Spamholes Fighting Spammers

mike9010 writes "A person named I)ruid has come up with an ingenious way to combat those spammers. His program, spamhole, creates a false 'open relay' that the spammer thinks he/she can send messages through. The messages then get sent nowhere, and the spammer has no idea. "spamhole is an open project. Hopefully, through user's and developer's contributions, we will amass a collection of spamhole implementations spanning all commonly used platforms, programming languages, etc. Ease of configuration and use are the primary objectives, for the easier to use by the non-techical layperson the implementations are, the more widely adopted and used spamhole will become.""

Comments

How can this work?

[corebreech]

Spammer will just send email to himself to make sure relay works. The author claims that the defense against this is to allow the spammer limited access in the beginning, but there's no way to uniquely identify the spammer, and in any case, the spammer can just continue to include himself in the mailings, so he'll know when the relay has been configured to deny him access.

This system will only increase the number of open relays out there.

The story of the hare and the briar patch comes to mind. Is this the idea of a spammer who is pleading with us to please not create all these open rel..., er, um, spamholes?

Re:How can this work?

[Anonymous Coward]

Spammer will just send email to himself to make sure relay works.

Most spammers use automated tools to fire off a huge amount of messages. They wouldn't likely bother with sending a message to themselves.

But if the spammer did decide to validate the server, it means he has to find another open relay. If there are a ton of spamholes out there, and few real open relays, then the spammer will have to waste an enormous amount of time searching for a relay he can use.

This system will only increase the number of open relays out there.

How is that? The spamhole isn't relaying anything... that's sort of the point.

Re:How can this work?

[kinnell]

but acts as a real one until the spam starts being sent

Yes, but if the spammer sends test emails alongside the spam, they won't get through, and he will know it's a spamhole. This system will likely work well until the spammers realise that it is being used, after which it will be easy for them to hack their way around it.

Re:How can this work?

[arcanumas]

So, if it will allow a few "tests" to go through, i am afraid that if it were to become popular then a spammer could use many many different servers to send his spam. A few mails each.

Distriuted spamming of some kind :)

Re:How can this work?

[Urkki]

• I don't. Spam eats up bandwidth just being delivered, even if it gets filtered at the end anyway. Then, you have the idiots that sit and open it and wait for images to load in their HTML-enabled mail clients. Despite this, from a technological standpoint, although it chews up and wastes valuable resources, it won't bring the Internet to a complete screeching halt.

Don't count on it. There are worms that spread to create spam relays, and then those relays send spam. Potentially this leads to exponential growth in traffic...

Re:How can this work?

[Anonymous Coward]

So if there are 9,900 spamholes out there and 100 true open relays, the chances of a spammer picking a spamhole on their first shot is 0.99. Now after a short while, they realize it's a spamhole so they move to another "open relay". Now they have 9,999 choices, of which only 9,899 are spamholes. Their chances of again picking a spamhole is 0.9899 (repeating) and so the chances of them hitting a spamhole on both of their first attempts is 98%.

Now consider a spammer who's hit 100 spamholes searching for the real open relays (this will happen about 36% of the time in this example -- still better than a third of the time.) They've wasted a decent amount of their time trying to send their spew through the spamholes, and they've still got a 0.98 (repeating) chance of hitting another on their 101st chance, assuming they continue.

This system would work not by making it impossible for spammers to find open relays, but by making it improbably for them to do so and therefore forcing them to do more work.

Re:How can this work?

[Marcus Brody]

This is a total Arms Race.

The initial test email would highlight the spammers test email address. All email to this address would then be allowed through the spamhole, giving the impression to the spammer that everything is hunky dory.

However, the spammer may use multiple test addresses, and the spamhole would not then be aware of these.

Therefore the spamhole could check for any addresses that were used frequently/periodically, and mark these as test addresses.

But the spammer could use a more complex set of test addresses.

The spamhole could use a combination of Bayesian filtering with Hidden Markov Models to renumerate potential test addresses with exponentially decreasing returns, such that the k-tuple value Z1 was never equal or above the Nth degree of reductionist SPAM (SPre). This would thus allow network strategist to implement a theory-based approach to network spam usage, thus continuing ad-infintum the ARMS RACE.

The result of this is that both spammers and anti-spammers remain in bussiness, spending exponentially increasing efforts attempting to thwart the efforts of the oposition.

Definition of a game: "A constructed conflict with quantifiable outcomes"

Ever get the feeling that the anti-spammers enjoy this whole malarky just as much as the spammers?

Maybe the answer to spam is this:

STOP wasting money and resources on using incresingly sophisticated anti-spam techniques. Re-direct this money into basic education for users, including short courses on:

1. How to identify a spam (People are proven to be far better at pattern recognition than Bayesian models).

2. How not to click on a spam.

3. How to delete a spam.

If AOL, MSN, and all other involved parties put a concerted effort towards this, then spam would soon get diminishing returns, and hence become increasingly unprofitable.

Re:How can this work?

[Syberghost]

Spammer will just send email to himself to make sure relay works.

Yes, and then when all the spamhole users compare the addresses attempted to send through them, they'll have a valid email address for the spammer.

Re:How can this work?

[FiloEleven]

How about redirecting money into the hiring of Hit Men to get at the root of the problem? After two or three spam queens get knocked off, I think it may dawn upon the rest that spamming isn't such a good idea anymore...

Re:How can this work?

[Marcus Brody]

Taking these thoughts further, 99% of spam bussiness is based around "Trolling for Newbies".

We have to think outside the box with the spam problem, and this fact may be a novel way to counter spam. Almost all people i know who have been "conned" by spam had been new and naive email users who had got excited becuase they had recieved email.

We may look down on such users, but we were all naive once, its just that spam wasnt around when most of us lot started using email.

Therefore, I suggest, all email services should provide a useful "introduction to spam" tutorial BEFORE users are given an email address.

Re:How can this work?

[Darth23]

I saw going to suggest a bullet in the brain myself, though I think some broken bones might work as well.

Sounds good

[johnburton]

It's not a cure but it's another small tool which might help a little.

Spamming method

[rf0]

This is not a bad idea though it could be abused. However what the author doesn't seem to realise that open relays may only account for 25% of spam. The rest comes via open proxys which mask the connection and mean that the mail server is receiving an SMTP session from a valid IP address. It might help a bit but at the end of the day the only good solution to fix spammers is hit them where it hurts in the pockets.

Of course that is easier said than done

Rus

It's not going to work...

[SuperDuck]

Just watch the RBL's and ISP's shut down your IP block for having an open relay...

How are they supposed to know the difference between a spamhole and a real open relay?

will my head sysadmin allow it?

[dummkopf]

i think it will not work for two reasons:

a) as mentioned before, it is easy to probe the hole to make sure it really works.

b) i seriuosly doubt that the security team of any university and / or company would enable such a hole because then they might get blacklisted and no more email for them...

Maybe this is just me being cynical...

[CaptainTux]

I can see this being a great "live" email harvesting tool for some spammers. Setup a spamhole and just sit back and collect the addresses that other spammers try to send to. A good majority of the addresses will be good and you don't even have to waste time harvesting. This could be a windfall for technically savvy spammers with a little time to waste. Good God. Here we go again...

For all of you who will say "This won't work"

[TechnoVooDooDaddy]

for whatever reason you say it, I ask you this "What solution have you thought about and coded?"

Re:For all of you who will say "This won't work"

[Chip Salzenberg]

Some plant, some weed. All farm.

It's a great idea, but I have one question.

[Infernon]

Isn't the spammer going to know that the supposed relay is a spam hole if he includes an account that he accesses on his list and checks to see if he's received a message from himself afterwards?

Re:I don't think this will work..

[cgranade]

Stopping spam is never the point of any prudent anti-spam action. Instead, anti-spam actions work by reducing the value of spam to spammers. This can be done by reducing click-through, reducing traffic and filtering that traffic which is out there. Always, spam will get through. The only way to combat spam is to reduce the profit margin and increase the time expense so much that it is worthless, and simply bad business to spam.

Your netblock is at risk

[Space cowboy]

If you put this on your site, and people complain about those 'let through' spams at the start, your entire netblock will be marked as a spammers paradise (and rightly so - how can the RBL's tell the difference?). Goodbye email.

Some RBL's do not allow changes to be made unless you pay a big fee, and you lose the fee if they consider the complaint genuine.

This sounds real risky to me ...

Simon.

Re:I don't think this will work..

[bonez_net11]

Yes, that is true. BUT, it would be quite easy to write a script that sent itself messages through a relay, then when/if the message is recieved it would start spamming and sending itself a message every 10 or 50 times or so. If messages start getting lost it would mark that relay as dead and move to the next one. After a few people write this script (there are always many) it would work like clockwork and nobody would really even notice it happening. Remember, there is always a work-around.

two potential problems

[tacocat]

I see two potential problems with this approach, one more insipid than the other.

1. Albeit minor, I've now lost my IP port 25 mail server. This is a big problem if I only have one IP address. I would still like to have a mail server, thank you.
2. Spamhole only works as long as it's population is much less than the population of potential open relays. Spam hole will send ~2 emails free to allow some meathead spammer to verify the relay works. After two, or when rate exceeds some value, you /dev/null the traffic. Now you have a really popular tricksy and you have 50,000 spamholes on the internet. This will delivery 50,000 X 2 free test emails. Why not just use that free 100,000 emails to deliver spam instead.

Haven't you only succeeded in sponsoring a low volume spam relay that not only delivers spam, but at such a low per-boxen rate that no one will ever be the wiser for it.

I see that even on your homepage you mention that a few spam emails might get delivered, but you are acting as a relay for a few spam emails times 50,000. You will eventually get blacklisted via OpenRelay RBL's.

I think if you sit down for a day and just watch your email logs, you will find that a lot of spammers don't bother to test a connection for open relay status. They just test by pushing as much email through it that they can as quickly as possible. Daily I have hundreds of attempting mail relay deliveries.

Isn't that interesting...

[dcavanaugh]

Run an open relay, the ISP detects it, launches nastygrams and prepares to blast your ass to Mars. Complain to the average ISP about the average spammer, and the spammer is still spamming through the same ISP 6 months later. Hmmmm.

Just a thought

[fr0dicus]

Everyone being blacklisted for using this might have the nice side effect of making more effective blacklists :)

Re:I don't think this will work..

[Pedersen]

then when/if the message is recieved it would start spamming and sending itself a message every 10 or 50 times or so

And then, as an added bonus, spamhole could be written to watch for these email addresses. Now we've got a real email address for these bastards...

Re:Nahh, spamd.

[arkanes]

I have to say, if I were a professional spammer I'd be using custom SMTP clients that didn't bother with stuff like "standards" and waiting on long timeouts and resending after a 450. All that matters is getting as much mail out as fast as possible, so just skipping hosts that aren't keeping up at a reasonable level would probably be the best option.

helping spammers... *sigh*

[dakkon1024]

So as the project grows, people will sell lists of these "open relay's" This way, spammers can use different SMTP servers to send there mail, making them more difficult to track. A few IPs and a few email accounts to check when the spam hole stops working, and they could actually use these to there advantage.

Re:Fed up reading such non-working stuff

[randombit]

1) Make a law (if your country doesn't have one already) which makes it illegal to send emails with forged FROM fields (= email addresses you don't own)

And when people violate it, you track them down how, exactly? Please explain.

Slightly improve RFC2821 (smtp)

What you term "slightly improve", I would call "change EVERY mail server and client in the world". Oh, wonderful solution. Even if this was pushed through today, it would take years (at best) to happen. As a much smaller-scale example, all new X.509 CAs that comply with PKIX (the IETF X.509 profile) are supposed to start issuing all their certs with UTF-8 on 1/1/04. This is been a requirement of PKIX since at least 1998. Not one single CA is going the change on the cutoff date. Not one. SMTP is thousands of times more widely used than X.509. You are insane if you think this is technically or politically feasible.

Yes, I know this prevents everybody from having his own pretty little smtp server. No, I'm perfectly well with that. Use a provider.

I am very glad you have no ability to carry out any of these actions.

Re:This doesn't solve anything

[TiggsPanther]

his does nothing to address the traffic/bandwidth usage. I've seen spammers continue to hit mail servers for several years (yes YEARS) after they were locked out, they just don't care. The bandwidth costs become seriously problematic.

Well, wouldnt merely locking them out cause mail to bounce?
But this Spamhole thing will at least make the Spam disappear at the first relay. Not bounce back. Not propagate on. It'll reduce some of the overall bandwidth usage.

Plus, from a purely users' PoV, whether it saves bandwidth is irrelevant. but if it manages to reduce the crap that hits their Inbox, then it's a good thing.

The database idea is great in theory, but it does sound similar to Blacklists. In so much as they have the same three potential problems.

• (1) Point-of-origin isn't always clear. And that means that either faked domains or open/cracked mailservers may get added. And once on, sometimes it's hard to get off.

  (2) Slightly less major, but there's always the chance that people get erroneously added purposefully - albeit through ignorance/laziness rather than malicious intent.
  Especially if it's automatable, people have been known in the past to just flag up certain senders as Spam. When it's actually legitimate bulk-mail that they just can't be bothered from unsubscribing from.

  (3) As problems with the RBLs have shown in recent times, all such a list/database does is provide a central "target" for Spammers to cripple. Unless there was a way of doing the database distributed, then they'd just get DDoS'd, and targetted by the latest worm payloads.

It's not that I think the idea itself is bad. Just that current implementations do tend to include rather serious flaws.

Tiggs

Re:I don't think this will work..

[Savagemutt]

Spam isn't the problem. Fraud is the problem. Legitimate companies don't send spam (or if they do, they usually learn their lesson). What's left is the criminals peddling worthless herbal cures, penis enlarging regimens and committing outright con games like the Nigerian spam. So lets spend a bit more money in the short term on law enforcement. Let's follow the money and put these scumbags in jail. Once the two bit operators understand the seriousness of their offenses, I think the volume will fall off dramatically.

Ok. So it won't stop the garbage coming from countries too poor or too indifferent to enforce the law, but it would help a great deal.

Why this is a horrible idea.

[dentar]

1: They'll get blacklisted.

2: The spammers will eventually be able to find a way to test it first (like they have with everything else.)

3: It'll just suck up bandwidth and dump it to /dev/null.

4: Even if the idea did work in theory, there won't be enough people believing in the idea to make it actually work.

Re:I don't think this will work..

[Smallpond]

Yeah. The address will be ajksajkshs@yahoo.com, now what?

Even if the spamware doesn't detect this now, it will by tomorrow. As a mail admin, I current use 2 RBL blocklists, + hardcoded addresses for serious offenders telesp.net.br and shawcable.net + Bayesian filter. I still get spam in my inboxes.

Spammers aren't stupid, just evil.

Re:Plan for Spam Prevention

[Dr. Evil]

It's been done. The Vipul's Razor portion of Spamasassin generates signatures from known spam. People feed spam sources into it.

The only problem is that dan@example.com would receive kretiv1y R/\N|)0/\/\][Zed di||erent tipes of spam. Twinkies limes in spain. \/|AGRA \/|AGRA \/|AGRA.

I thought that maybe applying pattern equivalencies, dictionary and grammar checkers to create signatures based upon "real sentences" would improve things, but before I could do it, randomized jibberish like this came out:

danc@example.com would receive kretiv1y R/\N|)0/\/\][Zed di||erent tipes of spam. Spanish onions defeat goliath squirrels. \/|AGRA \/|AGRA \/|AGRA.

Spam is NOT a technical issue!!!

[mnemotronic]

I'll keep saying it -- spam is not a technical, political, social, spiritual, or financial issue. It 's a "people" issue. It boils down to a human being saying or thinking "The rewards of sending spam outweith it's risks", making a choice, and pushing a button that makes it happen. To convice the spammer otherwise will require a different approach. What the ultimate solution is, I don't know, but (for most human beings) pain, and the fear of pain, is a very powerful motivator. Obviously, no "civilized" ruling entity would ever approve or condone such an approach. Well, except for the KGB, the Mossad, the Taliban, the 3rd reich, various South American governments, some Islamic states, the Chinese, the French revolutionaries, and probably one or two branches of the US "intelligence community". Did I leave anybody out?

Re:Fed up reading such non-working stuff

[Anonymous Coward]

Yes, I know this prevents everybody from having his own pretty little smtp server. No, I'm perfectly well with that. Use a provider.

I switched ISPs specifically so I could run my own mailserver, as my previous provider's (Comcast) were down more often than they were up and they had no accountability.

My server is locked down tight, I ruthlessly comb the logs and maintain my blacklist fervently. I can also create throwaway accounts on a whim to keep spam out of my 'real' account. The best part is, if there's a problem with my server I can fix it quickly instead of having to rely on someone else.

Having to do my own maintenance for the pleasure of having nearly spam-free mail and a reliable server is worth it. I'll see you in hell before I give it up.

Track IP addresses, not email addresses

[billstewart]

You don't really need the email addresses, because as another poster pointed out, many of them are forged. What you need are the IP addresses, and traceroutes to find one or two routers upstream to them, because that tells you what ISP the spammer is actually using, so the ISP can either whack their account (if they're a spammer) or get them to clean up their machine (if it's a hijacked zombie.) Sometimes that means the complaints go to the spammer themselves (so your spamhole gets outed), but if you're also hitting their upstream it's a good start.

If you want to get fancy, you can also do a couple of hits on any URL mentioned in the email - you shouldn't robo-complain, because spammers often put real email addresses in the spam as well, but it gets a bit of bandwidth drain, exercises all the URLs that the spammer might be getting clickthrough from (which is likely to get the clickthrough vendor to stop paying the web site or spammer), and generally shakes things up a bit.