Slashdot Mirror
Bounced Email - Dealing w/ the Latest Type of Spam?
heretic108 asks: "For 3 years, I've been running a home office EXIM mailserver to handle mails on my 3 personal domains. All had been fine - I'd fastidiously configured EXIM to guard against relaying, and even now receive a clean bill of health from the various relay-checker sites. Spam levels were moderate, and mostly arrested by SpamAssassin and Thunderbird's inbuilt filters, until today. I got up this morning to find 3500+ e-mails in my inbox. All were bounces - spoofed and genuine, and came from a vast variety of IP addresses (eg lots of AOL users' IPs), which indicates they're being sent largely via compromised windows boxen, as well as from inadequately-configured corporate/ISP mailservers which don't bother to check the purported 'from' addresses against the originating domains. This hurricane continues, with 10-30 new incoming spams every minute! I've re-enabled Active Spam Killer, but this is next to useless, since ASK passes all 'bounce' messages, real or otherwise, to the mbox without challenge. I'm hoping to hear from anyone who can share success stories in dealing with such a menace, without undue complication or loss of legitimate mail. Thanks in advance for all your constructive and positive suggestions." It seems that dealing with regular Spam is almost easy in comparison to dealing with its consequences: bounced emails. Does anyone have suggestions, or filters on how to handle bounced e-mail that has resulted from someone using your e-mail address to spam someone else?
This is how I do it anyway- there are several out there but I use SpamBayes because I've got my mailserver on a Windows box.
A baysian spam filter can learn to filter ANYTHING!
SJW: a person who perceives an injustice, and while correcting it, commits a greater injustice.
I get a lot of bounces from mail I didn't send. Things that come from postmaster or mailer-daemon aren't a big deal: send 'em all to /dev/null with procmail. The larger problem is vacation messages. I haven't figured out any good way to filter them. Ideas?
My SpamAssassin rules do a pretty good job of filterering messages about viruses I didn't send but even then I can't get 'em all. I wish there was standard for email generated in response to other emails.
Getting hit with a "joe job" is sometimes used as an act of revenge for a protest or flamewar. Best to keep your home email address out of the limelight for that reason.
"Eve of Destruction", it's not just for old hippies anymore...
I had this problem a few years ago. I received up to 20 messages (bounces, out-of-office, mailbox full, authentication request, etc.) a minute at the peak. In total I received about 100,000 messages over a few weeks before it stopped.
I called the company spamming and they "took a message". However, I was able to filter them because they were coming to a few specific random accounts, such as vxxylj@sample-domain.com and rtyylhi@sample-domain.com for example.
I could not find any other way to filter them because it seems that there are several dozen formats for bounces. That made me wish there was a standard format for bounces, or at least a standard subject line or sender address.
quoted from http://www.miami.com/mld/miamiherald/living/column ists/dave_barry/6649728.htm?1c
and twisted to change the subject to spam.
===
People do not like spam.
And how has the spam industry responded to this tidal wave of public hostility? It has issued this statement: "Gosh, if these people really don't want us to email them, then there's no point in our emailing them! We'd only be making them hate us more, and that's just plain stupid! We'll try to come up with a less offensive way to do business."
No, wait, that's what the spammers would say in Bizarro World, where everything is backward, and Superman is bad, and spammers contain human DNA. Here on Earth, the spammers are claiming they have a constitutional right to email people who do not want to be emailed. They base this claim on Article VX, Section iii, row 5, seat 2, of the U.S. Constitution, which states: "If anybody ever invents the Internet, Congress shall pass no law prohibiting salespeople from using it to completely fill your inbox."
For the last few months, using surbl (dot org) as to detect spamvertised URLs worked nicely, but this Christmas weekend, the company I work for got a ton of e-mails crammed with URLs with good websites. I'll have to check out spamassissin 3 to see if it gets around any of these problems, but it looks like this tactic kept my dns and spamassassin daemon busy enough to start letting e-mails through without getting scanned.
Just a heads up... It's the next phase in the arms race for me, and I'm not seeing this bounced traffic problem like the poster is.
Back in the old days, a bounce email to the "sender" of the email was the proper way to do things. Now, a straight 5xx rejection response should be given as much as possible.
One line blog. I hear that they're called Twitters now.
This isn't magic, but if everybody publishes SPF Records for their domains and checks them (SpamAssassin 3) joe jobs become much, much harder.
So do the right thing and publish them. 5 minutes a domain tops if you're familiar with DNS.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
Basically, you add an encrypted header to all outgoing emails which says "Yes, this email came from this server." Then, when you receive a bounce message, you check for the key. If it has it, it gets through, and if it doesn't, it gets rejected.
r e-authbounce.txt
Here's the Exim howto http://psg.com/~brian/software/authbounce/configu
Slashdot: Failed Car Analogies. Amateur Lawyering. Anecdote Battles.
The post already says that you're using Thunderbird's built in bayesian filtering. So what's the problem here? Thunderbird should be (If you train it properly) filtering out all those nasty bounce emails into your spam folder.
So, then, what's the problem?
The solution I'm currently experimenting with is to use simscan with qmail to pipe the mail through spamassassin before indicating final acceptance to the remote MTA. Even if it's sent by <> or sent to postmaster, SA3's scoring rules identify it remarkably well and the sending MTA gets a 5xx and it's game over. As another poster mentioned, 5xx errors are a great way to reduce bounce spam. Plus, legitimate senders who get false positives will know something went wrong, instead of their email going into the black hole of a spam folder.
$0.02,
ptd
I'm an animal lover -- they're delicious!
I allow abuse and postmaster through for any of my domains, but spammers should be aware they will be reported to the ISPs through spamcop if they use them. If they want to spam the admin on purpose, they're just asking for trouble.
RFCs are NOT LAWS
you are perfectly free to violate them
Spam lingo for this phenomenon is "backscatter" or "outscatter" (I prefer the last one, as the bounces are not actually sent "back", but to an innocent third party). Spam Links as a link collection to get you up to date at:
http://spamlinks.net/filter-bounce.htm
A nice solution is Bounce Address Tag Validation (BATV), described at:
http://www.ietf.org/internet-drafts/draft-levine-m ass-batv-00.txt
Abstract:
Acts@core.mailboks.com Acrux@core.mailboks.com Adam@core.mailboks.com Adar@core.mailboks.com Ada@core.mailboks.com
The feds won't prosecute spammers when they break the law. Forging headers is a violation of law, but since the authorities bury their heads in the sand on issues like this, there's really nothing you can do but deal with the flood. I've had it happen many, many times.
What I recommend is that you file a case with the local FBI. At least go on file. If they get enough complaints, maybe some day they'll do something about the digital criminals that operate without any fear of justice being served.
even if you filter it to trash, you still have to deal with the volume of mail.
i actually just lost my email on my hosting (shared hosting) because i was GETTING too much email. they claimed my incoming mail was flooding out their servers.
this story submitter said they host their mail server so it's an inhouse hog of bandwith.
These guys sure like to play cat and mouse games. Bayesian filters like Spam Bully http://www.spambully.com/ can filter these kinds of messages I have found on my office computer.
You should dump ALL bounce messages. When was the last time you got a legit bounce message from something YOU sent? Never? Years ago?
I had the same thing happen to me a few weeks ago they used my website that uses php-nuke againest me and i got over 6,000 bounced emails in less than 3 days.
~ GiZiM ~ www.gizim.net
is very useful for my domain. I get Exim to check valid users and 550 reject them if not valid.
That way I drop about 66% of inbound email before it enters my email gateway.
"It seems that dealing with regular Spam is almost easy in comparison to dealing with its consequences: bounced emails. Does anyone have suggestions, or filters on how to handle bounced e-mail that has resulted from someone using your e-mail address to spam someone else?"
My sympathies for your plight. However what you seek is a technological solution to what is essentially a social problem (much like the 'war on drugs' or 'war on copyright violaters'). What that basically means is that you'll win a few, and they'll win a few. Seesawing back and forth, like the US and Terrorism. So this week it will be "How do I?", and next week will be "I got the dirty bastard". Then back to "Ah crap! Another one", and so forth, and so on. Still up for a run? Or do you think mankind someday, will be mature enough to hear the real answer? But then again, If they were? We wouldn't be having this "Ask Slashdot".
change your email address Then on your old address set an out of office message pointing people to the new address. Gee... that was hard. Sounds stupid but nobody realizes if a spammer had to correct a few hundred thousand email addresses... the message would not get sent. As it is, they never send the messages from a valid address - so who cares if your replying to their spam with your real address? It will take a good year or so before you see another spam. If everyone did this, it would immediately invalidate all spam databases and cause the spammers a LOT of work.
And then organisations like sourceforge will get all horny and not users subscribe to mailinglists untill one can deliver to postmaster@domain.
Change is certain; progress is not obligatory.
I had a similar joe job.
The way I delt with it was simple;
All (afaik) legitimet bounces include a copy of at least the headers of the original email that was bounced.
If the email came from my system, those headers will contain reference to my system.
At receipt time (Eg before the MTA accepts the message), my filter scans bounce messages for my mail system name.
If it doesn't have it. its either:
a) A bounce for a message where the MTA doesn't include a copy of my original email. (oh well).
b) A bounce for a message that I sent from me, but through another MTA (unlikely, since I use spf codes and authenticated relaying)
c) A joe job email.
Problem, solved.
I use to have a funny sig, but slash cut it off, and I forgot what the punchline was.
However, the RFCs governing mail transport are Internet Standards. Some of us feel that following commonly accepted rules is more important than personal convenience, and thus are prepared to work hard to find spam filtering solutions that do not violate RFCs.
In fact, in some circumstances it can be more reasonable to break stupid laws than to break stupid RFCs, since humans at least can deal with unexpected behaviour, unlike computers.
The bounce messages you are receiving are not messages being bounced back at you to get past your message filters, they are the result of a spammer spoofing your domain name in outgoing mail in an attempt to get through another person's mail filters.
Nobody should assume a single mail message sent out into the ether constitutes a final and iron-clad communication. While it is bad to miss an e-mail message from a client or another person, if the chance of losing a message is slim and the amount of time you aren't dealing with your clients' needs due to spam bloated inbox is large, you should filter. There are many ways to lose e-mails. It can get lost in transit (actually does happen). It can get mistaken for spam by the person looking at the inbox and thrown out. It can be forgotten. The person can send it to the wrong address. The person's ISP could have an overloaded mailserver. Having a healthy e-mail ecology means having less spam, and by having less spam more real messages will get through.
There is no such thing as a perfect filter. But there is also no such thing as a perfect e-mail system. By the post office's own estimates %10 of their mail gets lost, yet we routinely rely upon that for business purposes, with the addition of redundant communication in case there is an error. There are tradeoffs involved, but if the benefit outweighs the drawbacks, and for a lot of us it does, filter your inbox.
On the other hand, Bayenesian filtering is not the be-all-end-all technology it has been propped up to be, but it is relatively good.
The ______ Agenda