Spamfighting Since the Death of MakeLoveNotSpam?

vacuum_tuber asks: "The now-defunct Lycos anti-spamsite screen saver, MakeLoveNotSpam, was extremely well received despite the whines and hand wringing from the no-one-should-ever-actively-defend-themselves crowd. There was speculation after its demise that Open Source spam-punishing tools would emerge. Other tools such as SpamVampire, LadVampire (punishes fake bank sites), Spam Research Tool and others were mentioned with increasing frequency, but there has been no coherent followup to gauge what people are doing since the death of the Lycos screen saver. What are you doing that you think is effective in punishing spammers or their spam-site sponsors?"

Comments

Simple solution...

[ActionJesus]

Just chop their heads off. See how well they spam if they cant see their monitor.

The best way

[nilbog]

The best way to fight spam is to go home and turn off your mom's zombie computer...

Re:The best way

[Anonymous Coward]

Duh, slashdotters are home, in the basement. That should be go *upstairs* and turn off their mom's zombie computer.

Don't join the mob

[IntenetStormCenter]

The vigilante mob created by Lycos was nothing more then a publicity stunt gone wrong.

Cooperation and user persistance has pushed spam already to the fringes of the Internet. Spammers have to just compromissed machines and other criminal methods to spread their messages.

Making them a victim will only make it harder to push them out, and it will take away resources from the actual problem: People buy the crap offered by spam! Spam is no longer free. If people would just stop buying based on spam, the problem would solve itself.

Fight Spam with Spam! Spam Spam Spam

[Brainboy]

I've been spamming the spammy spammers with my anti-spammer spammer. My spam scripts is well suited to spamming spammy spammers with spam. Spaming spammers is the best way to get them to stop spamming. Infact sometimes I use other spammer's spam to spam the spammers.

Now I'm off to eat my breakfast of spam, eggs, bacon, and spam.

Make it illegal.

[koreaman]

Make spam illegal, that is the only real way to stop it.

Write your congressman, if you have some free time try to meet with one of them and lobby them. Few people know how remarkably easy it is to get your congressman to sit down and meet with you.

Re:Make it illegal.

[sqlrob]

Like making drugs illegal has stopped drug abuse.

Or like making identity theft illegal has stopped phishing scams.

Or how making unauthorized access to a computer illegal has stopped spam coming from compromised machines.

Re:Make it illegal.

[flyingsquid]

Write your congressman

You mean we should flood their mailboxes with offers for viagra and penis enlargement?

I don't punish spam.

[Man in Spandex]

SPAM punishes itself by giving an "evil" image for their company.

Best way to punish spam is by keeping your friends AND foes aware of what to not pay attention. In the end, hopefully, they'll make less profit. Nonviolence resistance demands patience and is a slow process but always shows progression.

Spamvampire works

[DogDude]

I use Spamvampire almost constantly. It works great. It sucks up their bandwidth, and while it doesn't DOS them, it does make the business of spam a hell of a lot less financially viable. I regularly pound on spammer sites (the sites actually selling the garbage) for a few days, then the site dies. Now, there's no way to know if it's because these sites are only designed to be live for a week or so at a time, or if I really am hitting them in the pocketbook, but I'd like to think that it works. At the VERY least, it makes me feel better knowing that somebody is going to be very shocked when they see their bandwith bill at the end of the month. And, the info that the guy who wrote the SmapVampire scripts concerning the 97% billing is very true, so the results he describes are actually quite realistic.

Re:Spamvampire works

[Matt Perry]

I use Spamvampire almost constantly. It works great. It sucks up their bandwidth, and while it doesn't DOS them, it does make the business of spam a hell of a lot less financially viable.

Wouldn't local, transparent HTTP proxies put in place by ISPs, such as DSL and dialup providers, prevent SpamVampire from being effective?

Re:Spamvampire works

[Trepalium]

Seems that way, doesn't it. Why wait for the courts and laws to come into effect when we can be judge, jury, and executioner? Then again, the submitter of this story wrote to me, "There never seem to be any real cases cited, only hand-wringing by people who have not been joe-jobbed but who seem more concerned with hypothetical joe-jobbing of unnamed, unknown others that no one can point to". When I did name some specific joe jobs (such as the SpamCop and Spamhaus joe jobs), there was no reply, predictably.

But, I give up. I cannot convince someone who can't see beyond their own nose. Instead, I'll make this perfectly clear. I don't send spam, but if I ever get DDoSed by any of these holier-than-thou anti-spam vigilantes, I will do all I can to see the full force of the law fall upon them. You'd be no better than a script kiddie, and subject to the same punishment as far as I'm concerned.

Vigilante justice soils the good name of the anti-spam groups out there that are working hard to help the world control the spam problem. Attacking spammers with DDoS only changes them from being a criminal into being a victim, and we do not want that.

Unsolicited Commando

[Anonymous Coward]

Nice tool to jam spammers...http://www.astrobastards.net/uc/

My solution

[nizo]

What are you doing that you think is effective in punishing spammers or their spam-site sponsors?

Sending xmas cards to inmates about to be released from prisons in their state with the spammers name and home address as the return address with sincere hopes that they will come visit once they get out. Plus I get to use up all these extra xmas cards instead of packing them away for next year.

Turn images off

[Neil Blender]

Turn images off. And filter on <img src=. And tell your Mom to.

Two approaches.. ban buying, hit the websites

[speculatrix]

Why don't we consider the complete opposite: make it illegal to buy from spammers - kill the revenue stream, kill the spammer's business, stop the spam.

Another method is to hit the spammer's website... consider this perl fragment:
while (1)
{

• $sock = new IO::Socket::INET (
• 
  
  • Proto => 'tcp',
  • 
    PeerAddr => 'website',
    PeerPort => '80',
    Reuse => 1
    
  );
  $sock->autoflush(1);
  push @sockArray, $sock;
  

}

Naturally, the above code is for educational purposes only and is not intended to be used in anger :-)

Post URLs here

[Quixote]

and this motley crew shall /. into oblivion...

A hypothetical...

[Shadow Wrought]

If a spammer and a phisher were both drowning in a pool, and you only had enough time to save one, would get lunch or go for a walk?

Re:A hypothetical...

[SmurfButcher Bob]

I'd tell them I'll save them both... after I've finished checking my email.

What about -

[thewldisntenuff]

Forcing ISPs to turn off/temporarily disable the accounts of zombied, 0wned, computers? Isnt that where most of the spam comes from? How much spam could be stopped that way?

Doesnt have to be permanent, just cut it off and request the user run ad-aware/spybot/a decent virus scan and away they go......

-thewldisntenuff

Respond to them

[Stephen Samuel]

This is especially usefull for things like Mortage sites.

Give them info that at least looks real.
If you give them your real phone number, then you can keep them on the phone line for 1/2hour (if you've got a headset), while you play your favorite game.... then tell them you hate spammers.

Even if you don't give them your real time, it forces them to verify the data. People pay for info from those spams because it's mostly good data. from people who want mortages.

If you keep the S/N ratio from spams higher than random cold-calling, then the spam's useless.

For stuff like cheap viagra, it's mostly an attempt to get them to annoy their credit card company. or just wasting their time. If we (slashdot) can each get spammers to waste 10 seconds of their time, that's some number of spammer man-years. If we can each get them to waste 10 seconds a week, they're out of business.

It's using the statistics of spamming against them. They currently get about 1million-1 response ratio with a very high signal-noise ratio. If we can get that up to 1000-1 with a 1-1000 signal-noise ratio, then they'll drown in their own garpage.

Re:Respond to them

[Anonymous Coward]

and i love it too. I comb their site and post virtual orders, contact info, customer surveys (its dangerous to ask my opinion about spamming ;) and grab all the customer support and sales email addresses and un-subscribe them to their own spammer, as well up to 50 other address collection sites (i keep a current list). That way they get their own spam (and much more) and get a taste of what their own dollars are doing to me. That way they can DoS themselves with spam.

Yea, it takes time to be a pain in the neck, but it feels so good. Am I an addict? Nah, compulsive, vengefull, and @n as$-h0l3 maybe...

8^>

No sympathy for the spammer...

[Chordonblue]

"...the actual problem: People buy the crap offered by spam! Spam is no longer free. If people would just stop buying based on spam, the problem would solve itself."

So what you are in effect saying is that people who hawk too-good-to-be-true investment schemes and storcks shouldn't be punished? People are gullible, people are going to continue to be taken in by their greed, ignorance, or even illness.

I think these parasites should be taken down. Whether you agree with Lycos or not, I commend them for at least bringing this possible solution to the spotlight.

wget+bash + SPAM = Fun

[cluge]

Or

LWP + PERL + SPAM = Fun

Take your pick, for something simple like a website that is hosted on compromised machines, simply loop the address through wget, use the output of ps -aux | grep wget | wc -l to keep the system load down to something reasonable - like 50.

Another fun game is when the spammer/phisher wants some personal information. Use LWP to walk through the order stages or web pages. Then give them the information that they asked for.

Name - Don't you know
Address - don't you wish you knew
City - not yet
State - that one
zip - 12345-678

Special order instructions:

Don't ever e-mail me again, ever, please. I'm begging you. In fact I'll be nice, i'll only send this very same message once for each attempted spam delivery. So far the machine that delivered this message has also made 150,000 connections, to try and deliver messages to users that don't exist.

Add random garbage to through off simply filters. Rinse and repeat until messages stop coming to you

Using the host command, with the name servers that show up in the whois. Walk the dns. It's trivial to repeat until server stops responding. Especially if the server is another zombie.

Tactics usually prove good at stopping sites hosted on compromised broadband connections. These machines generally have upload limits that run out quick. Sites hosted in China or Russia seem to have more bandwidth and can take more of a load. I only know this because I read around. I would never, ever advocate such a thing as returning the spam I receive to the spammer via his web sites order page. Doing what is suggested would probably get you in trouble.

My solution? Baseball bats, but my lawyer has told me that they may be illegal as well.

cluge

snail-mail spam right back at ya!

[Pretbek]

Posting the physical address of a spammer on /. and asking people to "please not sign him up for all the snailmail-spam you can find because that is so impolite" seems to have worked well in the past. Well, it worked at annoying the spammer, that is. I don't know if the amount of sent spam actually declined.

Hand Wringing

[fm6]

MakeLoveNotSpam, was extremely well received despite the whines and hand wringing from the no-one-should-ever-actively-defend-themselves crowd.

Hand wringing? Like all vigilantes, you love to emphasis your own macho attitude and the supposed wimpiness of your detractors. Whereas the real issue is the collatoral damage.

Re:Make them use the products that they spam

[ZeroExistenZ]

So spammers would be crushed under their massive erect penisses...

Forward the spam to the BSA

[Anonymous Coward]

For the spam that sells software, I parse the html code (kmail shows the code, not the rendered page) for links to the spam sites selling the software. It's almost always Microsoft Office, Macromedia Dreamweaver (and/or Flash and I forget the other Macromedia software), Adobe suites, Intuit's Quicken or QB, Symantec's software, AutoCad (?) and a few other regulars I can't remember right now. Almost always, the software includes the big ones above, and sometimes a few others.

So I parse the links, removing the filler, isolate the links, then go to BSA's site, and fill out their piracy form. I provide the isolated links, along with the entire email itself including headers, so that they can investigate the spamvertisement themselves.

Then I add a few words of encouragement at the bottom. Three words are generally enough, you can figure out your own slogans as a substitute.

Keeps the BSA busy, their minds on other things, minimizes the amount of trojaned software that clueless users download via spam if BSA actually takes action to close the sites or go after site owners, and lets me kill some time.

I've been thinking of ratting out the criminals selling "pirated" software on Craig's List to the BSA piracy line as well. Maybe I'll make that the next step. It'll keep cheap "pirated" windows software off people's computers, and perhaps give the prospective buyers more incentive to use FOSS/Linux instead. Or at least OpenOffice on Windows, which makes it easier to get them on FOSS/Linux platform later.

The BSA is the greatest thing since sliced bread. Without them, why would most Windows users migrate to Linux? Because its a better platform? Bahhh! They don't even know they're running Windows, let alone why Linux is better or not.

My payback? SPAMHAMMER 2.0

[SmurfButcher Bob]

A long (long) time ago, I came home to find my wife pumping some online poll, somewhere. Vote, click, wait, back. Vote, click, wait, back. It seems that Marvel was running a "who's the coolest X-Man" poll, and the various fan-groups were doing their damndest to win. Since I wanted my computer back, SpamHammer was born. With a dynamic array of winsocks, it'd allocate as many as the target server could handle, and repeat the voting that you'd "taught" it xxx times. It did well, to the order of a thousand or so per minute if the target could handle it. I must say, the pained expressions on the faces of the various people who were NOT in my wife's fan-group was worth every minute spent coding it, if only I could have seen them. An army of them would spend an hour pumping in a few thousand votes... I'd throw in 10k votes in the time it'd take to make a cup of coffee. It was a few years ago, but it was the type of user-torture that lasts a lifetime.

Eventually, the phishing scams came out. And the mortgage quotes were flowing in. And I got tired of all of them. And I remembered SpamHammer.

So, a LOT of searching of the old file-tree to find it, a little tweaking, and V2.0 was born. This new version supports everything needed to pump tons of crap into any site, POST or GET, cookies or not. I spared no feature - from random emails, random name permutations from the USCB, junk mailing addresses that'll pass a city/state/zip xref, random credit card numbers with proper checkdigits, and even stuff picked from lists (think of med sites). Mortgage quoters want leads? Here, have a million. Just don't bitch when the lenders refuse to pay for those leads. Phishers want accounts and passwords? No problem - with the added benefit of DOSing the target host. Free viagra? Oooo... I get wood just thinking about it... here, have a hundred thousand orders for random crap on your site.

I'm not sure why, but there's something satisfying about getting a "write failure: access denied" after pumping a few million POSTs into a site, consisting of every major field being 32K each. The only thing more satisfying is knowing that certain med-sites simply email the order to an in-box... here, have a big pile of 1Meg emails.

No, a legal solution.

[www.sorehands.com]

I just returned from serving about 12 lawsuits on Avtech direct. With enough people suing spammers under their state's laws, it will tend to reduce much of the spam -- by making the spammers pay for spammers.

Even though spam may be international, the foreign companies can be sued. When you send spam into the USA (or the particular state) you are subject to the laws of the USA. After I sued Global Web promotions, the FTC sued them and siezed their funds. Even though they are in Australia, they are doing business here by sending spam.

Forward the spam, but not just to the BSA

[IrishMASMS]

There are a few organizations & companies that would love for you to forward on your spam; and Spamcop [http://www.spamcop.net/] would love to help you LART the headers & spam web hosts.

You can tell where the spam comes from; or at least identify the web sites they are spamvertizing. Yes, it is sometimes a BPITA - hence why I use spamcop to help auto LART the headers/email for me. I know with squirrel mail any spam you can auto forward to your spamcop account to be LARTed.

Normally I LART anything that gets past the spam filters, thinking that anything that does get caught is by the big spamhouses. I also report my spam to the Feds for action:
"FTC" uce@ftc.gov,
"US Postal Inspectors service" fraud@uspis.gov

These folks ask for spam, to either tweak their anti-spam tools or for internal investigation:
"junk_brightmail.com" junk@brightmail.com,
"SendUsSpam" spam@sendusspam.com,
"Spamarchive" submit@spamarchive.org,
"Spamrecycle" spamrecycle@chooseyourmail.com,

Specific countries have anti-spam efforts:
"Spam from China" spam@ccert.edu.cn,
"Spam from Korea" spamcop@kisa.or.kr,

As already mentioned - any spam offering grey market (aka cheap) software?
"BSA" software@bsa.org,
"SBA" piracy@spa.org

Any 419 scams?
"419@nigeriapolice.org" 419@nigeriapolice.org,
"Central Bank of Nigeria" info@cenbank.org,
"thoselads_scamorama.com" thoselads@scamorama.com,
"Treasury Nigeraian scam reporting" 419.fcd@usss.treas.gov

Child pr0n?
"FBI" iitf.tampa@fbi.gov,
"FBI_Child_porn" complaints.detroit@fbi.gov

Any stock or securities spam?
"cyberfraud@nasaa.org" cyberfraud@nasaa.org,
"nasd Penny stock fraud submittal" ombuds@nasd.com,
"Securities fraud SEC" enforcement@sec.gov

Any food or drug spam?
"FDA_Complaint" webcomplaints@ora.fda.gov,
"FDA_Complaint2" webmail@oc.fda.gov

FYI: there are some anti spam groups I am a member of, where a little bit of research dug up these agencies. It is easy enough to set up an auto forward on your spam folder to report & LART the spammer scum. ;)

HTH!