Slashdot Mirror
Spamfighting Since the Death of MakeLoveNotSpam?
vacuum_tuber asks: "The now-defunct Lycos anti-spamsite screen saver, MakeLoveNotSpam, was extremely well received despite the whines and hand wringing from the no-one-should-ever-actively-defend-themselves crowd. There was speculation after its demise that Open Source spam-punishing tools would emerge. Other tools such as SpamVampire, LadVampire (punishes fake bank sites), Spam Research Tool and others were mentioned with increasing frequency, but there has been no coherent followup to gauge what people are doing since the death of the Lycos screen saver. What are you doing that you think is effective in punishing spammers or their spam-site sponsors?"
Just chop their heads off. See how well they spam if they cant see their monitor.
The best way to fight spam is to go home and turn off your mom's zombie computer...
or else!
A solid wooden stake usually does the trick. Make sure it's the heart, though...
webpage
Cooperation and user persistance has pushed spam already to the fringes of the Internet. Spammers have to just compromissed machines and other criminal methods to spread their messages.
Making them a victim will only make it harder to push them out, and it will take away resources from the actual problem: People buy the crap offered by spam! Spam is no longer free. If people would just stop buying based on spam, the problem would solve itself.
SANS Internet Storm Center http://isc.sans.org
I've been spamming the spammy spammers with my anti-spammer spammer. My spam scripts is well suited to spamming spammy spammers with spam. Spaming spammers is the best way to get them to stop spamming. Infact sometimes I use other spammer's spam to spam the spammers.
Now I'm off to eat my breakfast of spam, eggs, bacon, and spam.
Just a guy with an opinion
Make spam illegal, that is the only real way to stop it.
Write your congressman, if you have some free time try to meet with one of them and lobby them. Few people know how remarkably easy it is to get your congressman to sit down and meet with you.
Le français vous intéresse?
SPAM punishes itself by giving an "evil" image for their company.
Best way to punish spam is by keeping your friends AND foes aware of what to not pay attention. In the end, hopefully, they'll make less profit. Nonviolence resistance demands patience and is a slow process but always shows progression.
I use Spamvampire almost constantly. It works great. It sucks up their bandwidth, and while it doesn't DOS them, it does make the business of spam a hell of a lot less financially viable. I regularly pound on spammer sites (the sites actually selling the garbage) for a few days, then the site dies. Now, there's no way to know if it's because these sites are only designed to be live for a week or so at a time, or if I really am hitting them in the pocketbook, but I'd like to think that it works. At the VERY least, it makes me feel better knowing that somebody is going to be very shocked when they see their bandwith bill at the end of the month. And, the info that the guy who wrote the SmapVampire scripts concerning the 97% billing is very true, so the results he describes are actually quite realistic.
I don't respond to AC's.
Nice tool to jam spammers...http://www.astrobastards.net/uc/
Sending xmas cards to inmates about to be released from prisons in their state with the spammers name and home address as the return address with sincere hopes that they will come visit once they get out. Plus I get to use up all these extra xmas cards instead of packing them away for next year.
I Am My Own Worst Enemy
Turn images off. And filter on <img src=. And tell your Mom to.
Another method is to hit the spammer's website... consider this perl fragment:
while (1)
{
- $sock = new IO::Socket::INET (
}- Proto => 'tcp',
);PeerAddr => 'website',
PeerPort => '80',
Reuse => 1
$sock->autoflush(1);
push @sockArray, $sock;
Naturally, the above code is for educational purposes only and is not intended to be used in anger
and this motley crew shall /. into oblivion...
If a spammer and a phisher were both drowning in a pool, and you only had enough time to save one, would get lunch or go for a walk?
If brevity is the soul of wit, then how does one explain Twitter?
Forcing ISPs to turn off/temporarily disable the accounts of zombied, 0wned, computers? Isnt that where most of the spam comes from? How much spam could be stopped that way?
Doesnt have to be permanent, just cut it off and request the user run ad-aware/spybot/a decent virus scan and away they go......
-thewldisntenuff
My MythTV HowTo
Give them info that at least looks real.
If you give them your real phone number, then you can keep them on the phone line for 1/2hour (if you've got a headset), while you play your favorite game.... then tell them you hate spammers.
Even if you don't give them your real time, it forces them to verify the data. People pay for info from those spams because it's mostly good data. from people who want mortages.
If you keep the S/N ratio from spams higher than random cold-calling, then the spam's useless.
For stuff like cheap viagra, it's mostly an attempt to get them to annoy their credit card company. or just wasting their time. If we (slashdot) can each get spammers to waste 10 seconds of their time, that's some number of spammer man-years. If we can each get them to waste 10 seconds a week, they're out of business.
It's using the statistics of spamming against them. They currently get about 1million-1 response ratio with a very high signal-noise ratio. If we can get that up to 1000-1 with a 1-1000 signal-noise ratio, then they'll drown in their own garpage.
Free Software: Like love, it grows best when given away.
"...the actual problem: People buy the crap offered by spam! Spam is no longer free. If people would just stop buying based on spam, the problem would solve itself."
So what you are in effect saying is that people who hawk too-good-to-be-true investment schemes and storcks shouldn't be punished? People are gullible, people are going to continue to be taken in by their greed, ignorance, or even illness.
I think these parasites should be taken down. Whether you agree with Lycos or not, I commend them for at least bringing this possible solution to the spotlight.
"...Well, there's egg and bacon; egg sausage and bacon; egg and spam; egg bacon and spam; egg bacon sausage and spam..."
...but it still happens, sometimes almost unchecked in foreign countries. How is this really going to help unless you target the companies USING spam to hawk their goods?
The spammers are a symptom of a much larger problem. Don't get me wrong - I wouldn't mind seeing them strung up too - but I'd rather see the CEO of some penis enlarging / Viagra-distributing company do some hard time with big guys...
"...Well, there's egg and bacon; egg sausage and bacon; egg and spam; egg bacon and spam; egg bacon sausage and spam..."
Or
LWP + PERL + SPAM = Fun
Take your pick, for something simple like a website that is hosted on compromised machines, simply loop the address through wget, use the output of ps -aux | grep wget | wc -l to keep the system load down to something reasonable - like 50.
Another fun game is when the spammer/phisher wants some personal information. Use LWP to walk through the order stages or web pages. Then give them the information that they asked for.
Name - Don't you know
Address - don't you wish you knew
City - not yet
State - that one
zip - 12345-678
Special order instructions:
Don't ever e-mail me again, ever, please. I'm begging you. In fact I'll be nice, i'll only send this very same message once for each attempted spam delivery. So far the machine that delivered this message has also made 150,000 connections, to try and deliver messages to users that don't exist.
Add random garbage to through off simply filters. Rinse and repeat until messages stop coming to you
Using the host command, with the name servers that show up in the whois. Walk the dns. It's trivial to repeat until server stops responding. Especially if the server is another zombie.
Tactics usually prove good at stopping sites hosted on compromised broadband connections. These machines generally have upload limits that run out quick. Sites hosted in China or Russia seem to have more bandwidth and can take more of a load. I only know this because I read around. I would never, ever advocate such a thing as returning the spam I receive to the spammer via his web sites order page. Doing what is suggested would probably get you in trouble.
My solution? Baseball bats, but my lawyer has told me that they may be illegal as well.
cluge
"Science is about ego as much as it is about discovery and truth " - I said it, so sue me.
The now-defunct Lycos anti-spamsite screen saver, MakeLoveNotSpam, was extremely well received despite the whines and hand wringing from the no-one-should-ever-actively-defend-themselves crowd
/. crowd about how hacking/DDoS is illegal and should be a punishable crime.
Yeah, um, right. Say the same thing in regards to the RIAA trying to prevent music piracy and you'll hear endless howls from the
If you want anyone to remotely take you seriously, you will have to first drop the double-standard.
Posting the physical address of a spammer on /. and asking people to "please not sign him up for all the snailmail-spam you can find because that is so impolite" seems to have worked well in the past.
Well, it worked at annoying the spammer, that is. I don't know if the amount of sent spam actually declined.
So spammers would be crushed under their massive erect penisses...
I think we can keep recursing like this until someone returns 1
The Lycos thing was an interesting sortee, but on a day-to-day basis? I'll keep doing what I do now: learn, build better filters, make it harder for the stuff to get through, defeat the purpose, drive their numbers down a fraction. I'm a systems admin; my users don't see much spam, largely because I've spent months tweaking the filters to stop it, building better code into my SpamAssassin, etc. Does it annoy me? Not really. It keeps me employed, and it makes me think, actually. A wise man once said, rather coldly, that without war there would be no innovation. (I'm paraphrasing). Largely, that's true I think ... though he didn't say anyone had to actually be killed. This is a war; spam, phishing, viruses ... they've made us all grow up, realise that the 'net isn't a toy any more, and stretch ourselves just a bit to make it safer, faster, etc. Yes, this doesn't help your Mum's computer, but one day it will. I'm not going to say spam is good, but I will say I think it was inevitable, and that our reaction to it can in fact turn out to be beneficial.
Irish by birth, Southern by the Grace of God.
For the spam that sells software, I parse the html code (kmail shows the code, not the rendered page) for links to the spam sites selling the software. It's almost always Microsoft Office, Macromedia Dreamweaver (and/or Flash and I forget the other Macromedia software), Adobe suites, Intuit's Quicken or QB, Symantec's software, AutoCad (?) and a few other regulars I can't remember right now. Almost always, the software includes the big ones above, and sometimes a few others.
So I parse the links, removing the filler, isolate the links, then go to BSA's site, and fill out their piracy form. I provide the isolated links, along with the entire email itself including headers, so that they can investigate the spamvertisement themselves.
Then I add a few words of encouragement at the bottom. Three words are generally enough, you can figure out your own slogans as a substitute.
Keeps the BSA busy, their minds on other things, minimizes the amount of trojaned software that clueless users download via spam if BSA actually takes action to close the sites or go after site owners, and lets me kill some time.
I've been thinking of ratting out the criminals selling "pirated" software on Craig's List to the BSA piracy line as well. Maybe I'll make that the next step. It'll keep cheap "pirated" windows software off people's computers, and perhaps give the prospective buyers more incentive to use FOSS/Linux instead. Or at least OpenOffice on Windows, which makes it easier to get them on FOSS/Linux platform later.
The BSA is the greatest thing since sliced bread. Without them, why would most Windows users migrate to Linux? Because its a better platform? Bahhh! They don't even know they're running Windows, let alone why Linux is better or not.
All spamd/pf does, for those of you that don't know, is to stall the spam sender by sending replies v-e-r-y s-l-o-w-l-y using a daemon that runs alongside sendmail. The OpenBSD pf packet filter is used to redirect data away from the real SMTP daemon and to spamd. Some people call spamd a tarpit.
Typically we have about 200-300 spammers in our tarpit at a given time, with a mean time of stalling at a few minutes. At the end of the stalling, we send a 550 rather than a 450 -- a 450 temp fail IMHO is irresponsible and causes more problems than any spammer-punishing benefit it might have.
I'm not sure tarpits are punishing anyway. Rather tarpits reduce the effectiveness of the spamming by tying up the senders in the tarpit rather than sending more junk to people.
I assume that spammers are wise to tarpits. We see a large number of disconnects within a few seconds. Of course, lots of folks program a HELO or multi-recipient delay in their MTA. That is a complementary technique that helps tarpits be even more effective. The longer it takes for spammers to tell that they are tarpitted, the less spam they can send.
A long (long) time ago, I came home to find my wife pumping some online poll, somewhere. Vote, click, wait, back. Vote, click, wait, back. It seems that Marvel was running a "who's the coolest X-Man" poll, and the various fan-groups were doing their damndest to win. Since I wanted my computer back, SpamHammer was born. With a dynamic array of winsocks, it'd allocate as many as the target server could handle, and repeat the voting that you'd "taught" it xxx times. It did well, to the order of a thousand or so per minute if the target could handle it. I must say, the pained expressions on the faces of the various people who were NOT in my wife's fan-group was worth every minute spent coding it, if only I could have seen them. An army of them would spend an hour pumping in a few thousand votes... I'd throw in 10k votes in the time it'd take to make a cup of coffee. It was a few years ago, but it was the type of user-torture that lasts a lifetime.
Eventually, the phishing scams came out. And the mortgage quotes were flowing in. And I got tired of all of them. And I remembered SpamHammer.
So, a LOT of searching of the old file-tree to find it, a little tweaking, and V2.0 was born. This new version supports everything needed to pump tons of crap into any site, POST or GET, cookies or not. I spared no feature - from random emails, random name permutations from the USCB, junk mailing addresses that'll pass a city/state/zip xref, random credit card numbers with proper checkdigits, and even stuff picked from lists (think of med sites). Mortgage quoters want leads? Here, have a million. Just don't bitch when the lenders refuse to pay for those leads. Phishers want accounts and passwords? No problem - with the added benefit of DOSing the target host. Free viagra? Oooo... I get wood just thinking about it... here, have a hundred thousand orders for random crap on your site.
I'm not sure why, but there's something satisfying about getting a "write failure: access denied" after pumping a few million POSTs into a site, consisting of every major field being 32K each. The only thing more satisfying is knowing that certain med-sites simply email the order to an in-box... here, have a big pile of 1Meg emails.
help me i've cloned myself and can't remember which one I am
Even though spam may be international, the foreign companies can be sued. When you send spam into the USA (or the particular state) you are subject to the laws of the USA. After I sued Global Web promotions, the FTC sued them and siezed their funds. Even though they are in Australia, they are doing business here by sending spam.
Fight Spammers!
From the CAN-SPAM act:
The CAN-SPAM act is soft on spamming, but tough on spam-related fraud. That can be useful.Sec. 1037. Fraud and related activity in connection with electronic mail
`(a) IN GENERAL- Whoever, in or affecting interstate or foreign commerce, knowingly-- ....
(4) registers, using information that materially falsifies the identity of the actual registrant, for five or more electronic mail accounts or online user accounts or two or more domain names, and intentionally initiates the transmission of multiple commercial electronic mail messages from any combination of such accounts or domain names, ....
"or conspires to do so, shall be punished as provided in subsection (b)."
(2) a fine under this title, imprisonment for not more than 3 years, or both, if-- ...
(B) the offense is an offense under subsection (a)(4) and involved 20 or more falsified electronic mail or online user account registrations, or 10 or more falsified domain name registrations;
Note the "or conspires to do so" clause. Knowingly assisting in a criminal offense satisfies the legal definition of conspiracy. "Cloaking services" are in deep trouble if they knowingly provide that service for a spammer. Unlike ISP's, there's no "safe harbor" for them.
As for the "knowingly" part, whenever you find a spam associated with a "cloaked" domain, send a note to the cloaking service, and post that you've done so to some public spam forum that's indexed by search engines. That will put them on record as knowingly cooperating in a criminal conspiracy. The next person who gets a spam from the same party will have that information as legal ammunition.
When you've got that info, report it as Internet fraud..
For 419ers and other spammers that tell you to correspond with them via Yahoo! or other free e-mail services, I strongly recommend reporting them to the abuse department for that provider. This can cause innocent fools from being able to actually contact the 419er, and if the success rate drops, then perhaps some of them will quit, if it's not worth their time. Yahoo! and others do not need their name further tarnished as being supporters of these scams, so cutting them off can only be beneficial to them.
Wasting the bandwidth of these phishers only hurts the Internet, by wasting resources. Do keep in mind that the sites may be using stolen credit cards, and the ISPs will lose money on overspent bandwidth bills when the CC company halts payment.
There are a few organizations & companies that would love for you to forward on your spam; and Spamcop [http://www.spamcop.net/] would love to help you LART the headers & spam web hosts.
;)
You can tell where the spam comes from; or at least identify the web sites they are spamvertizing. Yes, it is sometimes a BPITA - hence why I use spamcop to help auto LART the headers/email for me. I know with squirrel mail any spam you can auto forward to your spamcop account to be LARTed.
Normally I LART anything that gets past the spam filters, thinking that anything that does get caught is by the big spamhouses. I also report my spam to the Feds for action:
"FTC" uce@ftc.gov,
"US Postal Inspectors service" fraud@uspis.gov
These folks ask for spam, to either tweak their anti-spam tools or for internal investigation:
"junk_brightmail.com" junk@brightmail.com,
"SendUsSpam" spam@sendusspam.com,
"Spamarchive" submit@spamarchive.org,
"Spamrecycle" spamrecycle@chooseyourmail.com,
Specific countries have anti-spam efforts:
"Spam from China" spam@ccert.edu.cn,
"Spam from Korea" spamcop@kisa.or.kr,
As already mentioned - any spam offering grey market (aka cheap) software?
"BSA" software@bsa.org,
"SBA" piracy@spa.org
Any 419 scams?
"419@nigeriapolice.org" 419@nigeriapolice.org,
"Central Bank of Nigeria" info@cenbank.org,
"thoselads_scamorama.com" thoselads@scamorama.com,
"Treasury Nigeraian scam reporting" 419.fcd@usss.treas.gov
Child pr0n?
"FBI" iitf.tampa@fbi.gov,
"FBI_Child_porn" complaints.detroit@fbi.gov
Any stock or securities spam?
"cyberfraud@nasaa.org" cyberfraud@nasaa.org,
"nasd Penny stock fraud submittal" ombuds@nasd.com,
"Securities fraud SEC" enforcement@sec.gov
Any food or drug spam?
"FDA_Complaint" webcomplaints@ora.fda.gov,
"FDA_Complaint2" webmail@oc.fda.gov
FYI: there are some anti spam groups I am a member of, where a little bit of research dug up these agencies. It is easy enough to set up an auto forward on your spam folder to report & LART the spammer scum.
HTH!
I get a lot of spam attempts on my kevin@qualico.ca email.
Using scripting, I've made myself a nice little spam trap.
If you test mail.qualico.ca, you'll see its an OPEN RELAY!
BUT, if you try to use it...your email will be dissected and automatic abuse notifications sent to the upstream ISP of the target site, the injecting IP's ISP and any other IP listed in the email.
Further, reports are sent to all the major blackhole listing sites.
Very effective at shutting down sites because the instant reporting reduces the time spammers rely on between site switching.
I've been responsible for taking down a lot of sites and will continue to fight spam with every tool at my disposal.
Now if I could only extend this functionality to Malware and Adware sites.
Thank you, Slashdot!!!
Shame on Google.
I'm sorry, but the abuse desks almost never do anything useful. They are constrained by the lack of manpower, and they are constrained by ISP policy from doing anything that could ever be considered censorship to avoid losing the "common carrier" protections they currently enjoy.
Moreover, for many ISP's, spammers with "pink" contracts pay good money and help keep pay the ISP's bills. Agis.net tried this, and it wasn't until the Cyberpromo spammers had their upstream routers DOS attacked to death that Agis stopped taking Cyberpromo's checks, despite Cyberpromo's demonstrably criminal and fraudulent behavior.
To an ISP on the edge, a paying customer is very valuable.
Do you really think these spam servers, websites and there bandwith costs are not fraudulently optained? Your not costing the spammers your costing whoever ends up paying the credit card bill. Probably the credit card company will take up the tab, sometimes the acual person.
Imagine a beowolf cluster of these!
just a web application developer and instructor in Toronto, ON Canada
Instead of showing off your 12 year old IQ why don't you wake up and remember that 99.9% of spam does not have a valid reply-to or from adress and thus those 'mailbox does not exist' messages will go nowhere. Most zombie spam / virus mails these days forge the headers to look like they came from one of your contacts, so MSC will compound the problem by spamming a random friend whenever you get spam.
As a webmaster I decided my associates would not appreciate their email addressses being spammed because they were listed on a website but they still wanted their addresses listed on my website. I decided to develop SandTrap, which is now a SourceForge group. The way it works: 1. bots see an empty HTML link tag in the page source and follow it 2. The page they follow it to has meta tags instructing nice bots not to follow the links on the page (noindex,nofollow) 3. The bad bots of course ignore the warning and follow the links 4. The ip address of the bot is recorded and blocked from the server It's written in perl and I've only used it on one website so far but it seems to work in theory at least. Oh... I also replace at symbols in email addresses with an image of an at symbol. That is pretty fail proof.
Ok, maybe I'm missing something here.
You are indeed. The 0wned zombie machine is the spammer's friend. By emailing trojans to millions of Outlook users I can 1) Get a massive list of valid email addresses and 2) Recruit loads of PCs to spam others.
I don't use my regular email address for anything on the web. Yet I still get spam. Why? Because someone that had my email address in their contact list got 0wned. I get LOTS of spam that's customised with information gathered this way.
The VAST MAJORITY of spam (everything I've recieved in the last few weeks certainly) comes with forged headers. You can do some research if you want. Send all your spam from all your boxes back to the 'sender' for a couple of weeks and see what happens. Answer? NOTHING. Spammers don't maintain mailing lists. They just supplement them. You can kill your email address for months, and when you create it again I guarantee you'l get spam again immediately.
And about your 'if the address is bogus don't read it' comment. Are you saying that I should send a 'Are you real' reply to every email I get from a new address? That would sure piss off my clients. I know some companies that does that, and it's irritating as hell.
Leave the thinking to the professionals kid.
It's a disturbing sign of the state democracy is in in America that this has been modded "Funny"...
Be aware, it may have to go through several errors before resuming operation.
"Live Free or Die." Don't like it? Then keep out of the USA