Slashdot Mirror
What You Get When You Buy a Spam CD
defender writes "Recently over here in The Netherlands, the spam versus anti-spam 'war' has hardened. More professional spamming coming from a handful of hard-core spammers utilizing bulletproof hosting in India, chained open proxies, more and more false whois information, etc. One of the more known anti-spam people has been sent one of the subjects of those spams: a CD with millions of e-mail addressess of 'individuals' and hundreds of thousands of 'businesses'... Rejo Zenger has done an analysis of such a CD, which is fuelling new debate as to why the recent EU anti-spam directive was weakened because of businesses complaining or indicating that spam wasn't a big issue for them."
It's been reported that SpamCop is paying upwards to $30K / year for bandwidth as a direct cause of the continous DDOS attacks on it.
The spammers are doing everything they can to squeeze the anti-spammers out. They use frivolous lawsuits (aka Mark Felstein and his porn spamming backers) or DDOS attacks that either knock the anti-spam resources off completely or increase the costs so that no hobbyist can run them.
And while all this is going on, the law enforcement agencies are doing nothing to counter the clearly illegal acts of the spammers.
And ISPs are doing NOTHING to reduce the number of zombies on their networks. So the DDOS attacks continue.
Nice going.
It's only a matter of time when someone (Al Queda?) will use the zombie network for something that will truly be noticed.
Why aren't such CD's outlawed? I mean, contries go after drug suppliers... why not go after those supplying an individuals email address?
Any CD that is sold containing email addresses invariably has some that work, but the vast majority are just generated. I once knew someone (and I no longer communicate with that person) who insisted that spam was the only way to sell his products. He paid $400 to some marketing company, and they sold him a CD with a million addresses. He asked me to look at it, and my conclusions were that he got ripped off. He didn't want to believe me, but the sheer number of addresses that were obviously generated proved to me that someone had written a quick script to create addresses. A good portion of the addresses were also old-school, with lots of "71532.4532@compuserve.com" type addresses.
Spammers aren't just evil for selling addresses, they are evil for making up about 3/4 of the ones that they do sell, and anyone who buys a CD with email addresses on it should be aware of that.
libertarianswag.com
To be fair he also says "The addresses ending in one dot are technically valid adresses. If handled correctly by the software that is used, they should cause no problems. However, when sending bulk e-mail your goal would be to reach as many as possible and one would prefer to play at safe."
Yes, its great that people embed "remove-this" and so on into their email addresses at Slashdot and other places (like Usenet), for example to make it harder for bots to parse and detect valid email addresses..
But one wonders if tools cant easily be written to remove basic patterns of that sort ... a simple substitute (or regex, whatever) would cleanse quite a few addresses, especially on UseNet..
Why is this worth it ? playing devils advocate, if I wanted to market ThinkGeek-like toys, Slashdot readership would be squarely in my "target market". A bit of effort cleansing addresses would pay off (because presumably, a fair portion of the populace reading Slashdot have more disposable income to spend on toys and geeky appliances ? ) and thus the spam would be more "directed" ?
Along those lines, how much longer before someone just hires a highschool kid to manually "collect" addresses ? (a few bucks an hour payment, say).. all the fancy email obfuscation tricks would fly out the window then..
It all depends on the payment model for spammers (which I never could understand anyway..). Paid per email sent (with incentive to forge or do shoddy cleansing), or paid per items bought ? If its per item, then there is a good incentive to cleanse, I'd think..
Untraceable? Why not just pretend to be a customer, even buy the product, then bust them? Surely during the process of patronizing a spammer, you'll get their identity, address, etc.???
"Would it kill you to put down the toilet seat?" -- Maya Angelou
Edit the CD to include the email address of every politician the wolrd over, along with known spammers and the editor of every media outlet. If you can, use addresses that forward a notification to their mobile phone via SMS, then sell the new CD.
We'll soon see a change in the law.
Ahh I can dream.
I find it doubtful that the erroneous e-mail addresses are malicious. That would suggest that these spammers have vastly higher intelligence they evidence indicates.
But...thanks to this new and wonderful tutorial, they can vastly improve the quality of their spam e-mail lists. The tutorial was even kind enough to provide the appropriate regex patterns at the bottom. How thoughtful
Jens Wessling
Hrmmm. now all I need is a mailserver on a *real* big pipe to generate zillions of bogus addresses and a handful of bots to respond to spams with these addresses. Of course, those addresses wouldn't exist the next day or week or whatever... Set it all up and leave it runing like that for a year or something...
C|N>K
Well, as a consultant/technician, I feel more job security in this new year. I received 70 spam emails today. The greatest amount in 1 day so far. This article confirms my prediction that 2004 will see an exponetial growth of spam, zombies and open relays. Thats not necessarily a bad thing. Now I can sell my services to companies who are looking to implement strategies for managing email privacy. For example, you could simply go to a companies web site and show them that they have a flaw in listing their email addreses on the site. The best method is to post them as a graphic. Simple and effect. Now if I can just get hired.
Don't you think the war on spam should be fought as aggressively as the war on terror (ok, I know iraq did sidetrack us from that war, but still). After all,
1. just like terrorism, the spam mainly affects western countries...most of the uneducated masses do not have computers
2. the spammers do not care if our life becomes hell...they are interested in their 72 virgins...or money in this case
3. the harder we fight them, the more workarounds they find
4. any time you turn to news, you find terrorism. any time you turn to computer, you find spam. does not matter whether it is a child's email account or a grownup's.
5. it is a relatively low cost business. any tom, dick and harry can get up and start spamming. you never know when your next door neighbor is a spammer.
If only the government and industry made it a mission to kill spam. The only way it can be killed is with collective will to do so. Prosecute the spammers at par with felony or higher. Kick the industry to find workable solutions without introducing proprietary protocols.
But the analysis shows that the raw lists are not all junk but still have value. What we now need to do is now polute the status of these.
This can be done by actually visiting every link that a spam offers to you and checking the content of that page.
It sounds like this would alert the spammers to your email being alive and unique and as an individual this would be a bad thing BUT what if EVERYONE did this ?. The web site would be hit (err just like a /.) in proportion to how much they supported spam.
Especially effective if done at a Brightgmail/ISP level where is behind the scenes and hasn't even hit your account. And no one can say that visiting a link is something illegal.
The analogy is shouting into a room of people and saying IS ANYONE HERE. If just 1 person replies then thats information. If everyone yells back then thats NOISE. Effectively what would happen is that a spammer sends out 1 Million emails and is say 250,000 replied back and visited their web site then they would have to seriously question if that was an effective campaign. Traditional media people would say yes BUT those 250,000 visits are in fact robots looking like humans. Aint no sales from robots and just left with a large bandwidth bill.
What its saying is we need a co-ordinated community to effectively stop spam. Just a thought. What I haven't worked out is how to stop spammers using this as a DDOS attack. I suspect a robots directive but haven't worked out the logic yet.
(I hate how everyone's starting to talk about bittorrents every time a distributed system is wanted, bittorrent isn't a miracle solution.)
You're right that such a system isn't easily created, but it isn't as hard as you seem to think either; correctly set up the one in charge of the system could insert the signed updated data anywhere.
The public key could be downloaded from the same website as most updates are downloaded from, but once that website is attacked the one responsible for that website uses his dialup/adsl to release the new data into the P2P-networks available to him.
The website might be gone, but the "service" wouldn't die with it.
perl -e'print$_{$_} for sort%_=`lynx -dump svanstrom.com/t`'
Okay, set up a site for potential spammers to buy one of these CDs. Require they give correct contact information to purchase.
Once lots of them have purchased, send out the CDs with the list of people who purchased the CD.
Profit and the joy of justice, all in the same business plan!
"Oh yeah."
- The Duffman
"Evil's no good. Ya just don't cotton to it. You've gotta whack it on the nose with the rolled-up Newspaper of Justice, and say, 'Bad dog...bad dog!'"
- The Tick (as best I can remember)
Have a key that is like a public key, but isn't published to the world; only give it out to people from whom you authorize email to be delivered to you. If your incoming mail doesn't contain that key, delete it.
Then, have a specifically formatted message type to handle key requests. Say if Betty wanted to email Veronica to request her private-public key, it would have to be in a strict format, say with the subject line: KEYREQ . For example: KEYREQ veronica@archie.com Hi it's veronica. ?? Then your email client could have a button called "Reply/Authorize".
"Would it kill you to put down the toilet seat?" -- Maya Angelou
Why aren't these sites listed, real-time blacklisted, and DDoS'd by the good guys? If there is a SETI screensaver, why not a Pitchforks-and-Torches (my name for the angry mob of ordinary folks) one that, say, once a minute sends a query to known spam-friendly ISPs. A million of these would be a million messages a minute. Hard to call that a real DDoS attack from any one person since all I wanted to see if their page has updated.
While most e-mail users are digusted @ companies who spam and have business relations with spammers or spam-friendly ISP's; Google has not been mentioned yet as a part of that group.y +web+hosting+services&sourceid=mozilla-search&star t=0&start=0&ie=utf-8&oe=utf-8
By doing some searching on google - http://www.google.com/search?q=bulk+email+friendl
It's evidently that would-be spammers can easily find spam-friendly ISP's with the help of Google's Sponsored Links.
Google profits through the Spam-Friendly ISP's sponsorships and advertisements.
Does anyone see anything ethically wrong with that ???
I agree with the rest of your post. This part seems a bit forced if you think about this reality that we come across:
When searching for a long lost friend, it is nearly impossible to find a phone number, or a working email address, and sometimes phonebooks list only partial names. Also, chances are that any user of a plain-old phone book will find a SINGLE # per private entity.
So, if I had multiple phone lines, the secondary ones would stay hidden from the general public and allow us to avoid telemarketters or unsolicited calls from strangers.
With this in mind, think about email: Having multiple email addresses, thanks to AOL's 7+ emails per "account," (compare "7" to how many phone #'s you have) the public can easily have multiple email addresses, to use one for work, another one for spam and so forth. Yet they all catch spam sooner or later... Getting back to the phone book issue, when's the last time your fax line got a telemarketting call? So if emails are more prone to bulk requests than even our phones, email directories would simplify the task of cataloguing all my undisclosed, private addresses --and I get lots of spam even despite the lack of a "free phonebook for emails." Heck, if I could pay for removing my address from suck a phonebook the way I can do so for my phone #'s, I probably would.
"Wireless : LAN
How about this... some whitehat could make and market a CD of millions of mail addresses. But they'd all be fake except a few for monitoring, spamer tarpits and a few of abuse@ISP and the feds ;-)
Besides cutting down spam you'd be tranfering month
directly from the spammers to yourself.
The problem is not that the sites are vulnerable, its that law enforment will not step in to enforce the laws and so the DDOS continues. So why don't we go with this idea but find a server that they might care about to store the data on. If the blacklists were distributed by p2p, signed with gpg/pgp and the key was stored on a high profile server it might work. This is assuming that law enforcement would take an attack on this machine more seriously (not at all garunteed). There might be an even better server (maybe a .gov or .mil) where the key could be served from. I think the idea could work, if it is done properly.
Spammers are in the same boat. CC company's can, and should, deny service to spammers, but the CC Co's would have to actually research every business. Since someone looking to decieve could easily set up a CC merchant account for company X (the front) and recieve payment through division Y (the actual website) the CC Co. can be distanced long enough for the spammer to keep division Y unknown to the CC Co.
Unfortunately, any regulation, of any activity, depends on the penalties being enforceable against those without the ethics to abide to convention. Enforcement requires jurisdiction.
Could spam be the cause celeb that finally unites governments world-wide similar to the alien invasions of science fiction?
The potato it is uninformed.
So, for the purposes of legislation, maybe the answer is to divide spam into two categories.
First category would be random junk, with no real product, or with no realistic way to reach the purveyor of said junk. It happens, you can't do much about it, let it slide.
Second category, however, would be the spam advertising a real product/service, with some way of reaching the purveyor of said product/service. Such spam can be legislated against, by making it illegal to use spam to deliver advertising. If there's a means for a buyer to reach the seller, the same means can be used by law enforcement to kick the seller's ass.
Think it couldn't happen? When was the last time you saw a billboard with a cigarette ad? I don't know if there was specific legislation against tobacco product ads, but there must certainly have been some "encouragement" for the tobacco companies to stop their ads.
No, not at all. All you need is PGP. If the file's signature matches, it's the real thing. If it doesn't it's not. Pure P2P.
Gnutella would be much better. No central server.
I think it would be just fine if we had no way to revoke a key. Just make sure to keep it secure.
Besides that, why not just post the revocation cert to the P2P network, signed by it's own key?
It sounds amusing, but it really would work. If somebody else could make-up a revoc cert and sign it with that key, the key is vulnerable anyhow.
Well, since I just came up with a solution in 30 seconds, it's not all that hard.
Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
However, it claims nine out of ten spam emails are either untraceable or come from operations outside the European Union.
Then they should come up with a better law. The tax laws for the US not only require that foreigners in the US pay income tax, but US citizens in foreign countries can be required to pay US income tax even never having set foot in the US for the year they are gone. Just because they aren't local does not mean that the law can not apply to them, even it is would be hard to enforce. If a company "does business" in a country, then it should be held to those standards. If the government enforcers had a clue, they could stop spam with little effect on other traffic, but the methods may be more draconian than many would like.
All traffic into a country travels over a few links (even 100 is a "few" links on the scale of the Intranet). Traking the spammers and blocking them at those choke points would stop outside spam. Inside spam would be dealt with by local laws.
And, though it seems to be a smaller portion of spam, clickthrough spam is still a problem. That is easier to deal with. Require that the companies that pay for clicks only pay domestic physical addresses and agree to turn over the names and addresses of those that spam to the authorities.
But I don't see that there will be any fix for spam to come from laws. The people writing the laws are technically ignorant (so they will not be able to anticipate the loopholes or possible abuses) and big businesses will oppose it on the grounds that it may interfere with marketing efforts, and the government here has long been of the people, by the people, and for the corporations.
Learn to love Alaska
I really don't know why this is so hard for people to understand, but it "shouldn't" be that hard to create a peer-to-peer, fully trusted spam blacklist system.
1) Take a well known provider of such lists and have him generate himself a PGP/GPG (etc) key.
2) Create a hashing algo that can be applied to email addresses and domain names and produces (about) 60 or so distinct hashes.
3) Coordinate the email blacklists into N files where N is the number of hash results from item 2. These are the N components to the complete list. IF you have an address X and its hash is Xn then if the address doesn't apear in file N the address isn not blacklisted.
4) Construct (or use an existing) P2P app to distribute these N files. Ideally the P2P system in question can "bias" the fetch operation to favor retrevial from "previously known good" sources.
Here are the fine points:
A) The GPG secret key, and not the "location fetched from", is the magic that marks the list valid. You can not DDOS a secret key, just an originator.
B) A first-order web of trust, instead of a simple key, could also be used. That is, instead of requiring a signature from the master key, require a signature from a key signed by the master key. This way "the one key" can stay relatively unused while persons need to attack the rotating and regularly expiring frontage keys if they want to game the transfer for any reason.
C) The master key and the frontage keys don't have to equate to any real nor active network facility. They only need to be unique in key space. You simply *CANNOT* attack a namespace that isn't backed up by a physical facility. (For instance, if the master key were "master@control.spamcop.org", spamcop.org itself could be pointed at Geocities or something or nothing at all.)
D) While a current (Kaza-esque) P2P app would probably be less than ideal for the actual transport, it wouldn't be dificult to design a P2P style distribution mechanisim. It wouldn't need to be any more subtle than a bunch of http mirrors really, as long as the mirroring system (rdist/wget alike) would only put the files in the public directory if they passed a frontage-key/master-key signing test.
In practice you would probably want to distribute a signed known-mirrors (root) file too.
[Then again, a shite load of ptr records in a "spamcop.org" dns table could function as the analog of an MX table for this rooting purpose. Those sites would tend to become targets, but only for as long as the list size were small.]
If a "real" P2P app, or even a well designed friend-of-friend http-based network were put together and reached a core complexity of a at least a couple dozen known base points, it would be unquenchable. The target density would be too diverse to attack effectively. It would be like trying to DDOS "all the bloggers on the net".
Heck, set a pseudo standard: Every doman that wants to join the P2P network "backbone" should issue itself a "spamcop@my.domain" key and then do a challenge/response signing (on connection each party sends the other a challenge, gets the challenge back signed, checks the signature as valid) when it comes onto the backbone. Organize the thing like IRC but with records kept for keys used. Add some throttling (like IRC flood protection) and you are off. Abusers can be tracked down to their hosts and keys.
Then you can devolve. Regular users don't have to have keys to join the net and request information. Keys and domains can be blacklisted (possibly together?).
Heck, use the haxors techniques. Actually get permission to stake out some IRC channels to act as the root seed broadcast-style distribution system (list of known good core hosts, again, such lists are signed).
All you have to do is get some distribution without losing authenticity. That is what public keys are all about. The anti-assailable nature of P2P and the semi-chaotic nature of IRC have their legitimate purposes. Now all you need is to use these systems for good instead of evil.
Innocent people shouldn't be forced to pay for inferior software development.
--"Code Complete" Microsoft Press
I doubt that, at least to the extent you likely intend it. The great thing about Bayesian filtering is that it's adaptive. So they would have to dramatically increase the rate at which they discover and use filter-killing tricks for this to work.
I'm running Mozilla, and in the last 8 months (roughly) I've gotten 10,000 spams - modest, but a great library for catching spams. I catch about 97% or more of them. And I can tell when they come out with a new trick - my catch rate will drop to say 80% for a day, after which my filter catches up to the new trick. In fact, when they don't have new tricks, my catch rate is about 99+%. Most of what gets through is new tricks.
I'd say now, they come out with a filter-busting trick maybe once a month. For spam to become a problem to my client, they'd have to do it better than once a day. I don't think they have the resources to do that.
-Looking for a job as a materials chemist or multivariat
If you are selling a product that will only make you about $50 a year per customer, and have to spam 10,000 people ... there's no way you are actually turning a profit.
Unfortunately it CAN be profitable. You missed the fact that the cost of sending spam is vanishingly small.
Lets assume that one in ten thousand response rate. Lets assume $50 total profit. Lets assume you send a measly 2 spams per second (1.2 million per week). That is over $314,000 per year.
It will be profitable as long as your expenses are less than that. Hardware costs: insignifigant. Software costs: insignifigant. Address lists: insignifigant. Labor: one person part time. Bandwith: Maybe several thousand, but still not signifigant.
If some of them keep buying herbal viagra every year it becomes that much more profitable. When you find such a "live one" they are prime candidates for every other crack-pot offer you dream up. One single fruit-cake can be a gold mine giving you a few thousand per year.
I hate working out this math, it almost makes me want to go into the spam business. On the other hand if you do the math it becomes clear that each spammer can easily kill entire LIFESPANS worth of other people's time just deleting this crap.
-
- - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
You're not going to sell this CD to Alan Ralsky or his ilk, the professional Florida ROKSO members or the newer mafiosi who run their own harvesters (you'll leave attractive-nuisance web pages around for them :-) This kind of product is designed for the Gullible Bottom-Feeder spammers, the anklebiters who think they'll Make Money Fast by buying a CD from the big professional spammers. That means they'll either see your ads and believe them, or they won't, but they won't have the clue about how to ask around for other spammers who've bought your fine product and are now in jail or court or bankruptcy or buried in paper junkmail or keep getting their single-wide trailer windows broken, plus you'll have had fun taking them for $39 and any other optional services you've sold them, like "bullet-proof hosting" and "spam-free bulk email delivery ISP services" .
For the slightly brighter potential spammers, word may get around faster (e.g. it shows up in Google next to your ad), but that's ok - any meme that says buying cheap spamware is dangerous is a Good Meme. The problem is making sure that *you* are hard to trace, because the guy in the singlewide trailer may have a doublewide baseball bat, and the slightly brighter spammer may have a kid brother who's a 31337 Skr14t K1dD13 who can annoy you as well.
The other problem, of course, is how to reach your potential customer base, other than by spamming... Google's a start.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks