outnumber the people who have enough time, a spare machine, and bandwidth to run a spamhole.

This guy says that he has 'holed' over 50,000 spam messages. Well, not really. They will be retransmitted. Spending the energy on blocking spam from your users completely is a better bet, I think. Educating people and advocacy is a better bet. Spamholes will be just another 5 minute net curio.

The Power of the Lexicon

[Asprin]

That's not what a 'spamhole' is around *my* office. Pfft!

Danger!

[Anonymous Coward]

Will this send spam over to the 8th dimension? Let's not forget the inherent dangers of crossing dimensions shown in The Adventures of Buckaroo Banzai Across the 8th Dimension.

Re:Danger!

[Anonymous Coward]

John Big-Melons has written a paper that says this can't happen. "The chances would be a million to one" he said.

two potential problems

[tacocat]

I see two potential problems with this approach, one more insipid than the other.

1. Albeit minor, I've now lost my IP port 25 mail server. This is a big problem if I only have one IP address. I would still like to have a mail server, thank you.
2. Spamhole only works as long as it's population is much less than the population of potential open relays. Spam hole will send ~2 emails free to allow some meathead spammer to verify the relay works. After two, or when rate exceeds some value, you /dev/null the traffic. Now you have a really popular tricksy and you have 50,000 spamholes on the internet. This will delivery 50,000 X 2 free test emails. Why not just use that free 100,000 emails to deliver spam instead.

Haven't you only succeeded in sponsoring a low volume spam relay that not only delivers spam, but at such a low per-boxen rate that no one will ever be the wiser for it.

I see that even on your homepage you mention that a few spam emails might get delivered, but you are acting as a relay for a few spam emails times 50,000. You will eventually get blacklisted via OpenRelay RBL's.

I think if you sit down for a day and just watch your email logs, you will find that a lot of spammers don't bother to test a connection for open relay status. They just test by pushing as much email through it that they can as quickly as possible. Daily I have hundreds of attempting mail relay deliveries.

Re:two potential problems

[Alphix]

1. I've now lost my IP port 25 mail server.

No, reread the article, mail is forwarded to a real server to do more processing (let the 2 mails per connection trough for instance).

2. This will delivery 50,000 X 2 free test emails

Big deal, no spammer today counts on sending 100.000 mails to make a living. Up the amount by a few orders of magnitude. Also, the extra time required to find and use all those servers isn't exactly negligible (sp?)

Re:two potential problems

[Technician]

Why not just use that free 100,000 emails to deliver spam instead.

It's simple. It's work to find open relays. Sending only 2 mails per server doesn't get very far for the bulk they try to send. It makes more sense to find an open relay and pour as much through it as it will handle. If they don't test, they pour hundreds of thousands of e-mails down the drain and don't know they wern't delivered. If they do test, then they only emailed themselves and maybe sent one UCE. The one they sent themselves was solicited, so it's not UCE ;-).

Re:two potential problems

[Aardpig]

Now you have a really popular tricksy and you have 50,000 spamholes on the internet. This will delivery 50,000 X 2 free test emails. Why not just use that free 100,000 emails to deliver spam instead.

Because to send each of those two 'free' emails from each of the 50,000 spam holes, you have to bring up 50,000 separate SMTP connections and send the email text 50,000 times, thus completely maxing out your connection. This is not the way spammers want to work.

Instead, they find high bandwidth open relays, and send a few spams with huge To: lists. It is the open relay which then multiplexes the spams to the multitude of recipients, not the spammer.

To summarize, the 2 (or however many, as long as it remains a small number) 'free' emails permitted by spam hole will be of very little use to spammers, since to reach millions of recipients, they will have to connect to thousands of spam holes, which is too slow to be economical. Spam hole will not create a new spam problem in itself. Whether it will cure the present spam problem is another matter.

Re:two potential problems

[tacocat]

FROM THE WEBSITE

A common misconception seems to be that this is indended to be a real mail server or a kind of spam-detection or content filter. It is NOT. spamhole is intended to be a FAKE open relay, and it should never have anything at all to do with legitimate email services. It's akin to a honeypot.

No... you reread the article. I've lost my port 25, which is what I said in the first place.

Additionally, I get hundreds of relay attempts against my box every day and I'm not an open relay. All this will do is provide a certain number of them to get through if you configure it that way. If spammers have time to make 200 SMTP connections against me every day as it is, then they'll be overjoyed to find that they can actually send spam, even if it's only 2. It's more than they get with me today and I don't see them stopping anytime soon. It's all done with bots so who cares?

Microsoft should build this into Windows

[Anonymous Coward]

...which would make so many false open relays that the spammers wouldn't be able to tell the fakes from the real ones.

Then again, Microsoft would fuck it up somehow so a simple buffer overflow would make the thing actually send all those messages that were supposed to be accepted and then shitcanned.

Proxy Honeypots been doing this for ages

[gorbachev]

monkeys.com used to have one, until the spammers DDOSed him.

Several other people are still running proxy honeypots with great success. They are a great resource for finding out which ISPs harbor proxy hijacking criminals.

For all of you, who think spammers will check whether the proxy works first, spammers do no such thing. They actively scan for open proxies and immediately start blasting away. That's just like with spamming. You really think spammers check every Email address on their lists is real?

Proletariat of the world, unite to kill spammers. The more painful and slower, the better.

Re:'Anonymous' wreckless endangement on /. tsarkon

[Anonymous Coward]

Protect yourself. Try and use proxies or a super good second browser with proxies that you never log into such as Opera (which makes it very easy to delete all private data). Thank you.

Or, you could just place a little less emphasis on what seems to be your lifelong goal of participating in Slashdot threads.

Plan for Spam Prevention

[dcocos]

Since it seems that a lot spam I get comes from my e-mail address being on my homepage, I've toyed with the idea of putting two address up on the page
like dan@example.com and danc@example.com since danc only exists as a harvestable address any messages that show up at danc are compared to the messages in the spool for dan and a 95% or more match pushes them both to the trash. Has anyone else tried this or something similar?

Re:Plan for Spam Prevention

[Grey_14]

I Actually think this is a great idea, but why stop there? How about a spam registry, when say, 100+ people report a message as spam, it's placed in a global database, where e-mail clients or a daemon could compare local messages, and delete matches. this could reduce spam worldwide.

Re:Plan for Spam Prevention

[davids-world.com]

Let's say, I haven't put up my real e-mail address at all. Instead, there is a form (and a well-filtered e-mail address in an image file). Also, I never enter my real e-mail address into any web forms or use it to post messages on usenet. For these occasions, I have a secondary address that gets changed every now and then.

This way, I have reduced my spam to an absolute minimum. The secondary address is automatically filed into the trash in my mail client, so I just have to check the trash once a day or so to see if there are any interesting e-mails, for example stuff on mailing lists. Just browing through these is no pain at all, and if I want, I can still have a lough with "Joseph Makle: Dept of Minerals and Engery, South Africa" offering me some $15M for a transaction...

Re:Plan for Spam Prevention

[Anonymous Coward]

I noticed old school web spam spiders going through my webpages a few years ago, and devised a fake email generator -- some fly in their ointment.

Affectionately called SpamSpiderFucker , check out: http://www.generation.net/~erick/ssf

The rationale is that shitty spamspiders will collect anything that looks like an email address, and attempt to deliver mail to these nonexisting (hopefully!) domains, and alerting attentive SMTP admins who will figure this out once they see what is in their mail queue.

Re:Plan for Spam Prevention

[Dr. Evil]

It's been done. The Vipul's Razor portion of Spamasassin generates signatures from known spam. People feed spam sources into it.

The only problem is that dan@example.com would receive kretiv1y R/\N|)0/\/\][Zed di||erent tipes of spam. Twinkies limes in spain. \/|AGRA \/|AGRA \/|AGRA.

I thought that maybe applying pattern equivalencies, dictionary and grammar checkers to create signatures based upon "real sentences" would improve things, but before I could do it, randomized jibberish like this came out:

danc@example.com would receive kretiv1y R/\N|)0/\/\][Zed di||erent tipes of spam. Spanish onions defeat goliath squirrels. \/|AGRA \/|AGRA \/|AGRA.

Re:Plan for Spam Prevention

[Ciggy]

To a point...97%+ of the spam I receive is sent to one e-addr (with 51.9% last month, and 38.6% this month so far, coming from sites hosted by wanadoo.fr, a sister company of that e-addr's ISP) and is dead easy to filter.

How's about adding a few high profile people's e-addr's in white text on a white background (like some of the spam I receive has some of its text), include a comment (also in white on white) saying something like: "This is my MP's e-addr"; and leave it up to them to take action against the spammers - once they get bogged down like we do I'm sure they'll do owt to fix the problem.

Isn't that interesting...

[dcavanaugh]

Run an open relay, the ISP detects it, launches nastygrams and prepares to blast your ass to Mars. Complain to the average ISP about the average spammer, and the spammer is still spamming through the same ISP 6 months later. Hmmmm.

a trap bu tnot a solution maybe

[denisdekat]

Perhaps this can be used to trace them down, I am a tad doubtful that this would really work, however, it could be used to catch folks who test for these and try to use them, thereby identifying potential spammers. Perhaps, a follow up email to ISPs getting them disconnected for life (hehe)?

Just a thought

[fr0dicus]

Everyone being blacklisted for using this might have the nice side effect of making more effective blacklists :)

Fed up reading such non-working stuff

[c.herwig]

Everybody is complaining about spam. And at the same time almost everybody comes up with yet another brand-new-weired-looking workaround. Why the hell?

May I suggest just doing a few basic things:
1) Make a law (if your country doesn't have one already) which makes it illegal to send emails with forged FROM fields (= email addresses you don't own)
2) Slightly improve RFC2821 (smtp): Convert the optional ssl layer to a mandatory one. An smtp sender should only allowed to send mail to a server if
a) it uses an ssl encrypted connection and the Hostname in Reverse-DNS matches the name provided with the ssl certificate OR
b) it uses username and password to login into some kind of mailaccount
3) Sue spammers violating law 1) to hell. If you want to find them, you only have to look at the ssl certificate used for the connection.

Yes, I know this prevents everybody from having his own pretty little smtp server. No, I'm perfectly well with that. Use a provider.
Yes, ssl certificates are expensive for now. But any serious provider should be able to afford one.

Re:Fed up reading such non-working stuff

[randombit]

1) Make a law (if your country doesn't have one already) which makes it illegal to send emails with forged FROM fields (= email addresses you don't own)

And when people violate it, you track them down how, exactly? Please explain.

Slightly improve RFC2821 (smtp)

What you term "slightly improve", I would call "change EVERY mail server and client in the world". Oh, wonderful solution. Even if this was pushed through today, it would take years (at best) to happen. As a much smaller-scale example, all new X.509 CAs that comply with PKIX (the IETF X.509 profile) are supposed to start issuing all their certs with UTF-8 on 1/1/04. This is been a requirement of PKIX since at least 1998. Not one single CA is going the change on the cutoff date. Not one. SMTP is thousands of times more widely used than X.509. You are insane if you think this is technically or politically feasible.

Yes, I know this prevents everybody from having his own pretty little smtp server. No, I'm perfectly well with that. Use a provider.

I am very glad you have no ability to carry out any of these actions.

Re:Fed up reading such non-working stuff

[c.herwig]

And when people violate it, you track them down how, exactly? Please explain.
Please read my original posting: Use the certificate data.

What you term "slightly improve", I would call "change EVERY mail server and client in the world".
No. You have to change the servers. Updating server software. Thats what admins are for. Should be possible to do in a year or so. After that, if your company server isn't able to send mail to anyone, you will update fast, I bet.

• And you don't have to change a single client
• • . Clients use login/password to authenticate at their server. Again: Please read my posting.
  • 
    
    I am very glad you have no ability to carry out any of these actions.
    Yeah, and I'm sure it's lot simpler to write about ten or twenty drafts for new mail systems, to maintain lots of blacklists or to develop and continually change algorithms for filtering spam. Thank you.
    

Re:Fed up reading such non-working stuff

[randombit]

After that, if your company server isn't able to send mail to anyone, you will update fast, I bet.

That's the thing. It won't happen, becuase nobody wants to take the first step. Just like IPv6, where the first major provider that changes gets to deal with every IPv6 bug in every piece of network equipment that is around. Thus, it's easier to keep using IPv4. Similiarly, nobody would change the mail servers because then they get to deal with all the problems inherent with doing this (when they would rather wait for someone else to deal with it).

Updating server software. Thats what admins are for. Should be possible to do in a year or so.

Just getting this through the IETF would take a year, assuming it wasn't insane. You are discussing a mandatory change to a widely used Internet standard. I don't know if you're aware of how this works, but it's not just "Hey! Let's do X" and it magically happens.

If you don't believe me, then go here, sign up to the SMTP WG list, and get SMTP changed. Then, if you like, you can come back and laugh at me and remind me how wrong I was.

Re:Fed up reading such non-working stuff

[jmv]

You don't need a spcial law. Most spammers can now be sued under the criminal code, either for fraud (Nigerian scam) or for cracking the machines they're using to send the spam. Forget about fines, jail them under the current laws.

Re:Fed up reading such non-working stuff

[ectoraige]

More important. Make it illegal to advertise through spam, and kill the market.

Re:Fed up reading such non-working stuff

[c.herwig]

ok, now we're getting closer...

I roughly know the process of getting this through the IETF. And no, I neither can nor want to do it. I'm no programmer and no big provider.

But I know the internet for about 15 years now. And, let me guess one thing: smtp (and email with that) will be dead in less than two years if no solution is found. So I honestly think its better to change smtp than to stop using it.

And no, it's no matter of who is laughing at whom. But I don't understand why people dedicate relevant resources (lots of manpower, lots of money) to fiddeling with filters, blacklists et.al. And at the same time almost nobody tries to solve the original problem (spammers sending mails via unauthenticated, unknown, untracable, constantly changing hosts).

And at last, there is a difference between Secure-smtp and IPv6 you should consider: IPv6 is (was) entirely new. smtps isn't. Every common server software can deal with certificates and originate/answer secure connections by now. Probably you even don't need to change the software. At least in postfix (thats the only software I know en detail) it would be sufficient to change some configuration switches. No new code, no new bugs.

I don't say that this is easy and quickly done. I just say it has to be done something serious. And I don't see good alternatives.

Re:Fed up reading such non-working stuff

[Anonymous Coward]

Yes, I know this prevents everybody from having his own pretty little smtp server. No, I'm perfectly well with that. Use a provider.

I switched ISPs specifically so I could run my own mailserver, as my previous provider's (Comcast) were down more often than they were up and they had no accountability.

My server is locked down tight, I ruthlessly comb the logs and maintain my blacklist fervently. I can also create throwaway accounts on a whim to keep spam out of my 'real' account. The best part is, if there's a problem with my server I can fix it quickly instead of having to rely on someone else.

Having to do my own maintenance for the pleasure of having nearly spam-free mail and a reliable server is worth it. I'll see you in hell before I give it up.

Re:Fed up reading such non-working stuff

[Anonymous Coward]

Your original proposal is dead on arrival. You're proposing a solution to spam that involves changing laws, changing SMTP, changing email clients and servers, rejecting email from clients/servers that don't conform to the new standard, putting email certificates in control of a few central servers, and of course, reliance on lawsuits for ultimately stopping spammers.

Congratulations. You have successfully hit almost every point on this list, which was written by someone who actually knows what they are talking about.

Re:Fed up reading such non-working stuff

[phillymjs]

Most spammers can now be sued under the criminal code, either for fraud (Nigerian scam) or for cracking the machines they're using to send the spam.

Yes, but it's usually difficult and time consuming to track down the spammers. The laws need to include liability for the companies who actually sell their products via spam. Currently they can just plead ignorance "Hey, we didn't know that this guy we paid to do our marketing was sending spam via cracked PCs!"-- if they can be penalized financially via a civil suit for marketing their product via spam, they'll be a lot more careful about who they hire to do their marketing, spammers will lose business, and spamming will become unprofitable.

Since we'll never be allowed to hunt down and kill the tools who actually buy the shit marketed via spam and make the business model viable, this is the next best thing.

~Philly

Re:Fed up reading such non-working stuff

[tepples]

Yes, ssl certificates are expensive for now. But any serious provider should be able to afford one.

Afford one, or afford one for each domain that the provider handles?

Re:Fed up reading such non-working stuff

[Lord Apathy]

Amen! Preach on Brother, Preach On.

Re:Fed up reading such non-working stuff

[Anonymous Coward]

Spam is like someone throwing a brick through my window with a flyer advertising window repair. Can't the government just say hey you can't advertise like that.

I don't understand why all the proposed solutions are about getting the spammers or fixing mail servers. Spam exists because people are making money from companies willing to pay. So why not go after the companies? Make a law saying it is illegal to use spam as a marketing device, plain and simple. Forget about the must have return address, must have ADV in the subject field, blah blah nonsense. All they would have to do is...

1. Receive spam advertising shitty product.
2. Buy said shitty product and trace the transaction.
3. Fine the company behind the spam severely.

The goverment already regulates other forms of advertising (cigarettes, alcohol), so this wouldn't be anything new.

This doesn't solve anything

[RouterSlayer]

there are two major issues unsolved by this.
This does nothing to address the traffic/bandwidth usage. I've seen spammers continue to hit mail servers for several years (yes YEARS) after they were locked out, they just don't care. The bandwidth costs become seriously problematic.

and the second thing, sort of the first, or related, is what the issue never getting addresses about EGRESS filtering.

Now if everyone, or at least every major ISP would actually use egress filtering, the spam problem would be reduced by, probably, at least 80%.

Here we are talking about this same stupid issue years later, with the same stupid suggestions and the same stupid ideas, over and over and over again. But no one listens.

The other way to combat spam is one I mentioned years ago, and on slashdot many times, in fact, almost every time this subject comes up, which, by the way, is getting more and more frequent. Anyhow, it was an online database of known spammers, by domain and IP. Two seperate lists, one IP, one domain. IPs are by class-C (/24) minimum. It would work if it was pseudo-public, and open, and everyone would keep updating it.

but no, people say "yeah, interesting" but does anyone really get involved? no.... sigh...

My predictions: we'll see this spam issue more and more often with more and more so-called "brillant" solutions like honeypots and crap like that. But will anyone really want to *DO* anything about it? nooooo..... and we'll keep talking about it for eons... nobody cares...

Re:This doesn't solve anything

[TiggsPanther]

his does nothing to address the traffic/bandwidth usage. I've seen spammers continue to hit mail servers for several years (yes YEARS) after they were locked out, they just don't care. The bandwidth costs become seriously problematic.

Well, wouldnt merely locking them out cause mail to bounce?
But this Spamhole thing will at least make the Spam disappear at the first relay. Not bounce back. Not propagate on. It'll reduce some of the overall bandwidth usage.

Plus, from a purely users' PoV, whether it saves bandwidth is irrelevant. but if it manages to reduce the crap that hits their Inbox, then it's a good thing.

The database idea is great in theory, but it does sound similar to Blacklists. In so much as they have the same three potential problems.

• (1) Point-of-origin isn't always clear. And that means that either faked domains or open/cracked mailservers may get added. And once on, sometimes it's hard to get off.

  (2) Slightly less major, but there's always the chance that people get erroneously added purposefully - albeit through ignorance/laziness rather than malicious intent.
  Especially if it's automatable, people have been known in the past to just flag up certain senders as Spam. When it's actually legitimate bulk-mail that they just can't be bothered from unsubscribing from.

  (3) As problems with the RBLs have shown in recent times, all such a list/database does is provide a central "target" for Spammers to cripple. Unless there was a way of doing the database distributed, then they'd just get DDoS'd, and targetted by the latest worm payloads.

It's not that I think the idea itself is bad. Just that current implementations do tend to include rather serious flaws.

Tiggs

Re:This doesn't solve anything

[RealProgrammer]

See my RFC on Spam Eradification.

Re:This doesn't solve anything

[Lord Apathy]

Your RFC is incomplete. I see nothing in there about flogging spammers with thier own intestens...

Re:This doesn't solve anything

[RealProgrammer]

"Flogging spammers with their own intestines..."

Ok, I'll get to work on it. :-).

Re:This doesn't solve anything

[RouterSlayer]

doesn't work, and won't work. for various reasons, not all of them technical. Some of the major reasons are political.

this has been bantered about before.

Another nice "spamhole" project

[Electrode]

spamhole.com!

It lets you set up a temporary forwarding address, which can be very useful for those "free registration" things that just scream "SPAM!".

what about blacklists?

[x01mOiRe10x]

It may cause spammers dificulty, but what about the server you run it on... what keeps it from ending up blacklisted on ordb and the like, and then becoming inaccessible to all those people out there who have vigilant sysadmins and good firewalls?

Same name

[404notfound]

Spamhole is the name of a temporary e-mail redirection service, good for those times when you need to submit an address for a verification code but don't want the company's spam to fill your inbox afterward (why would you?).

If it won't work, try something else

[orb_fan]

It seems from peoples comments here, that this simply will not work. If nothing else, you'll appear to be a relay and will get blacklisted.

So, how about this... change smtp servers so that it appears that the server is on a slow connection. This could be done by putting in a delay before send the ACK for each packet recieved. For legit messages, this wouldn't be much of a problem as volumes would be low. However, for spammers, who are relying on sending 1000s of messages per second, the added delay would become a problem for them.

Of course there is a problem with long legit messages. But in this case, just make the deley dynamic - the more packets recieved for a message, the shorter the delay.

Spam & Junk Mail Summary

[joelparker]

These fake open relays won't work.
For an ongoing summary of ideas:
Junk Mail Guide

I welcome feedback & ideas...
I believe there's a good solution
that's still waiting to be found.

I have a better solution

[SuperMo0]

Don't give out your real email address to the spammers. If you ABSOLUTELY HAVE TO use your email address for something, get an alternate email address, get the password you need or whatever, then switch to your main one or just don't switch at all. Multiple email accounts = good. ^_^

Re:I have a better solution

[Urkki]

The problem with this is that it does not solve the problem. It may hide it from you, but it does not solve it. Also, it somewhat requires that you don't need to be reliably contacted by people you don't know.

The actual problem is at least two-fold
1. The actual spam traffic slowing things down, costing core network operators, and this cost getting passed down to ISPs and ultimately end users.
2. The threat to home PCs that get hacked for the purpose of sending SPAM from them.

Filtering or hiding your e-mail may help *you*. But unless you expect every stupid average Joe to do it too, it will not discourage the spammer in the least so the real problem remains.

Re:I have a better solution

[jqh1]

check out spamgourmet for help with this.

Re:I have a better solution

[Anonymous Coward]

I keep going back and forth on this. On the one hand, it is nice to have my own domain, so that I can make up arbitrary email addresses [1]. On the other, it opens up more targets, thus making me want to limit additional aliases.

[1] I have a clueless extended family when it comes to tech, it would not surprise me if half of their home computers were compromised in some way - so I don't give them my main address - does this sound all too familiar?

The problem is different ISPs

[Sycraft-fu]

Some ISPs are very vigilant. They have a take-no-shit attitude towards SPAM and/or hacking. They'll actively watch for it, shut people down, respond to abuse complaints, etc. Some just don't give a fuck, and won't stop it unless it interferes with their network or someone comes after them with a big enough stick.

So just because you've dealt with an ISP that is in the "don't give a shit" category, doesn't mean there aren't other ones that will be very responsive.

Re:The problem is different ISPs

[Anonymous Coward]

They'll actively watch for it, shut people down, respond to abuse complaints, etc.

This is true. The idea of running one of these for a while, just to see how quickly the spammers sniff it out, how many get suckered, and how much spam will be prevented from reaching its destination, intrigues me.

Every now and then, though, the logs from my mailserver show that Speakeasy (my ISP) has performed an open-relay test on my [real] mailserver. Since I don't know what kind of action they take if they find an open relay, I don't really want to risk my connectivity.

helping spammers... *sigh*

[dakkon1024]

So as the project grows, people will sell lists of these "open relay's" This way, spammers can use different SMTP servers to send there mail, making them more difficult to track. A few IPs and a few email accounts to check when the spam hole stops working, and they could actually use these to there advantage.

AOL will block your legit emails.

[FunkDaddy]

I'm currently having troubles getting legit emails through to AOL customers. From what I've read in their SPAM rules, if your domain has an open relay, they will block your email. So if you set this up on your domain, you might hurt yourself more than the spammers.

What about that other plan?

[Anonymous Coward]

There was a plan mentioned on /. a while back which goes something like this:

Modify the SMTP protocol and MTAs so that when a message is sent, the mail server replies with a math question. The mail client then works it out, sends back the answer and everything is great.

This would work wonders, as spammers couldn't send millions of mails if each one took a second or so to calculate.

So what happened to this plan? It wouldn't require a complete overhaul, just some tweaks -- we could_ halve spam in a year with this.

What Im worried about

[jakoz]

I am willing to contribute to this, having some GB/month to spare, and hating spammers... but what Im wondering is how much bandwidth this might cost?

Bad-Address Reporting

[waldoj]

As I'm sure many of us that run our own mail servers have found, I've got a good dozen addresses that have never existed to which spammers attempt to send mail. I get hundreds of attempts to send spam to these addresses each day. For a while, I was forwarding these messages to an RBL, but my mail queue just got too huge.

What I would like is a tool that hooks into Postfix (or whatever MTA; I use Postfix) that not only blacklists the sending IPs on my machine, but even reports the sending IP to an RBL. At a bare minimum, this would be a useful tool for me, since it would keep these spammers from proceeding to send spam to any other addresses on my server. At best, this simple method of confirming that a spammer is a spammer could help to reduce spam on the whole.

-Waldo Jaquith

Spamhole servers will get blacklisted

[RealSalmon]

The downside to this is that a few SPAM emails may actually be delivered by your spamhole. Such is the price to pay for tricking the spammer into continued use of your 'open relay'.

Yeah, that and getting your server and/or organization blacklisted when anti-spam services/software check to see if your server is an open relay.

Make it costly for spammers

[lamename]

It seems to me the reason people spam is because it is cheap to do. Sending out hundreds of thousands of emails for next to nothing.

What if everyone who got spam took 5 minutes a day and replied to a few? I am not saying they need to actually be interested in the pitch, but just send a nice polite letter saying you are. Could you send me some info by postal mail? Do you have an 800 number I can call? Could you contact me with greater detail to this question? Now, the spammer has to invest some time and possibly some money.

Millions of people get spam. If a small percentage would do this, would it deter spammers?

Re:Make it costly for spammers

[Anonymous Coward]

A software solution would be better...

Something that would take e-mails that I *manually* toss at it, follow the links or reply or dial the 800 number.

Try this approach......

[SomeoneGotMyNick]

I don't believe honey pots will be able to solve the problem. I believe in attacking the economics of spam. Make it not worth their while to send it in the first place. Here's one case in point:

I have been the victim of a spam which used my e-mail in the forged From line. I have been receiving all the 'undeliverable' bounces as a result. Of course I got fed up and decided to do some research.

I picked out the origination IP from the header of the attached bounced mails (always valid) and did a port scan on then. I found most of them infected with the Jeem trojan.

Well, this explains the open relay. I gave up complaining to ISP's about their subscribers who have trojaned systems. They don't seem to care. I suppose it's time for vigilante justice.

The Jeem trojan opens up an e-mail relay on a random port and a control connection plus an http proxy on their own random ports. Time to fight fire using the same fire.

After 'safe browsing' the web sites listed in the spam mails, a lot of them have form information (usually requesting credit card info). Why not use a program that uses a trojaned system's HTTP proxy to send invalid data as the form contents. I was able to send URL encoded form content based on the form's fields which easily bypassed the form's javascript validations. In return, I get an expected confirmation screen. Hey, maybe they just got one invalid response.

Now, if this can be done often enough, maybe the ISP will see the traffic and suspend the account of the trojaned system. In the meantime, the source of the SPAM gets a lot of invalid info to filter through. When I say invalid data. I don't mean 'asldfhhfsdf' and such. I mean real looking names, addresses, CC numbers, etc.

I know there are flaws with this idea, but I don't see where it wouldn't start becoming a thorn in their sides. The Jeem trojan can be controlled remotely. I wish I knew the remote commands to turn them off. But, if we use their known trojans against them, maybe they'll turn them off for us.

Re:Try this approach......

[Anonymous Coward]

There are serious flaws in this idea. You could get busted for putting false credit card numbers in their forms pages. If you do any forms hammering, I wouldn't do it with a form asking for credit card numbers.

Re:Try this approach......

[Ice Tiger]

I like it.

Basically I am collecting my non deliverable messages so I can email the user at the other end to let them know they have been trojan'd.

This is nice too though. :)

And to be honest, what Jury is going to convict you?

Re:Try this approach......

[SomeoneGotMyNick]

You could get busted for putting false credit card numbers in their forms pages

Does the law forbid using invalid credit card numbers, or using a credit card that's valid but doesn't belong to you? There's no value in a credit card who's number doesn't even exist.

Why this is a horrible idea.

[dentar]

1: They'll get blacklisted.

2: The spammers will eventually be able to find a way to test it first (like they have with everything else.)

3: It'll just suck up bandwidth and dump it to /dev/null.

4: Even if the idea did work in theory, there won't be enough people believing in the idea to make it actually work.

I used to do this manually

[bdsesq]

It was on an ancient DGUX system and I was having a bear of a time upgrading sendmail. Management had no clue they were running an open relay. -- "Whats that?"

So I stopped outgoing mail every night at 8pm, cleaned out the queues in the morning and restarted outgoing mail.

I had to keep the legitimate stuff but that it was not a problem figuring out what was legit and what wasn't.

After a few months I was able to install Red Hat -- end of problem, at least for a while..

Uh... No one reads slashdot anymore

[Anonymous Coward]

Well, compared to the numbers this site used to have, anyway. There are other sites that do a better job. Once taco starts caring again or steps down for someone who does, this place might start to smell better.

Re:Uh... No one reads slashdot anymore

[Frisky070802]

Heh. Well, regardless of an overall readership count, I think if I were a spammer, I'd periodically visit sites like /. to look at the "spam" category and see what's what. It might not be the only place I'd be looking for news, but it'd be one of them.

Attacking spammers with DOS

[flopiano]

Well, it's just an idea a friend of mines had some time ago and that could possibly work.
The idea is that instead of filter and trash mails from spammers (with any antispam sw), these mail messages should be fed to a software that extracts all web sites mentioned into them. Some kind of P2P network could then exchange these lists of websites and attack them with DOS. If the system spreads enough, when a new message is sent by a spammer his website will be flooded by millions of bogus requests (slashdotted), this antispam agent should just open a connection and keep it open without doing much traffic.

--
This is not a sig.

Re:Attacking spammers with DOS

[Urkki]

Standard response to this suggestion:
Then it'd be easy to get innocent web sites DDOSed simply by sending "fake spam" with suitable links.

Re:Attacking spammers with DOS

[DirkDaring]

Standard response to your standard response.

Then innocent web sites that have DDOSed by fake spam will bitch and cry and finally lawsuits will eventually hit spammers from the massive outcry.

Re:Attacking spammers with DOS

[eyenot]

that doesn't seem to be stopping blacklist database maintanence from supporting anti-spam products and services. the margin of error is already there, but so far all we do is lose mail over it. why don't we make it count? some people get lazy maintaining these blacklists because the only bad side-effect of their lethargy is somebody doesn't get their email christmas card (or does, bagh!)this way they will try to keep their lists viable rather than face potentially their favorite news or entertainment server from going down.

Re:Attacking spammers with DOS

[Urkki]

So who would be hit with lawsuit?

If suing the spammers would be an option, then why wouldn't they already have been sued a 100 times over for hacking people's home computers and all the other blatantly illegal activity that surrounds the spam business?

Re:Attacking spammers with DOS

[Urkki]

There's a difference between using blacklist to block something (ie some email) that comes to you, and actively going out and DDOSing other peoples servers.

It's like the difference between a boycotting a store that's on some blacklist undeservedly, and gathering a mob and lynching the shopkeeper who's store is on that list...

Re:Attacking spammers with DOS

[eyenot]

if the results of poorly maintained databases were network instability and sites being bum-rushed off the net, instead of a 'few'(^n) spams getting through or emails being mis-blocked you might get reliably maintained databases. you're only worried because you think somebody who doesn't deserve the 'lynching' will get on the list of people to lynch/shun/etc.

This has possibilities...

[I-R-Baboon]

Most ISPs now block port 25 so open relay spamming is on the decline. It is also part of the reason AOL implemented their blocking of non-registered or recognized mail servers. ISPs that do not often times do not are considered "Spammer Friendly" and placed on just about every BL out there for their IP block. (This also has the added advantage of curtailing SMTP engine toting virii) As also pointed out Email test probes will be added to the Spammer's aresenal of Poopsmith tools to verify they are able to send their shit out. This could however have a slight benefit of flawing their business model as it requires more time be invested for active true open relay verification and their email be routed through a mail server which might have spam filter running which may help to flag suspicious accounts sending the same or similar Spam to their box frequently.

What this also could be useful for is legitimate mail servers helping to track down Spammers as it runs the blackhole open relay to everything not in an approved IP scope or authenticating. Possibly allowing the single test email being routed back to the domain of the IP attempting to send and if a flurry of Spam comes reporting the IP to the abuse department of that domain along with the total attempt of Spam sent to the bit bucket. This could catch Spammers who get their email from their own servers and email from their ISP's mail servers or Spammer friendly servers to be BL and/or shutdown. Would be an interesting project as Spammers have to look for more ways to send their shit out and not use their ISPs mail servers and be shutdown. Lots of different ways to play with this program and the application of it to attack the business model of the Spammer and lure them into stupid mistakes that may lead to their imprisonment like they deserve so they can meet Bubba.

Give SPAM its own domain.

[darkwing_bmf]

I think all commercial and bulk email should by law be only sent from some new top level domain, ".bulk" for instance.

All mass emails coming from this domain are perfectly legal.

But...
Anyone who sends mass emails or soliciting emails from anywhere else can be sued for one million dollars per email.

That should be enough incentive for lawyers to gather evidence against real spammers, protect free speech, and give the users a real way to opt out.

Re:Give SPAM its own domain.

[Anonymous Coward]

Oh, right, like the bulk emailers will fall for that one. Hardware companies would take about a week to start selling routers preconfigured to shitcan any traffic coming from a .bulk domain.

Then we'd start hearing the spammers piss and moan about free speech and liken the creation of the .bulk TLD to a virtual version of the Jews' being herded off into concentration camps and exterminated.

I'm sure that putting spammers in concentration camps for orderly extermination is something we can all get behind, but it will never happen.

Re:Give SPAM its own domain.

[Anonymous Coward]

Yeah, but spammers aren't nearly as cute as the Jews. Think of cockroaches and buffalo. Not a whole lot of support for the cockroaches being saved from a nasty death.

(don't whine about the analogy, I'm a jew)

What's the value of spam? (slightly OT)

[Anonymous Coward]

In the discussion it has been mentioned again that spam should be fought by reducing it's value to the spammer. But I wonder, what is that value really? I wonder if it's always just people responding, or if there coud be other benefits for the spammer. Like who will respond to the garbled messages spammers sometimes send around (P*E,,n1_S etc.)? I really wonder, can there be other value besides people actually buying the product (or trying to, thereby revealing their credit card info)? Maybe the spammers are up to something completely different, that nobody has quite figured out yet? Ie for one over the top idea, maybe it's all just anonymous communication of criminal groups, and in P*E,,n1_S, the * and ,, are some kind of code?

Easily circumvented

[Tamor]

It's false to suggest that the spammer would have "no idea" that the relay wouldn't be passing on his spam. All he has to do is include a throw-away email address he has access to in the mail shot, if it arrives the relay was good.

Spamhole would have no way of knowing which of the millions of addresses being spammed was the relay test address, so it would be very hard to cirumvent.

Granted you may still cost the spammer some wasted time, but each relay is only going to trick one spammer one time, if they're smart.

Honey Pots

[catdevnull]

Seems like a good way to figure out which spammers are using open relays but they will probably figure it ain't working after a while and move on to a legitimate open relay.

Spam will go back down to a tolerable level when:

All mail exchanges require authenticated SMTP

When legit MTAs are all properly registered with DNS entries. Reverse-lookups on MTAs that don't resolve are usually spam. When we tried to implement this on our mail server, incoming spam decreased by 80-90%. But, our false postive percentage went up to about 2-3% because of lazy or ignorant or poor sys admins not registering their MTAs in the DNS. Maybe we can help evangelize proper MTA registration and hygeine amongst the poor and indigent .orgs, small businesses, and ill-equipped net denizens, eh?
You might see this revisited again if I get my mojo on for it.

yeah, right

[MasTRE]

This only seems like a good idea until you realize how dumb it is (i.e. spammer sends a test message).

interesting that you think they'll read responses

[eyenot]

much of spam, if you reply to it will result in your response being bounced back to you. they don't want to hear from you -- they want you to generate 'points' for them by clicking on the contents of the mail, believing it to be worthwhile. many of them get points for clickthroughs but a lot also get points just if you view the message and cause some images to be called from servers which track where the image was being requested from, so just looking at some spam will verify for the spammer that you exist on the other end. if you want to cram the spammer, you should just bounce back all their crappy spam but keep in mind that clogs the net, too. and most spammers don't even keep track of if their messages are bounced back to them or not, they keep sending anyways knowing that there are programs like mailwasher that give windows users options to bounce all their mail. they obviously can spare the time and throughput it takes to spam so many damn people that they can ignore the 'bugs' and just keep amassing larger and larger mail lists, and probably not hit a 'bump' until they are at around the 100,000 address mark. so, the idea of also wasting human time and ingenuity in responding to spam conversationally is bad.

Instead of putting your address in clear...

[b00le]

try Enkoder (also available as an OS X app), which converts your mailto: link to a javascript thingy which works correctly but cannot be read by bots. It's free.

Spam is NOT a technical issue!!!

[mnemotronic]

I'll keep saying it -- spam is not a technical, political, social, spiritual, or financial issue. It 's a "people" issue. It boils down to a human being saying or thinking "The rewards of sending spam outweith it's risks", making a choice, and pushing a button that makes it happen. To convice the spammer otherwise will require a different approach. What the ultimate solution is, I don't know, but (for most human beings) pain, and the fear of pain, is a very powerful motivator. Obviously, no "civilized" ruling entity would ever approve or condone such an approach. Well, except for the KGB, the Mossad, the Taliban, the 3rd reich, various South American governments, some Islamic states, the Chinese, the French revolutionaries, and probably one or two branches of the US "intelligence community". Did I leave anybody out?

Convincing people it isn't...

[supabeast!]

If it looks like an open-relay to a spammer, why won't it look like one to an ISP? I really don't want to risk getting my company tossed off of the net because some nerd at my ISP refuses to believe that I'm not running an open relay...

Solution Found!

[RoboLom]

We all agree that the SPAM Problem exists. It has not been solved yet only because it is not a problem for the people who could who really have the power to solve it ;) In other words, lets create more open relays and double or triple the amount of SPAM. My point is that we have got to reach a critical mass point before it explodes. Right now the SPAM just slowly expands and adapts .

distributed expected business as advertised for

[eyenot]

i think it's a better idea than responding conversationally as another user suggested we all do.

i would join your distributed network if:

1. the 'attack' (hereafter referred to as 'distributed activity') could not be construed as malicious, i.e. "we thought they really wanted all of us to request that url at the same time repeatedly and frequently -- why shouldn't we?" collective ass should be covered by pointing out that the recipient of the distributed activity was actually hoping to profit from it and expected it, just look at their business plan. if they weren't ready to do business with the world, they shouldn't have advertised.

2. any people hoping to beat your system couldn't just put urls they hate, or your favorite urls, or slashdot.org, into spam and mass-mail it, hoping that the system will turn against you. there would have to be some official board set up to verify that some spam was definitely spam hoping to profit by ignoring the recipient of the mail's concerns, and that they aren't just trying to juke you out. i suppose they could maintain and share spam blacklists as already occurs for some products and services, and use those as the basis for the distributed activity.

3. the program would have to intercept the url request responses and ditch them. i don't actually want to process the content of the site, i just want them to have to do the work of sending it to me and the 1,000,000 other participants in the distributed activity.

that being said, i'd like to sign up for your distributed activity as a beta tester.

Link spamholes to whitebox authentication

[deepvoid]

If you linked spamhole to a real mail server's authentication scheme, you could toss any mail that also appeared on any chosen spamhole. As long as a spamhole is not identified as such by the slugs that spam, a fairly quick culling of the spam from legitimate servers can occur.

No more email lists for sale. . .

[mntgomery]

retaining the original To: address for reference.

Lovely. So, spammers can install a spamhole and obtain the lists that all the other spammers are using to add to their database. At least that should stop the spam from people trying to sell their email lists. . .

Attack the business model

[dpilot]

This was a Slashdot article on November 17.
http://ask.slashdot.org/article.pl?sid=03/11/ 17/22 47251
(sorry, I'm a text-mode bigot.) I'd been thinking about this concept for a few weeks, and about submitting it to Slashdot when someone beat me to the punch. IMHO, it can be developed into a great idea, but needs some work. (That's why I hadn't submitted it, yet.)

This is kind of like the War on Drugs. IMHO, the War on Drugs is more dangerous and has worse side-effects than the drugs, themselves. Current efforts to fight spam are focusing on the spam, and are just breeding more clever spammers.

We need to take the war to the folks who advertise through spammers.
We need to harness the Slashdot effect for Good, instead of Evil.

The purpose of spam is to connect me to someone selling something. So let's connect. Let's ALL connect. Imagine a client that can go through my Mozilla (or Thunderbird) spam folder, and start accessing, via email or http. They would not be prepared for the volume of response.

So let's take these poor folks who advertise through spam and HELP them get to their tarket audience more efficiently, primarily by not targeting so many people who don't want their advertising. So in the auto-response is some sort of tell-tale, "LEAVE ME ALONE!!!" words that they can understand. Kind of like a 'Do not call' list, but more like, 'Do not call, or else!'

There are two downsides:
1: It generates extra net traffic, and might be even worse than the spam itself, in this regard. Such a spam-auto-response client would have to be carefully tuned, initially on the light side, and ramping up.
1a: A variation on this might be the tar-client. It would take a fudged TCP stack, but imaging not ACKing packets, or delaying ACKs to slow the traffic and tie up the connection. Harder to do than a classic tarpit, but something might be possible.
2: I could see spammers adding extra response addresses in to their advertisements, just to discredit this type of effort. I could see them adding links to the likes of IBM, Microsoft, and US government institutions so users of the clients would be responsible for a DDOS attack. Some sort of whitelist or extra filtering step would be needed, and any sort of whitelist would come under attack by spammers. (THIS is why I never posted.)

Re:Attack the business model

[ichandarin]

This sounds like a good idea -- or course, the fatal flaw would be that spammers would insert fake URLs into their messages which would then get DDOSed.

How's this for a possible treatment for this problem:

1. Use a peer-to-peer network to "harvest" URLs found in spam (someone already suggested something similar). These harvested URLs could be used to make a central database.

2. A real, live person could check through the spam-URL database, and then send lists of URL's that correspond to real, spamming companies to all of the computers on the network. Each verified URL would then be responded to by all of the computers on the network at once.

At least, I think that might work.

This may have some flaws, but addresses the major problems.

Re:Attack the business model

[dpilot]

There's a subtle difference, here.

Using a peer-to-peer network, as you suggest, is setting up and executing a DDOS attack. Never mind that they may deserve it, it's still setting up a DDOS attack, and is illegal.

OTOH, simply responding to their spam is just what they asked us to do. That may be a DDOS attack, but it's a self-requested one.

The place for a peer-to-peer network is in the whitelist - the places we DON'T want to attack. I fully expect spammers to include lists of innocent victems in their spam, as well as the desired recipient. Any spam-responder client needs to check the whitelist, and not respond to any of those addresses.

Next comes spammers trying to get their clients onto the whitelist, and whitelist attacks in general, just like they're attacking RBLs, today.

A more interesting approach

[neopipil]

This is a more interesting approach to fighting spam: http://smtpnic.org

Those "solutions" are actually not ...

[GNUALMAFUERTE]

Why?, well, because if you know how to install popfile, or spamassesin, or whatever, spammers are not interested on you. you are not going to buy them anything anyway ... so they just don't care. They care about all those windoze people outthere.. the kind of people that has a hotmail account, they are the only ones who can beleive theit shit. So, they are not going to stop SPAM. Even if we find a definitive techical way to block it, they will start to SPAM other systems, like MSN / ICQ, forums, etc,etc,etc. So, i suggest that we stick with spamassesin, and just forget about SPAM. For me, SPAM is just a few gigabites of montlhy transfer. I don't receive it, my custommers does, but who cares?, it's their fault. As i was satying, just transfer, ignore it, they won't stop spamming, it's a too fucking big business for them to just drop it.

Mabey YOU are the PROBLEM?

[Anonymous Coward]

If people would STOP purchasing products from spam, and hit and run marketing the spamers would have NO incentive to spam!

Also, as a defense until people gain awarness to the simple solution, wont the new Internet protocols fix this problem? IV6 that is?

later...

alligator

What A Good Idea

[moby]

So you write a program that sends a few select messages through the 'spamhole' to known good addresses, such as the spammers own, which not only verify that the relay is operational, but also trigger a mechanism to send the spam load through said relay.

This way, the spammer only has to send minimal messages to test relays, which then in turn do the dirty work automatically :)

Re:interesting that you think they'll read respons

[lamename]

"so, the idea of also wasting human time and ingenuity in responding to spam conversationally is bad."

Perhaps it is, but technology alone doesn't seem likely to stop it. We use SpamAssassin on our server, spam tools and filters on our clients, and still some spam filters through.

I am not sure I agree with the idea that they don't won't to hear from you. Somebody, somewhere is looking for a response. True, sending a reply might get bounced back, but the reason this stuff goes on is because it is economically viable. If they lost money every time they did it, spammers might go away. I don't claim this is the solution, just one possible method to try.

Surely this idea

[goldcd]

coule be developed a bit more. We all install a spamhole on our PC and then they all P2P themselves together to form, what I have decided to call, a 'Spamnet'
When one of our servers detects a spammer it communicates this to all it's little peer friends and they launch a DDOS for a few minutes. If the same spammer hits the same (or another) node in the Spamnet he gets hit for longer etc.
It's not a perfect idea (and probably illegal) but it would certainly get the attention of whoever is responsible.

Re:Surely this idea

[ender-]

You don't really need to go that far [into illegality], but you're on the right track.
Maybe have a spam-net and when one of the servers detects a spammer, it propagates the offending IP to the rest of the spamnet. You then can use that as an rbl or as firewall rules or whatever for your real mail server.

Ender

Re:Surely this idea

[Tjp($)pjT]

Obviously you need to contract this out to off-shore companies to implement. And run.

This is a joke for the humor impaired. Or is it?

Also worth a try: spampot.py

[Saint Aardvark]

Just set up spampot.py, a similar program written in Python. Details, if anyone's interested, are here. Still waiting for a hit, but it's only been up since Saturday; firewall logs show I get probed about once a week.

Christmas present idea

[glassesmonkey]

I like this idea for Mr. Ralsky - send a Christmas card

This is nothing new...

[KC7GR]

Google for 'honeypot' or 'proxypot.' In fact, Security Focus ran a series of comprehensive articles on honeypots, one of which is here. There's also a huge web site devoted to nothing but honeypots at this link.

Proxypots are a variation of the honeypot idea. A proxypot pretends to be an open proxy server which, instead of actually passing traffic sent to it, simply logs what's going on and sends the actual traffic to a specific destination specified by the proxypot operator. This can be Dave Null's in-box or anywhere else said operator wants.

Details of proxypots may be found here, and here, just to name a couple.

Keep the peace(es).

This application type isn't new

[ducomputergeek]

I worked for a DOD sub-contractor that was writing such "Blackhole" scripts to block email nukers exploiting military mail servers back in the day (circa 1997). It will help, but its not a cure all.

Human approval

[Anonymous Coward]

If you have someone on hand as tech support and the like, whats wrong with a tray icon flashing and asking them to approve a message? If it looks like a test message, let it through and whitelist the reciepient address. If it's spam, it disappears.

Available on Exchange 2K

[Kammak]

Oddly enough I have configured a similiar "feature" on Exchange over a year ago. Microsoft calls it a Mail Sink.. It requires some hacking but it serves the same purpose. Microsoft Knowledge Base Article - 315631

A better idea

[ftzdomino]

Just alter the mail RFC so that all e-mail must be at least 1 megabyte. Then it will get really expensive for the spammers, people with open relays, or ISPs which choose to ignore spam from stolen dialup accounts.

Re:A better idea

[garwain]

and kill all email for dialup users, and fill up the mail boxes and HDDs on mail servers... Would you rather deal with a few spam messages a day, or a few users with corrupt mail boxes an hour?

spammers don't care

[eyenot]

i don't think your suggestion is viable as a way of economically bogging the spam industry, due to the fact that there are very few spammers who really 'care' and many don't speak english.

as sure as you are that they're waiting to have a hallmark moment with their victims, i'm equally convinced that they don't even have an 'inbox' feature on their mass-mailer. it's too tedious to care what people say or want -- that's why spam is what it is, an annoyance that won't go away.

i'm not saying that your ideal of there being some kindhearted spammers out there in singapore is wrong. there might be, but addressing them in the hope of it causing them financial distress seems to be pointing the wrong shooter up the wrong hole.

first of all, if i did find any kindhearted spammers i would assume that they were actually employing some new emotional honeypot method. they want me to think they care, so i won't try something more drastic or painful.

but, if some spammer and yourself exchanged a few poorly translated words and got to know one another's concerns, i guess i would hope not that the conversation was intended to financially hurt anyone but rather was intended to emotionally hurt them. if you really actually find an open port to some spammer's heart, you should try to request they use their powers for good and crash the megacruiser into the death star.

i mean such an opportunity to touch a spammer's cold, spongemold heart is not going to be very useful as a financial tool but might have some purpose as an ideological one.

all this applies as well to the idea of passing yet more flailing laws against various forms of data or transfer. all that nonsense has to stop because frankly it's not how the internet or computing were formed in the first place. nobody 'cares' about abuse of laws to stifle what amount to annoyances, not actual damages. you don't have to open your inbox or accept mail from anybody not on your exclusive list of expected senders, but the stupid ass legislation gets passed anyways.

Re:spammers don't care

[lamename]

Well, I agree about the law part. I heard on the news this morning President Bush is going to sign some anti-spam bill today. Somehow, I don't think that will help either.

honeypot bearlist?

[Doc Ruby]

I'd like to subscribe to that honeypot's list of sender addresses, putting them on a list of addresses that require authentication before handling their messages.

Run this and get blacklisted by your ISP..

[Anonymous Coward]

And if I run a spam hole how do I communicate that to my ISP. They will shut me down if I am found to be running an open relay..

Interesting idea, but its better just get people to close up their real open holes....their mail servers too..

Incorrect assumptions

[UpnAtom]

Spam is of no value to spammers (or anyone else) whatsoever.
Spamming is sold on the hopes and expectations of the vendor/fraud. Either the vendor profits or they don't.

If they don't, there are plenty more idiots looking to get-rich-quick (blame capitalism ;)

Anyone employing a spammer is as guilty as the spammer, and should face the same punishment (torture ideally).

Been there done that

[kasperd]

With my own honeypot I was once able to collect 36 million spam mails over a periode of four days. That means I have (hopefully) stopped more spam mails than I will receive in my entire life. So I did my share of the spam fighting. And hey, I don't worry about those emails from spammers threatening to kill me.

Re:Been there done that

[qualico]

How did you get 36 million? That is a large number. Did you request any for testing or does that include ORDB testing?

Re:Been there done that

[kasperd]

How did you get 36 million? That is a large number.
It is a large number. During those four days I also performed nummerous adjustments to my system. I shortned the SMTP responses from my honeypot because I have a quite limited upstream. I adjusted the maximum number of simultaneously allowed SMTP sessions. I found ways to control the bandwith used for spam, so I could slow down the spam when I needed to use the connection for other purposes.

Did you request any for testing or does that include ORDB testing?
Any SMTP server on the net receives messages from spammers looking for open relays. And spammers do use databases with informations about open relays. I have no proof that they use ORDB, but another database who's name I don't remember. I had a simple heuristic for identifying relay probes, and after looking on them I relayed by hand anything I was confident was in fact such test messages. But AFAIR I have always avoided those from ORDB. The delay caused by this manual handling will probably not look suspicious to the spammers. That is what they should expect from a server feed with this large number of spam mails. Of course none of those spam mails ever reached their intended recipients.

Other spam fighting tools

[Anonymous Coward]

I have add spamhole to the eigenpoll at http://all-technology.com/eigenpolls/spamsoftware/

The result so far is:
Options Score Ranked by

sa-exim 0.717 1
Outclass 0.557 1
Mail Scanner 0.518 2
spamprobe 0.41 4
POPFile 0.41 1
SpamBayes 0.387 5
SpamAssassin 0.369 10
Vipul's Razor 0.004 0
Blackmail 0.004 1
bogofilter 0.004 2
Infinospam 0.004 0
Spamthis 0.004 0
Shovel 0.004 0
SpamBouncer 0.004 1
Declude JunkMail 0.004 0
spamhole 0.004 0

Oh that's no fun

[goldcd]

The p2p DDos attack has a beauty about it, I was thinking of the bodies own immune system. An antigen is spotted (spam) it's location is tagged and then everything piles on to smother, engulf and destroy it. Current solutions always seem to fall into two categories; Blacklist the spammer (which isn't working) or cleanup the mess he makes before it hits people's inboxes (merely cosmetic) - I'm entirely discounting the whole "Let's redesign the email system" as it'll never work.
People are quite happy to install quasi-legal software such as Kazaa currently. Make is spyware and bundle it with freeware, naked celeb videos and "Click here to install" whatsits on websites. The stupid people click to install the problem, the stupid people then click to zap it.

other solutions

[dstarfire]

obviously, I'm not the only one who's noticed the flaws in this idea. That said, I think I've already seen the perfect solution.

It was a few years ago here on slashdot, and somebody came up with the idea of making e-mail more expensive. For every recipient of every e-mail sent, the server has to perform some calcuation sent by the receiving server. For normal e-mail, and even legitimate commercial e-mail, this small calculation isn't a problem.

For spammers on the other hand, those 500 e-mails now take 5 hours to send because of all the calculations the server has to perform. This would make profiting from spam nearly impossible, given it's ridiculously low response rate.

OF course the only problem with this solution is getting it implemented. Would require a major modification to the existing e-mail infrastructure, and probably didn't look worthwhile back when spam wasn't as pervasive as it is today.

Re:other solutions

[eyenot]

charging miniscule amounts to send email that only mount up when you're mass-mailing sounds like a great idea until you work trojans and zombies into it, then you have people racking up bills and not knowing how to explain it. a server could analyze traffic and find the offensive email being sent to the zombie to mass-forward, but if the trojan decrypts the message first and then scrambles the key based on some seeded randomization shared with the zombie-lord, how will you ever prove that was the offending message? people will be getting screwed out of more money than they already are.

Seriously though

[goldcd]

you're absolutely correct. Use the spamnet to gather potentially dangerous IPs and then distribute them. Allow the mail server admin to decide what to do with the information. P2P model would allow a large net to be thrown and then also prevent a single attack point for those wishing to stop the distribution of the list.

Go after the businesses

[philv2]

I don't see why they don't target the businesses employing spammers, they're easy to find and most of them (unlike the spammers) are in the US. Make it illegal to use spam, and noone will employ spammers. This feels so obvious its probably already been mentioned mind you, or shot down.

SpamTraps create more Spam...

[qualico]

...at least the one I setup does. Try mail.koralta.com, I have it setup with an open relay. However, nothing is really relayed. What does happen is a parse of the messages to sift out IP addresses. The injecting IP address and the IP of any http references are automatically sent to ORDB and abuse departments of the upstream ISPs. The kill ratio is fantastic. Here is the problem. I had to throttle back on the reports because it just became ridiculous. There was more mail created by the system of reporting than there was by the spammers. It really is just a cat and mouse game. So far though, I've had my share of mice. :D

Re:SpamTraps create more Spam...

[qualico]

Oh I did forget to mention that using ipchains, I was able to block the injecting IP. Of course the spammer will simply rotate on the IP, however, I simply blocked the whole range. /sbin/ipchains -v -I input -s $blockipnet -j DENY -l blockipnet=`echo $blockip |cut -d"." -f1-2`".0.0/16"

spammers are actually DO open relay test emails...

[boldi]

Using "spampot" my only meassages:

data/spampot/2003-08# more new/1061044* ::::::::::::::
new/1061044252.1681_0001.eternal ::::::::::::::
SMTP-Date: Sat Aug 16 16:30:52 2003
SMTP-Sock: XXXXX:125
SMTP-Peer: 195.228.253.44:27125
SMTP-Hello: 195.228.253.44
SMTP-Mail-From:
SMTP-Messages-This-Connection: 0
SMTP-Rcpt-To:
SMTP-Rcpt-To:
SMTP-Rcpt-To:
SMTP-Rcpt-To:
SMTP-Rcpt-To:
SMTP-Rcpt-To:
SMTP-Rcpt-To:
Message-ID:
To:
From:jackbran3@hotmail.com
Subject: group4 is all over
Date: Sat, 16 Aug 2003 09:51:58 -0500
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1252"
Content-Transfer-Encoding: 7bit

049057053046050050056046055053046049053048 ::::::::::::::
new/1061044303.1681_0002.eternal ::::::::::::::
SMTP-Date: Sat Aug 16 16:31:43 2003
SMTP-Sock: XXX:125
SMTP-Peer: 195.228.227.189:2475
SMTP-Hello: 195.228.227.189
SMTP-Mail-From:
SMTP-Messages-This-Connection: 0
SMTP-Rcpt-To:
SMTP-Rcpt-To:
SMTP-Rcpt-To:
SMTP-Rcpt-To:
SMTP-Rcpt-To:
SMTP-Rcpt-To:
SMTP-Rcpt-To:
Message-ID:
To:
From:aliciadbethel@acmemail.net
Subject: group4 is all over
Date: Sat, 16 Aug 2003 09:52:50 -0500
MIME-Version: 1.0
Content-Type: text/plain;
charset="Windows-1252"
Content-Transfer-Encoding: 7bit

049057053046050050056046055053046049053048

----
So actually they check if the server works correctly... BTW the attached example shows, that they:
1. Searched for a simple proxy
2. Tried to connect to smtp servers in the same subnet from the proxy

so actually they don't want to find "open" relays but "semi-open" relays, , and those relays are not banned by most of the antispam lists (to reduce the number of false positives)

The obvious answer then...

[exhilaration]

Spammers aren't stupid, just evil.

... is to get the Vatican on our side!

Track IP addresses, not email addresses

[billstewart]

You don't really need the email addresses, because as another poster pointed out, many of them are forged. What you need are the IP addresses, and traceroutes to find one or two routers upstream to them, because that tells you what ISP the spammer is actually using, so the ISP can either whack their account (if they're a spammer) or get them to clean up their machine (if it's a hijacked zombie.) Sometimes that means the complaints go to the spammer themselves (so your spamhole gets outed), but if you're also hitting their upstream it's a good start.

If you want to get fancy, you can also do a couple of hits on any URL mentioned in the email - you shouldn't robo-complain, because spammers often put real email addresses in the spam as well, but it gets a bit of bandwidth drain, exercises all the URLs that the spammer might be getting clickthrough from (which is likely to get the clickthrough vendor to stop paying the web site or spammer), and generally shakes things up a bit.

Enough with this technical crap!

[EvilStein]

BAN deer hunting licenses. Issue spammer hunting licenses instead.
Tell everyone that there's no limit.
Tell everyone that the season just opened.

Spam will vanish in about a month.

Shoot the damn spammers

Paying someone else to do the crime

[UpnAtom]

If spamming is illegal, then surely paying someone to spam is equally illegal?

Why not....

[Dieppe]

Just have ALL SMTP relays act like this?

If you get one or two email within a configurable time frame (1 minute? 30 seconds?) the email goes through. If all SMTP ports were "honeypots" as such... perhaps the quantity of spam would drastically drop.

And, as a previous poster pointed out.. then you'd have all shards of glass looking for an SMTP port/service that wasn't so modified.

(That and I've always been partial to Mr. Gates one spam fighting idea.. delay sending of any one email by 3-5 seconds. Trying to send a million spam then becomes kind of a bitch.)

Blacklisting and spamhole.net

[Frank T. Lofaro Jr.]

www.spamhole.net is blocked by SurfControl. I just found that out this morning (the day this story posted) when I tried to go there.

Stuff like that makes me wonder how quickly one could get blacklisted for actually using the software.

POST, REFERRER, Sendmail.

[pr0ntab]

a) It is 100% likely that whomever wrote this CGI banger was doing so was just crafting a POST request and sending it... and that's it. No amount of checking environment variables or what have you can catch that as the entire transmission can be faked by watching what a real webbrowser would send (including session cookies)

b) Thus, the only way to prevent formmail from being abused is to make sure that the form fields should be treated as completely hostile, and the email should be recrafted explicitly to contain it. If you are expecting UTF-8 input on your fields, you should ensure you use a MIME-multipart mail format and set the appropriate encodings to prevent misinterpretation/errors in the client (cough Outlook cough). Otherwise make it all US-ASCII and strip out control characters or ones with special meaning from each form field.

c) Log. Log everything. Make the script rate limit itself too... there's always the possibility of DoS.

Additional Spam fighting Ideas I use

[mycal]

Have a phony account or two on your system that you keep email addresses on the web and usenet, use these email accoutn to gather spam to run into spamassasan to make its filter better.

filter all cable and ISP customer IP's. This would be much easier if the stupid providers reversed DNSed there IP's in a reasonable way.

Bad Name:

blabla.cable.east.comcast.com
blabla.dsl.sf.pac bell.com

Good Name:

blalbla.east.cable.comcast.com
blabla.sf.dsl.pa cbell.com

been done: Spam Can

[KalvinB]

Spam Can

It gobbles up any e-mail sent on port 25 and logs everything from the e-mail itself, all the headers and the originating IP. It doesn't care where the e-mail claims it's comming from or where it's supposed to go.

I'm not sure why this is an "open" project since Spam Can was thrown together in VB in about an hour. The most difficult part was getting it to go to the system tray.

The obvious problem is that you can't run this and a real mail server at the same time. And real mail servers (like Mercury Mail) can already do catch alls.

And if you're not running a real e-mail server, why run a fake one to waste your own bandwidth? Good luck convincing millions of people to run these (without having a tell that spammers can look for) making looking for open relays not feasible.

Spammers also already know right where to get a valid relay; They get a nice e-mail from the infected machine.

Ben

NO WAY!!

[ewhenn]

blocking SMTP traffic going elsewhere than their own mail server etc.

I guess that means if I have a webhost I can't use their SMTP server to send mail for my domain. Espcially considering my ISP has a crap SMTP mail server (As we speak Adelphia's SMTP will only let you send to the adelphia domain).

Its still stupid

[autopr0n]

So what? The spammer could just send a few hundred spams before the actual test message. if the Test Message does go through, so do hundreds, or even thousands, of SPAMs. If it doesn't go through then the spammer gives up on that relay.

This is the most pointless anti-Spam system ever. In fact, its worse then nothing. If everyone was running these things then spammers would have an infinite supply of 'soft' open relays they could use to send hundreds of messages through!

Besides, most Spam is sent through open proxies, not relays now, and hacked machines.

kill all spammers

[Anonymous Coward]

The spamhole could use a combination of Bayesian filtering with Hidden Markov Models to renumerate potential test addresses with exponentially decreasing returns, such that the k-tuple value Z1 was never equal or above the Nth degree of reductionist SPAM (SPre). This would thus allow network strategist to implement a theory-based approach to network spam usage, thus continuing ad-infintum the ARMS RACE.

too much work. what we need is a crazy person to start hunting spammers. crazy person to find alan ralskys kids swinging on the playground and take them out.

write your congressman. demand that they define a spammer as sub-human. then we can all go hunting. would be so much fun.

PHP and SMTP

[KalvinB]

I have a web-form and use a simple PHP script that is hard coded to go through my mail server and my mail server requires a valid POP3 login from the username you plan to send e-mails with prior to being able to send e-mails with it. You get a short window of time once validated and even then you must send the e-mails from the same IP that validated the user name. So you can't figure out what e-mail address is being used, send a message from the form and then spam away with that e-mail address remotely.

And on top of that the function that sends the e-mail is seperate of the pop3 function so even if you managed to figure out how the script works, you still couldn't abuse it in any way shape or form. All the security depends on the mail server itself.

And then from my form the script that uses the SMTP/POP3 script can only send messages to a single hardcoded address. It also can't do BCC or CC's. I'm considering doing an anonymous e-mailer with it but I need to work out details before jumping off that cliff.

"that was an extra the customer had to pay for"

That should be an extra the customer has to pay to get ACCESS to. You should be logging regardless. It's just diskspace and if the customer isn't paying you can clear the old logs on a X day basis if nothing exciting is happening.

Setting up a secure form mailer is rediculously easy. And with PHP I can use my script anywhere. I don't need to set up funky permissions. I don't know what formmail is doing that could possibly allow it to be hacked in such a way that an attacker couldn't just go right to the mail server and accomplish.

Currently, my log analizer is custom made and logs all formmail attempts sorted by IP. It used to be pretty bad. So much so that I reported a number of people. That's died down now though since they've finally realized I don't have formmail on my server in any form. I don't even have Perl installed on my server anymore. PHP only.

Ben

Really?

[autopr0n]

I've noticed a massive increase in the amount of Spam I've been getting in the past month or so, I guess in preparation for the "holiday season" or maybe the email apocalypse has finally come?

Spammers arn't stupid

[autopr0n]

The people doing Spam these days aren't stupid, which for some reason a lot of people seem to think. People shouldn't bother to come up with anti-Spam systems if they can figure out an easy way to counter this. The way to counter this is super-easy:

Send one thousand spams, and then one test message. If you don't get the test message, then it's a fake relay. If you do, then you've just successfully sent a thousand spams! I mean, come on. This system would have to at the very least allow one Spam message to get through.

And in any event, most spammers use open proxies now, not open relays. This might have done something if it were implemented in 2000, but now its useless.

Re:Spammers arn't stupid

[Anonymous Coward]

Spammers are fucking idiots, actually.

They don't know how any of this works. They don't know TCP/IP from a hole in the ground. They can barely find the ON switch. They know nothing about the Internet and have to strain their intellectual powers to the limit just to click on a button that says "SPAM."

Even if they were as clever as you seem to think they are, the spamhole system would still cost them time and effort, and reduce their output.

I think the spamhole system is a good idea and worth pursuing. It's not the whole solution but it can help.

Could be used to harvest addresses

[Caffeine Pill]

My fear would be a spammer (Spammer A) getting this, modifying it to not only block, but also log all of the e-mail addresses that the spammer (Spammer B) is trying to send to. Then, bam - Spammer A has just quadroupled his spam list.

number 1

[KalvinB]

You run the spamhole or whatever on port 25 and run the mail server on port 26. The spamhole does it's custom checking and logging while forwarding everything to your actual mail server. Outside it's completely transparent. I use RinetD to allow my mail server (coloed at a second ISP) to work on 2 ports to get around my home ISPs port 25 block.

But yes, I've done such a project myself and it is really quite pointless. There nothing it can do that my mail server can't handle itself. And I don't have a second system running 24/7 that would be worth putting my SpamCan on to see if people are attempting to use my system as a relay.

Highly unlikly considering the entire residential Cox network has outgoing port 25 blocked and I'm sure spammers are aware of that.

Ben

Congrats!

[autopr0n]

Wow, the throw-away, automatically generated hotmail account that the spammer check once and forgot about. I bet you sure would feel special knowing that!

Re:Congrats!

[Syberghost]

Wow, the throw-away, automatically generated hotmail account that the spammer check once and forgot about.

Yes; that he checked once, from an IP address now available by supoena.

Spam = Terrorism

[CrashVector]

For X-Mas sake! Just declare all SPAM a terrorist attack designed to make all people in America angry and disgruntled. Then sikk John Ashcroft on the spam bastards - they'll be destroyed in a week...

Re:Spam = Terrorism

[Anonymous Coward]

Destroyed like Saddam Hussein and Osama Bin Laden are? Alrighty-then!

Yes

[autopr0n]

Hormel should be happy, as it applies to both UCE and SPAM lunch meat.

Why would use a nuke against a house?

[autopr0n]

There would be a lot of collateral damage, and probably throw the bush admin into a hussy fit. A conventional bomb would be fine for blowing up a house. You would need a pretty big one, though.

Re:Why would use a nuke against a house?

[herrvinny]

Well, nukes are just more fun than conventional bombs... I would have said use one of those 100 megaton nuclear bombs we have strapped onto ICBMs, but that seemed a tiny bit of an overkill...

I suppose if we really needed to be sensitive to all those human rights groups (I know what you're thinking: spammers have rights?... But I digress) we could always call for a special ops team to break into Ralsky's home, run into the basement, use their M16s against the computers, make sure every hard drive, CD and data storage device is completely trashed, then just get out of there. No loss of life, and one spammer that has to start from scratch...

I have to admit though, it pisses me off that he's living so well out of causing other people trouble...

Carefully consider using this...

[cymen]

The whole "honeypot" idea isn't exactly new but for those that haven't consider the implications of setting something like this up--it may not be a good idea to do it on your current mail server. While it will catch spammers, it will also get you on open relay lists and suddenly a lot of your outgoing mail may never reach the recipient due to anti-spam measures that many sysadmins place on their
servers.

Now if you have a static IP that you don't mind tainting, go for it!

Sshhhh......

[Anonymous Coward]

Be vewy vewy quiet... I'm busy hunting spammers.

What if you already have a mail server?

[pilot1]

This seems to be a good idea, and while I would love to do it, I'm already running a mail server.

Is there any way that those of us that already have a MTA running on port 25 can run this too?

MOD PARENT DOWN

[Anonymous Coward]

thx

My solution is simple, really

[astrawinski]

I run my own mail server (sendmail currently, postfix when I get around to it). I create a virtual user whose name represents the site/mailinglist/newsgroup/etc I'm giving my email address to. I have over a hundred such users at the moment. For example, if I'm signing up for a newsletter at xyz.com, I create a virtual user like alan.xyz.com@mydomain.net. In this manner, I still get my newsletters and all is well. If they sell my address, or if my address is compromised in any way and I start receiving spam addressed to alan.xyz.com@mydomain.net, I know who the spammer got it from. From here, I can either create a new virtual user, update my preferences and continue to receive their newsletter, or (more likely) just nuke the virtual user and be done with it. No more spam.

I do have a real email addres. I deny all by default, and only allow specific whitelisted senders through (friends, family, coworkers). If somebody sends me email to my real address, and they aren't whitelisted, a reply is generated that politely directs them to a form on my website. They fill out the form letting me know who they are. If I deem them worthy of sending me email to my real address, I add them to my whitelist. My own email address is not whitelisted. This prevents spammers from using my address in the FROM: field in an attempt to circumvent the system I have in place. If I need to send myself something, I do it from another virtual user.

If a whitelisted individual keeps abusing me (constant virus warnings come to mind) I just remove them. Ditto if some worm is going through their address book. If this happens, I create a virtual user just for them let them know that this is the address they have to use if they want to email me. If their machine gets compromised again, I just nuke the virtual user and create another one for them.

I haven't seen spam in ages. The beauty of using virtual users is that all email is delivered to one place. It makes creating rules that organize my mail easier as well. Currently, I have to edit /etc/mail/virtusertable every time I need to add another virtual user. If I ever get the time, I'd like to create/implement (is there one already written?) a nice web interface that allows myself and others to manage their virtual users. As it stands right now, only two of us do this on our mail server as root privileges are required. The other users in the 75+ domains we host would probably love this.

Anyway, that's what I do. I've been spam free for quite a while now. This doesn't address badwidth issues with spammers attempting to use my mail server as an open relay or attempting to send email to users that don't exist, but it has kept my inbox free of spam. Would educating the public be a better solution to spam? Probably, as spammers profits dwindle. Unfortunately, I have neither the time nor the desire to start any sort of information campaign. This simple technical solution works and only took a couple of hours to set up.

That's enough to trick 90+% of spammers

[billstewart]

Some spammers write their own spamware, but most are just customers of spamware vendors, and most of those spammers are going to buy whatever spamware is best advertised, without worrying about every detailed feature. Most of the potential open relays out there today either accept the message and try to deliver it, or else refuse to relay and report a proper error message, so lots of the spamware won't even bother sending test messages to see if they're delivered, because getting a positive response from the suspected open relay is good enough. Some of the more sophisticated spamware probably does check, and the big professional spammers are more likely to have that, but it's going to cost more than dumb spamware and the anklebiters aren't going to bother paying extra for it. Sending _lots_ of test messages interspersed with the spam is yet another level of complexity. It's probably worth adding to high-level spamware, because it lets you test whether your relay is still open and unblocked _today_, but again, that's a fancier and more expensive feature than the anklebiters need, because they're going to 1) rip off a relay, 2) send their 10 million pieces of junk, 3)...., 4)Profit! (or not), and if step 4 doesn't happen, they'll eventually give up.

There's going to be some arms race with the spamware vendors, but running a zero-message threshold is good enough for a lot of the spammers today, and running a one-or-few-message threshold is good enough for a lot more, and unless spamholes become much more prevalent than genuine open relays, that's enough to kill most of the anklebiters and discourage some of the big vendors.

Not enough, but...

[herbierobinson]

I don't think this will do much good by itself, but I can think of three things that would make much better:

1. Combine it with a proxypot so it looks like there is an entire network of open mail servers out there.

2. Involve legal authorities in designing the tools so the ttols provide enough logging to result in a slam-dunk conviction of the spammers.

3. Work with said legal authorities to have the spammers arrested.

Unauthorized use of mail and proxy servers is illegal. The problem is collecting enough evidence. A combined mail and proxy sever system could probably do that. Also, involvement of law enforcement could get one a special IP allocation that doesn't mind being blacklisted. [You DO want the honeypot servers blacklisted, after all: It will make them look more like the real thing.]

Relaying ONE message doesn't hurt

[billstewart]

Open relays are an advantage to the spammer because they can dump one copy of the message lots of addresses to the relay and have _it_ expand them out to all the recipients, so they get a big multiplier effect as well as a layer of obfuscation. But if you only relay one message per spammer, there's no big multiplier effect, so there's not a lot of point in using a relay, and there's not significantly more spam in the world than if you didn't relay any. On the other hand, if you relay one or two messages and silently eat 100,000 more, there's lots less spam in the world.

And if your fake relay includes a bit of delay, say one second before responding to some of the messages, that spam will take a lot longer for the spammer to send out, reduce your bandwidth load, and (if you're tracing and robo-complaining to the spammer's ISP), give you longer to trace them before they vanish.

We put up with this because dingbats order stuff.

[human bean]

If nobody bought anything advertised by spam, then folks wouldn't even use it. The fact that it exists tell me that somebody, somewhere, sent off money or value enough to fund the spam generated.

STOP IT!

1. Never ever buy anything from a spammer, and let all you friends know it.

2. Set up open relays that modify the messages sent by them at random intervals. Insert an educational advertisment letting the recipient know that purchasing anything advertised by unsolicited email is evil, and that they screw it up for themselves and the rest of us when they do.

Add some delays to reduce bandwidth

[billstewart]

Teergrube is an anti-spammer tool that implements SMTP with long delays and occasional error messages, so spammers who hit a teergrube waste a bunch of their time waiting for ACKS instead of sending spam. (It's mainly intended for honeypot addresses, not real ones.)

You could apply the same kind of technique to spamhole - adding one second of delay per message to your SMTP responses is enough to drop a bunch of 3KB spams to about 24kbps (and almost all the bandwidth is inbound, so if you're on ADSL or cable modem with a slower upstream, it won't bother you, unlike a _real_ open relay which would be transmitting N copies of spam for each N-recipient message received.) More delay -> Lower bandwidth!, and you're wasting the spammer's time. You'd probably be better off adding a bunch of sub-second waits during the session rather than one long wait, in case it's checking for timeouts, or if you want to get fancy, don't do the waiting phase when you're giving the spammer their one free test message.

One test message doesn't hurt much.

[billstewart]

Open relays are an advantage to the spammer because they can dump one copy of the message lots of addresses to the relay and have _it_ expand them out to all the recipients, so they get a big multiplier effect as well as a layer of obfuscation. But if you only relay one message per spammer, there's no big multiplier effect, so there's not a lot of point in using a relay, and there's not significantly more spam in the world than if you didn't relay any. On the other hand, if you relay one or two messages and silently eat 100,000 more, there's lots less spam in the world.

And if your fake relay includes a bit of delay, say one second before responding to some of the messages, that spam will take a lot longer for the spammer to send out, reduce your bandwidth load, and (if you're tracing and robo-complaining to the spammer's ISP), give you longer to trace them before they vanish.

Why Vigilante Killings of Spammers Are Bad

[gbulmash]

I've seen at least one post suggesting that the solution is to kill off a few spammers... whack 'em... and let the rest live in fear that vigilante anti-spam hit men will find them and put a very permanent end to their noxious activities.

This might slow spam, but it could easily increase spam even more. Every geek with a delusion that he's a bad-ass hacker would start trying to frame his enemies as spammers.

I wish it was as simple as intimidating spammers with the long arm of super techno-ninjas who would spike their Mountain Dew with rat poison. And said solution does have a really satisfying visceral feel. But like many things, it would be ruined by friendless queebs trying to turn it to unintended uses.

Anyway, shouldn't we save our true fanatics for attacks on the checkpoints around SCO headquarters?

Greg

Re:Why Vigilante Killings of Spammers Are Bad

[sik puppy]

The worst offenders are already known, such as Ralsky. I'm sure almost everyone here would celebrate his demise, and the slower and more brutal, the better.

ISPs were a different problem

[billstewart]

The RBLs are actually trying to find open relays.

The ISPs that did this were trying to find anybody using SMTP at all, because that might be a *business*, and therefore should be paying them *much* more money than a home user, just as a few of the worst greedy cable modem companies blocked VPNs, and most of them block web servers because those might actual *gasp* use bandwidth. DSL providers that aren't run directly by local telcos are less likely to be that stupid, and some DSL providers have the clue that "Of *course* we'll let you do lots of interesting things with your bandwidth, that's why you're buying DSL."

Even @Home's employees mostly realized that Napster was one of the big reasons people bought broadband, so while their official corporate mantra was "Napster .. Bad... Destroy!", they were happy that it was around.

Who's that stupid?

[3rdParty]

Yeah, "I know how to stop spam - set up open relays! Only they aren't open relays! And the spammers never know! They'll never know! Because we don't tell them! So they never know! And they keep trying to send spam, and it doesn't work! My sides hurt, I am giddy with inspiration!"

No, you are giddy from lack of oxygen. That is similar to letting people steal from you, so you can catch theives the next time they steal from you. Kind of stupid, if you think about it for a second or two. A much better idea would be to block open relays, and automatically block emails with random chars, Viagra, or "Remember me?" as a subject. Maybe include the words mortgage, pay, party, naked, sluts, girls, offer, free, special, ........., in the block list. Seriously, who sends a legitamite email that has the word Viagra in the subject? Not even Viagra salesmen, I'll bet.

Clueful ISPs attract people who'd run this

[billstewart]

Unfortunately, there's some negative feedback here, because the kinds of people who'd run Linux and especially who'd run interesting applications like this one and who like attacking spammers tend to get their ISP service from clueful ISPs that are going to detect this kind of problem and work quickly to shut down spammer tools... The kinds of ISPs who don't care about it are usually the kind that you don't want to bother dealing with if you're more than a couch potato.

But you have to wait or SMTP fails

[billstewart]

Maybe you spend some time detecting timeouts and avoiding hosts that don't respond quickly, but you can't overdo that or everybody will add that to their SMTP servers to discourage spammers. But even adding a second of delay at the end of a message is enough to crank your bandwidth drain down a lot and slow down the spammer's average load. And if the spammer is getting a 10:1 multiplier by feeding your relay 10 recipients per message, they won't be surprised if you're only accepting incoming spam at 10-12kbps because that'll fill up your average cable modem or ADSL upstream, and it'll happen by adding random delays to the response time. So go ahead and add a bunch of 100-200ms delays per packet (especially per RCPT TO or per line of message body, since SMTP handles data a line at a time.) If you want to add a bunch of longer delays, see how much you can get away with.

Too bad there's no "FAKE RBL" for Fake Relays

[billstewart]

I know it can't work, but it would be really nice to have a Fake Relay Blocking List, so that ISPs who find your honeypot can look it up on the FRBL list and leave you alone, without spammers also looking it up and finding that you're hacking with them.

But if there *were*, you'd *want* to be listed on it so the spammers wouldn't bother you. But then the spammers would guess that you were a Fake Fake Relay, and try out your machines anyway, so you'd need to fake them out again by claiming to be a fake fake fake relay....

/. the spamers

[Anonymous Coward]

What if every one created a hit or two per day to the web site selling the goods. 10x the bandwidth requred to keep the site up and no increase in sales. Would waste some of my bandwith but if we all did it...

No Sense.

[spence2680]

I fail to see how setting up fake relays will really cause any prolonged resolution to the "problem".

This is analogous to saying, "Because of all the drunk drivers, let's build more roads!"

Obligitory Wargames Quote, Etc.

[inKubus]

Joshua: A strange game. The only winning move is not to play. How about a nice game of chess?

I say we say "fuck it" to email and redesign the whole system. A centralized model, run by the postal service. Thus, the order is restored. The government can impose proper restrictions and regulations, and spammers will be held responsible for their actions. All at the price of a little freedom and privacy that's mostly a farce anyway, considering the FBI spent a little over 500 million on Carnivoring the entire net under the guise of the U.S. Patriot act. Get real people. There's no need to fight. You've been controlled your entire life, and you've never even known it. The solution to spam is simple. More laws, more regulation by the system. Otherwise it's us against them, and it's just soooo inconvenient to have to delete a few spams. As the parent post says, fighting it will just make it worse..

If you are a privacy advocate and you're lazy, you deserve to suffer. If you really value your rights and freedom you have to do something sometimes. In this case, you either fight the spam with local mail filters, live with it, or wait for the government to run the mail service and ban public/private SMTP networking.. This is the only real solution, as the parent poster so eloquently has proven. W.A.S.T.E.

Atollo, #1 Toy for 2003 in Consumer Reports!
#1 Place to Get Atollo:

Re:Obligitory Wargames Quote, Etc.

[Anonymous Coward]

Oh, joy. An Internet that would work as efficiently as the Post Office or Department of Motor Vehicles, with the added bonus of the unblinking panopticon eye of Big Brother staring over every shoulder.

Fuck that noise. I'll get my bandwidth with two cans and a string before I participate in THAT.

Stupid.

[Lord Bitman]

And so Spammers' automated scanners will.. ignore you because their message doesnt get through. Good for you, idiot.

A real solution

[Anonymous Coward]

This idea won't work. Spam filters don't work. Bayesian spam filters don't work better than most, but they still don't work.

I worked in the research dept. for one of the first companies to offer mail/web filtering products (Content Technologies Ltd.) several years ago; we thought hard about a whole bunch of security issues including filtering. Guess what? It doesn't work!

But stopping spam is really easy provide you forget about this nonsensical idea of filtering. Here's how it should really be done:

By default, don't deliver mails from anyone. Instead, send them a reply with one of those image tests that only humans can decipher. If they pass that (i.e. if they are human), welcome them with open arms; provide them a unique private email address (cryptographic hash) by which they can contact you, that is only for use by them, and not to be disributed (they can give their friend's your public address if they need to). If they distribute your private email to the web and you get spam, disallow that hash, and they will have to re-sign up to talk again -- you warned them right!

The only problem with that is the inconvenience of talking to new people, and that you will need a quick way to create your own hashes for mailing lists and email newsletters, although RSS seems to be taking over for newsletters.

Have I missed anything?

Re:A real solution

[Anonymous Coward]

Ah, yes, "Challenge-Response." Been tried, been discussed to death on SPAM-L and in n.a.n-a.e, isn't practical for many reasons. Not only would it consume tremendous bandwidth, but also the spammers would hire people in Bangladesh to spend twelve hours a day squinting at the screen and clicking on links for ten cents a month, just to get you to whitelist the email address that's about to send you a very important message about how to enlarge your penis.

Seeds/Spikes

[dindi]

Well the idea is nice (not new IMHO) , but has a big problem: SPAMmers use seeds in their lists (some call it spikes). They put their own email addresses into each list (let's say every 10.000th address is their own) so they know if 1. the list is stolen by an other scumbag, 2. they get a "ring" when 10.000 mails are sent.

By the way, people put their own addresses in customer lists, so when their provider (or whoever else) steals their DB, they know who to go after.

Where do I know it from? - worked for companies involved in spamming - I admit, but i swear I never sent out 1 single spam mail, and I hate SPAM more than ... ahmm ... spammers :)

PGP require encrypted mail.

[PzyCrow]

If all mail where required to be pgp encrypted, spam would take a hit.

Consider the cpu power needed to encrypt 10.000.000 mail... costs money.

Better than most think

[Derkec]

Many are argueing that spammers will be clever enough to eventually figure out which spamholes are indeed bogus. I think that might be fine. By making them spend the time to find, use, fail and retest you've made their life harder and their spamming more expensive. That's where the victory is, not in any given spammer failing long term.

If spamholes are used en-masse spammers will have to spend increasing amounts of time to find legitimate open relays. This is a similar approach to what the RIAA is doing with seeding P2P networks with trashed files. While once you download a song, you can see it's bad, you become frustrated and the value of the service declines.

We can't keep spam from happening, but we might be able to make it financially and emotionally not worth it. Part of this effort, of course, is educating people not to try it out or using technology to filter it away before some idiot buys herbal viagra. The other part is messing with their technology like this, calling their 800 numbers, pressing lawsuits that cost them attorney fees etc.

It's a guerrilla war, I hope we win.

What?

[autopr0n]

No, actualy you are the one who's stupid. did you even read this article posted this very day? Spammers don't give a fuck about open relays. These days they are using open proxies and ownzored boxes. This won't cost them any time, and do some of their work for them. If spammers were truly idiots, they would have been stopped by the simplest filters and preventions. God damnit if anyone one of us here can think of a work-around, so can the spammers. And plenty of us have.

OpenBSD's spamd

[RazzleDazzle]

This sounds a lot like OpenBSD's spamd program. Check out a possible use of it like spamhole.

SpamHole, on a related note

[RoC MasterMind]

SpamHole.com also offers a cool 2 hour temporary email redirecting service. Very useful when signing up for things.