Slashdot Mirror
Copyrighted Haiku Delivers Spam Through Filters
An anonymous reader writes "Remember that antispam company that includes a copyrighted haiku (which I can't quote here due to copyright reasons...) in emails vouching for their nonspaminess and thus bypassing spamfilters?
The idea is that a spammer using said haiku to get through spamfilters can be prosecuted under the more stringent copyright laws instead of the weaker antispam ones.
Well it seems said haiku has lately been figuring in a large spam run trying to pitch the usual medical remedies for various unfortunate ailments.
What do you think? Is it time to start filtering for haikus or will Habeas succeed in thwarting the spam attack?" We mentioned this brilliant anti-spam scheme last April.
You made the first post
Hey, mother Anonymous!
You proud of your son?
Which would have taken any semi-literate reporter or editor ten second to find on their site. I guess that would have spoiled the illusion of a breaking story though.
If you were blocking sigs, you wouldn't have to read this.
It's an interesting idea, I really hope it'll work too.
:-/
Unfortunately I think they might need to make it so that they couple it with a white-list, ie *all* mail with their signature that is *not* on their whitelist is assumed to be spam... Otherwise there will just be too much spam specifically intended to make their service useless, actually harmful to their customers... There'll even be fake spam designed to be hard to track, just to force people to filter out any mail with their delivery and thus forcing them out of business
Darwinian Selection is the governing rule of spam.. If appending a Haiku makes a message 'fitter' it will survive the slaughter more readily and therefore make it into your inbox more often.. until some realises what's going on and combats it with a new filter.. and then the process starts all over again.. :)
For this reason, I think we're going to be fighting spam for a long time to come :)
Simon.
Unbelievable.
About 5 in the past couple days. I noticed the unusual X-headers and finally remembered what it was. Increased the SA score yesterday and now I get none! woot!
I can see this company being semi-successful in taking spammers to court under copyright lawsuits, however like the article says the latest rash is (not suprisingly) zombied broadband hosts, making their chances of finding someone to sue almost nil.
I just checked through the mail I've received in the last while, and there is only one newsletter I am on using Habeas -- other than that, I have only received Habeas headers in spam.
Guess what my bayesian filter is going to start thinking of those headers soon... this could prove to be a problem for them if they don't get things fixed ASAP.
SSL Certificate
In theory the Habeas scheme is very clever. It's difficult to get spammers under any anti-spam law (where they exist), so change the ballgame so that you can prosecute under copyright law instead.
Unfortunately though, I suspect it's going to be difficult to track these people down, and even when Habeas do, they will need to mount a prosecution in another country - wherever that happens to be. The spammers may even win given that each country enforces copyright laws differently.
According to the statement given, the latest version of SpamAssassin should be able to filter these out. We're running what I think is the latest (2.61) and it still seems to be letting them through - thanks to the Habeas mark. I'm beginning to think I should just disable the Habeas rules completely and let these get scorded normally.
Joe-Jobs are made to order... Just send a bunch of mail through a rooted proxy, advertising the competition's stuff, and watch Habeas sic the lawyer dogs of war on your competition. You'd laugh all the way to the bank.
Same type of thing if enough spammers use this trick, the lawyers will be too busy.
Did Habeas actually think this was going to work? I mean, spammers are willing to do ANYTHING to make sure Joe Public reads their garbage. Constantly changing tactics to evade filters, to write viruses specifically to generate more open proxies to send their garbage through, to Denial of Service attacks against those who try to filter out this stuff, to garbage lawsuits. This is nothing compared to those..
People Talking in Movie shows.. people smoking in bed.. people voting republican.. GIVE THEM A BOOT TO THE HEAD!
Seems they were hacked
The idea is that a spammer using said haiku to get through spamfilters can be prosecuted under the more stringent copyright laws instead of the weaker antispam ones.
Which should read:
The idea is that a spammer using said haiku to get through spamfilters can be prosecuted under the more stringent laws that are difficult to enforce instead of the weaker laws which have proven so hard to enforce.
I'm amused by the idea, but it seems to me that if you couldn't get (find) them under anti-spam laws (especially the newest ones) then how could you get them on copyright laws? Are the new anti-spam laws so lacking in punishment that they pale in comparison to copyright laws?
The Habeas mark is just a way of making money, it has nothing to do with opt-in or responsible e-mailing. I've tried to contact Habeas in the past about a company that used their mark, while they did not correctly verify their opt-in mailadresses. There was no reply (and IIRC, their web form didn't work at all at the time).
my other sig is a 500 page novel
Next time Alan Ralsky will use copyrighted spam to bypass anti-spam filters. He will sue anti-spam companies and blacklists for including his copyrighted fake sender addresses, and also special characteristics and words like 5p4m or V14gr4.
bright-ly an-tic-i-pa-ted
5 syllables in anticipated, for a total of 7 on the line, making it (assuming you pronounce SWE as Swee and ignore the tm) 5-7-5, with a mention of seasons. Seems valid to me...
PenguiNet: the (shareware) Windows SSH client
Ok, so spammers are using haiku. If we only could convince them that harikiri is a spamfilter prevention technique....
This is my sig, show me yours
If they want to up the ante, maybe they should consider using some of the Emperor's Waka Poetry (more syllables == more boring).
...Whether my Maker is prepared for the great ordeal of meeting me is another matter.
Churchill
To disable the Habeas rule, edit file $HOME/.spamassassin/user_prefs
add line
score HABEAS_SWE 0
they stole my haiku
my moment of sartori
sold fake viagra
I'm generally "Interesting," "Insightful," and even "Funny" here. What the hell happens to me at parties?
Hey, and I forgot - What happened to the CAN-SPAM ? How long before we have Attacks of the CAN-SPAM-Resistant Killer Spam.
To see a world in a grain of sand, and then to step back and see the beach where the sand lies
http://pharmacourt.biz/about.htmlo urt.biz/contact.html
http://pharmac
Since they will add the offender's on to the blacklist, make sure you report that spam at http://www.habeas.com/report. That way the next unfortunate receiver of that spam would have adjust their score accordingly.
See: http://www.habeas.com/supportBlackList.html
Another way these nonsense spams work is, in my experience, by having two different MIME parts, a plaintext part of random words, and an html part with the actual spam content. Since I don't use html mail, it works rather poorly on me, but I did once take a look at the html part, and it was formated text, not random nonsense like in the plaintext part.
Like autumn harvest,
Writing haikus correctly,
Is very diffic
-- Open Source: It's mad, but you don't have to work here to help.
Now, we've seen spammers use a copyrighted poem in their spam headers. I'd like to know how much they're worried about being taken to court about this. After all, they're not exactly on the right side of the law already...
(1) They subvert other people's computers to relay spam: illegal in most juristictions.
(2) They send out viruses and worms to break into other people's computers: illegal in most juristictions.
So, if they're already doing two illegal things, why should they worry about a third?
Agrajag: "Oh no, not again!"
The Habeas plan
Most ineffective effort
Ever to stop spam
(c) 2004 Mabu
ALL RIGHTS RESERVED!
Oops.. .forgot my linebreaks
Like a dying wind
Habeas screams to the sky
But they're still worthless
Experience says
The Habeas Haiku means
"This Message is Spam"
Habeas Haiku
To some, touching poetry
Me, I filter it.
Maybe this would help?
The Spammer's Compendium
Main article refers to a spam attack started in 2004, your link refers to a spam attack in 2003, so i find it unlikely that they are referring to the same case unless habeus have a time machine.
It would be foolish to turn off the habeas checking in spamassassin, or otherwise filter out based on the habeas mark for 2 reasons:
/pharmawharehouse.biz/
/pharmacourt.biz/
/valuepointmeds.biz/
1) Habeas has shown a commitment to actually *EXPEND* The resources to go after spammers. If you dimish the value of the habeas mark by filtering out email with their mark in it, then they have nothing to protect. I personally don't have time to go after spammers. Anyone who has a proven track record of winning against spammers (which habeas has) should be encouraged!
2) There is a large number of users who have added the habeas mark to their e-mail headers based on the assumption that it was a protected mark that would ensure their mail *WASN'T* filtered out. If you start filtering on that mark you *WILL* falsely filter out a lot of legitimate mail.
A previous poster named Mehu, posted an excellent solution to the problem if you're using spamassassin:
"So, rather than just add a score of 0 for HABEAS_SWE, I figured I'd give them a chance & added the following to my ~/.spamassassin/user_prefs, which takes care of the current rash:
body PHARMAWHAREHOUSE
describe PHARMAWHAREHOUSE Link to pharmawharehouse.biz
body PHARMACOURT
describe PHARMACOURT Link to pharmacourt.biz
body VALUEPOINTMEDS
describe VALUEPOINTMEDS Link to valuepointmeds.biz
score PHARMAWHAREHOUSE 10
score PHARMACOURT 10
score VALUEPOINTMEDS 10
Looking through my mail, it turns out some of my valid mail actually does contain those headers (would never have noticed them), and a few spams, even w/ the haiku headers, have been blocked by HABEAS_VIOLATOR (RBL: Has Habeas warrant mark and on Infringer List), so the company does appear to be doing its job.."
-Chuck
*Condense fact from the vapor of nuance*
I'm not sure how serious you are, but since even a stopped clock is right twice a day I'll have to agree at least with the literal interpretation of your posting.
If law enforcement generally were applied to the sellers of spamvertised products, spam would become far less of a menace. Most spamvertised products are prima faciae illegal (ie, you can't get prescription medications without a prescription), false advertising (a sugar pill won't give you a 12" penis) or are actually just fraud schemes to take money and not deliver a product.
Tracking down email senders is extremely difficult due to header forgery and the use of zombies and other kinds of compromised systems. But just about all spam will take a credit card, which should enable tracking of a financial trail to the sellers. If the Feds would make a RICO case out of it, they could ensnare just about anyone with their finger in the pie, including the spammers, who I'm sure would be fingered by sellers caught in the net.
A few RICO cases that put the squeeze on ISPs, banks handling their financial transactions, spammers, and most importantly, sellers and suppliers of these products would have a pretty significant effect on the whole "scam 'n' spam" business environment. I think there's probably some otherwise legitimate players (ISPs, banks) participating in this field behind the scenes, and some negative exposure in a few of these cases could close the door to a lot of "operators" who need access to the legitimate economy in order to operate.
It's pretty clear that nobody likes spam, but the fact that there have been no high-profile FBI/Treasury/Commerce investigations into some of these things really puzzles me. It may be that the investigations have been done but this angle was deemed not fruitful (doubtful), resources aren't available due to the war on terror (more likely, but not entirely credible), or political pressure has been applied by heavy corporate players to keep their shady business segments viable (somewhat conspiratorial, but believable) -- yet even these theories don't explain the lack of credible, visible efforts on the part of Federal law enforcment to crack down on internet fraud.
...is not haiku or any other kind of rearrangment of normal speech. What's pouring right through my filters are messages consisting of just a half-dozen lines of random English words. No sentences, no advertisements, no links, nothing but everyday words.
It's a fairly clever attempt to poison the Bayesian filters. Either I associate these words with spam and risk losing legit email, or I loosen things up and let more real spam slide through. It's frustrating because there's absolutely nothing I can do about it.
[insert long ranting call for vigilante bullet-to-the-head-style action here]
You cannot apply a technological solution to a sociological problem. (Edwards' Law)
Under the CAN-SPAM act, ISPs can sue. If you read the definition of an "ISP" in the act, it's clear that a mail processing service like SpamCop would qualify. What's needed is a paid service like SpamCop that files at least one high-profile lawsuit a month, increasing to one a week as volume builds up. That would make a dent.
When I checked on net.admin.net-abuse.sightings, there are several hundred of these reported, and NONE of them use our domain. Checking a few at random, it looks like they are using many many many forged domains, so we are just getting the bounces from a tiny fraction of these these.