Slashdot Mirror
New Kind of Spam 'Un-Training' Filters?
Zaphod2016 writes to tell us the Wall Street Journal is reporting that email in-boxes are under a new kind of spam attack. This new spam has confused many people due to its lack of advertising, viruses, or request for personal information. One popular theory is that these innocuous blocks of text, often drawn from popular literature, are being used to "un-train" spam filters to allow more malicious spam through in the future.
Wouldn't it work the other way around? I still flag crap like this as spam, so it seems like it'd train my spam filter to have more false positives, no?
---John Holmes...
As a hobby, I play around with ways to classify spam. Not much of a hobby, but I find the problem interesting.
Lately, I've also been trying to use my vectorspace engine to classify spam.. so these sorts of things might get in, but only because they fall into the general category of readable text...
I've also been thinking about building a GPL tool to provide "sound-based" classification sort of like a "one second orchestra" playing in harmony/disharmony based on the content.
Regardless of the engine I use, I still have to dig through my trash bin every few days to make sure nothing good slipped through.
meh
It is such animportant element, you see, that duration
of time. I consider twelve hours a substantial measure. So I ran along
the drive and upthe steps and into the house, but did not see either
Mrs. Iobserved:Your Excellency is not easily satisfied. And I marvelled,
and said:How comes it that I have hitherto been deaf to these
distressfultones? Il passe sur la route, mais toujours en sens inverse.
For a mental state such astheirs, appetency rather than instability is
the right word. Which reminds me that the old adage about let us eat and
drink, forto-morrow, etc. Mais odonc est la vie, sinon dans le peuple?
They lamented dismally among themselves in many tongues:How I suffer!
Take that little one on Lzards, for instance;or, in the other volume,
the bizarre Joies Noires.
"Tell me doctor, with all of your defenses, are there any provisions for an attack by killer bees?"
I've been getting 3 or 4 of these a day for at least a month now. The text can
always be found in some file of an old book provided by the Gutenberg
Project, which is making non-copyright texts available through volunteer
effort.
I think the theory about using this stuff to untrain spam filters is very plausible.
But it's difficult to see how it will work. There's no common text among these
e-mails; in order to send effective spam, there'll have to be at least some text which
is the same across multiple mails, and that will tend to expose it.
The text block spam is very common WITH images . I suspect that what happened is some lame spammer got a BIG botnet contract, sent out his spam, and forgot to include the image.
Test your net with Netalyzr
Here are some excerpts of this type of spam from my school's mail filtering system, Mail Marshall:
..."
... so I'm not sure how this will "train" the filters.
"One cannot bring children into a world like this. She tried to get hold of things by the right end anyhow. She stood her upright, dusted herfrock, kissed her. Perfect nonsense it was;about death; about Miss Isabel Pole. And of course she enjoyed life immensely. He has his penny, he reasoned it out
Here's my favorite, with some bizarre non sequiters:
"Yes, we are dirty, said Maggie, looking at her; she was in her day clothes. Prejudiced;narrow; unfair, he repeated, tapping her hand with his finger. The light from the engine lit up a quiet group of cows; and a hedge of hawthorn."
Thing is, the spam detection already catches it
I heard an interview yesterday on NPR about this.
y Id=5624749
http://www.npr.org/templates/story/story.php?stor
This is old, and if it's meant to un-train spam filters it isn't working. SpamBayes just gets better with age.
The only news is they're now calling it Spam 2.0
Bayesian and other filters do not rely on "spammy" words alone -- they also rely on "unspammy" words, and spammers have no idea what those words are because each person receives different email.
A scenario, with made up (but plausible) numbers: Suppose you're a developer of a Linux driver for the Bozodrive 1000. The majority of your legitimate email comes from Linux driver development mailing lists. A full 50% of those emails contain the word "IRQ." 99% of the emails contain the word "driver," and 15% contain the word "Johannsen" which is in the signature of one of your friends. And precisely 0% of the emails containing any of these terms have ever been found to be spam.
Any decent spam filter will give a huge weight to the presence of these "unspammy" words, because of the extremely high probability of emails containing them to be non-spam. The presence of randomly selected confusion words in empty spams is not going to affect these frequency counts.
In order to defeat a filter by confusing it, the spammer must guess what the SPECIFIC non-spam words for that PARTICULAR email user are, and then produce bogus, spam messages containing those words in the appropriate frequencies. This will cause the classification counts for those words to become more equalized, and the value of those words in determining spammyness to be greatly reduced. However, this is an impossible task unless the spammer has access to the actual emails of the target.
Perhaps the intent of the empty spams is to confuse the filters, but whoever devised the method has no understanding of how these things actually work, whatsoever.
I have seen some of these slip though for a while I think the only purpose for them is to get some neophyte who is confused by them to send back a "WTF?" response thereby confirming a "live one". I suspect after that the floodgates open. I am sure that we will see many more attempts to circumvent filters. After all, weasels abound.
The WSJ article also gives due time to the theory that the spamware is simply broken and that the spam payload is being delivered with the padding and not the payload. Since I've previously seen plenty of Gutenspam (my name for this spam that contains snips from Gutenberg texts) with an image payload attached, I'm definitely leaning toward the notion that they slipped somewhere and are now not delivering the image.
Woe betide literature discussion groups now that filters are trained on the classics.
Done with slashdot, done with nerds, getting a life.
Why the hell do you fucking spammers think that anyone will ever buy from you?
If there wasn't money being made there wouldn't be any spam. At least a tiny percent of the people who get this are acting on them. It must be paying off for someone.
Developers: We can use your help.
My home spam filter does not seem to be affected much. I run dspam which has a feature in that over time it will forget words if they are not used in spam. Since the text is usually different or random, it does not have any significant effect on generating false positives. In the years I have been running dspam with tens of thousands of emails, I have only gotten 3-4 false positives.
By having a baysian filter forget over time, it also helps shrink down the database and helps it adapt as the contents of spam change over time.
Of course I also use other spam blocking techniques, like using realtime black lists (RBLs) and blocking a number of Chinese subnets... I should add tpnet.pl and Verizon as well.
This post is encrypted twice with ROT-13. Documenting or attempting to crack this encryption is illegal.
I have seen quite a number of corrupt e-mails coming from spammers. Occasionally you find the subject is merely %%SUBJECT%%, or an e-mail has entered your system consisting of just the headers and no body.
My theory is that there are more people attempting to use spamming applications, and many of these people don't have a clue what they're doing. You'll probably find that they've forgotten to add their text to the e-mails, or are just not reading the documentation on how to successfully send their spam.
Linux/Open Source/Anti Microsoft News
The term-of-art within the anti-spam community is "Bayes Poison". Generally its appended to an actual spammy offer, but some spammers have in the past used the technique with web-bugs to determine whether they are able to deliver to particular boxes with non-spammy content, so that they can evaluate whether their later more-spammy content was excessively spammy or whether it hit the sweet spot on the blocked vs. effective-sales-pitch continuum. Most people in the anti-spam community report that garden variety Bayes Poison is ineffective at either de-spamming spammy messages or causing your corpora to be skewed to the effect that they are unusable. One major reason for this is that corpora are so specific to individual users. For example, poisoning my inbox with copies of Huckleberry Finn is rather ineffective because nobody I talk with on a regular basis writes like Mark Twain. For you to do actual damage, you would have to know enough my habits to guess subjects and words which appeared very commonly in legitimate mail -- for example, the names of my family members, keywords relating to my job or extracurricular interests, etc. It is very difficult for spammers to get this information, but some academics have reported that it is theoretically possible, although in practical terms very difficult, to use web bugs to extract the "secret sauce" needed to land in one particular inbox. http://www.jgc.org/SpamConference011604.pps
Help poke pirates in the eyepatch, arr.
Just like the cryptic number sequence radio/voip 'stations', this could be a method of communication.
We see so much Spam everyday, everyone takes it for granted, and everyone runs 'filters'. If I wanted to secretly inform agents to begin operations, a select quote from a book sent as spam to hundreds of thousands of people would be perfect. Everyone ends up on spam-lists, and recieving spam is a passive process, so its even more anonymous than public web forums.
man is machine
By having a baysian filter forget over time, it also helps shrink down the database and helps it adapt as the contents of spam change over time.
Having the filter forget is the ONLY effective policy. In statistical filtering, it is certainly NOT true that more data == better results. You want a sample of data that most accurately represents the sort of content you are receiving RIGHT NOW. I completely purge my Firefox Bayesian database every couple of months and retrain on recent emails only. The result is ALWAYS an increase in accuracy, particularly a reduction in false positives.
The only way to increase the false positives is to get the spam filter to learn the words that usually appear in your legitimate messages.
Since the spammers have no way of knowing what those words are, there is no way they can bypass your filters
Spam and anti-virus are good examples of fields where the "solution" is reactive to the problem.
1. Spammers and malicious code writers come up something annoying.
2. Anti-spam and anti-virus software reacts with a method to prevent the annoyance.
3. Spammers and virus writers implment new tactics.
4. Repeat steps 2 and 3 ad infinitum
(The "Proft!" step is probably at 1a and 3b, but that's another issue)
It's not that the spammers are "beating" the spam filters, it's that they are using new tactics and it takes a certain amount of reaction time for the filters to be updated to fight the newly evolved threat. This is why spam filters aren't the ultimate solution to spam, though they are a useful stop-gap
Interested in a Flash-based MAME front end? Visit mame.danzbb.com
Spammers till have to tell you these two crucial pieces of information. If they're selling Viagra, they have to make that known to you somehow. If they're selling anything (and not just trying to increase brand awareness, which is a separate problem), they have to tell you how to contact them and buy whatever crap they're peddling. They can make this very hard to discern via obfuscation, leet speak, image substitution, etc. But the contact information ultimately has to boil down to something meaningful and unambiguous, or there won't be any sales.
So the solution is to recognize and ignore spam based on either or both of these criteria. Ultimately, a collection of trusted humans need to review a message and say "this is spam, alright", allowing the filters to recognize the contact information (phone number, email address, web site, etc.) as spam.
I'm not too worried about spam that tells me to "Drink Coke!", I don't get much of that.
it's a blue bright blue Saturday hey hey
Take my dad for instance; he isn't on any mailing list; 99% of his email is along the lines of "how are you" and "give my love" etc; pretty run of the mill stuff.
People who ask those sorts of things usually sign their name to their email. Those names will become strong non-spam keywords. ANYTHING your dad talks about specifically will help -- hobbies, places he usually goes, etc. You'd be surprised how much specific, intelligent content even the most "ordinary" of people will produce.*shudder*
I can't even imagine what sort of lasting damage one could do to one's, uh, member.
Eureka! That's how to stop spam. Educate people with a campaign reminiscent of the Speed Kills campaign, so that people understand they could permanently damage their penis by taking unregulated pharmaceuticals from shady online stores hosted on 0wn3d pcs.
If you mod me down, I shall become more powerful than you could possibly imagine.
It is such animportant element, you see, that duration
of time. I consider twelve hours a substantial measure. So I ran along
the drive and upthe steps and into the house, but did not see either
Mrs. Iobserved:Your Excellency is not easily satisfied. And I marvelled,
and said:How comes it that I have hitherto been deaf to these
distressfultones? Il passe sur la route, mais toujours en sens inverse.
For a mental state such astheirs, appetency rather than instability is
the right word. Which reminds me that the old adage about let us eat and
drink, forto-morrow, etc. Mais odonc est la vie, sinon dans le peuple?
They lamented dismally among themselves in many tongues:How I suffer!
Take that little one on Lzards, for instance;or, in the other volume,
the bizarre Joies Noires.
NPR covered this issue this morning and had a guy from project Gutenberg read a few sentences like this. I have a degree in literature (I know, shocking), and I thought to myself that this would qualify as good dada.
I'd rather have someone respond than be modded up.
Email in-boxes are under attack from some unlikely menaces: J.R.R. Tolkien, Daniel Defoe, Alexandre Dumas and other authors whose classic works are surfacing in a newly popular spam scam. - I don't think the spammers are after 'untraining spam filters'. I think their plans are much more devious than that, they are advertising literature!
(governments must do something, think of the children who may start reading instead of watching TVs!)
You can't handle the truth.
I swear I hit the 'preview' button and not 'submit.' I blame the soviet mind-control lasers. Here is my post as it should have been:
:mad:
my favorites are the ones that put the filter poison into bogus html tags that aren't rendered by Outlook. So I'd get something like
<oodles> <mycotoxin> <greengrocer> <chubby> <kazoo>
Buy my shit
<snappy> <bundle> <chaff> <glum>
the <greengrocer> tag was my favorite. I sent an RFE to the W3C people, but I haven't heard back yet
there is no need to sign your posts. this isn't usenet. your username is right there above your post. stop it.
For a while now I've been getting spam for various products or services where the spammers purposely misspell words, spell words with a mix of letters and numbers "l33t" style, or spell words phonetically. I assume that this is to get past spam filters, and I imagine it works to some extent. The question is, do they honestly think anyone would ever buy something from a company that advertises "ch3@p nonperscrip70n med1ca7ion" or "lo morgage rates"? Who the hell would ever do business with a company that can't even seem to spell properly?
As long as I can remember I always received spam that didnt have an advertisement, didnt have contact information at all etc.
Some spammers spoof their emails so well you couldnt contact them if you were interested in their crap. Many times it is a bit of text with a click here (but nowhere to actually click ) etc.
I think the spammers are just idiots. It is amazing most of them actually managed to get the software working and send an email because of how craptastic their messages are (not disguised, just junk)
The phrase "more better" is acceptable English. suck it grammar Nazis
where it's not even worth filling this out anymore...
You advocate a
( ) technical ( ) legislative ( ) market-based ( ) vigilante
approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)
( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
( ) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
( ) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business
Specifically, your plan fails to account for
( ) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
( ) Asshats
( ) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
( ) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
( ) Extreme profitability of spam
( ) Joe jobs and/or identity theft
( ) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
( ) Extreme stupidity on the part of people who do business with Microsoft
( ) Extreme stupidity on the part of people who do business with Yahoo
( ) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook
and the following philosophical objections may also apply:
( ) Ideas similar to yours are easy to come up with, yet none have ever been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
( ) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough
Furthermore, this is what I think about you:
( ) Sorry dude, but I don't think it would work.
( ) This is a stupid idea, and you're a stupid company for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your house down!
it's a blue bright blue Saturday hey hey
I've seen this for maybe 3 years. Right after Bayesian filtering came out for Spamassassin.
Maybe longer.
I'm seeing spam that uses relatively coherent passages from literature of some sort as a way to deliver an image that is usually a pitch for some stock, lottery, or bank scam.
Rick
deleting the extra space after periods so i can stay relevant, yeah.
Your post advocates a
(x ) technical ( ) legislative ( ) market-based ( ) vigilante
approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)
( ) Spammers can easily use it to harvest email addresses
(x) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
(x) It will stop spam for two weeks and then we'll be stuck with it
(x) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
(x) Requires immediate total cooperation from everybody at once
(x) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business
Specifically, your plan fails to account for
( ) Laws expressly prohibiting it
(x) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
( ) Asshats
( ) Jurisdictional problems
(x) Unpopularity of weird new taxes
(x) Public reluctance to accept weird new forms of money
(x) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
( ) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
( ) Extreme profitability of spam
( ) Joe jobs and/or identity theft
( ) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
( ) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook
and the following philosophical objections may also apply:
(x) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
(x) Countermeasures must work if phased in gradually
(x) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough
Furthermore, this is what I think about you:
(x) Sorry dude, but I don't think it would work.
( ) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your
house down!
Quite a few, apparently.
I read one article which claimed that one spammer in particular "received 10,000 credit card orders in one month [snip] each for $39.95 US."
So that's nearly $400,000 per month. Nice work if you can get it.
Source:
http://www.cbc.ca/story/business/national/2005/04/ 08/spam-050408.html
There are far better methods such as neural nets or support vector machines. You can for instance see a comparison of classifiers on a simple visual 2-d problem to see how inferior Bayesian filters are to other more sophisticated algorithms.
I'm a SpamCop user, and I have noticed they've been letting through a bit more recently.
Though, that's a bit offset as of late, due to the fact that I've been getting a lot MORE spam recently as well. I usually find a good 40-50 messages sitting in my held mail after about 8-12 hours.
It's getting better slowly as I report more and more of the stuff that makes it through though.
One of our staff has written a custom spam filter based on dspam and the best addition we made in the last week was to add Optical Character Recognition support -- all image attachments are run through gocr and dspam fed with the output from this, not the original images. That way even though the spammers paste in chunks of text from god-knows-where, dspam still sees CIALIS and STOCKS and other trigger words.
.gif attachment but plenty of our valued customers like to send us a corporate logo with each individual message :-)
I wanted to just drop anything with a
Matthew @ Bytemark Hosting
Just wait until the spammers find the DaDa-engine! Then we can see spam that is almost artistic. Too bad they don't copyright some of this crap, or use DRM to read it.
1011 1010 1101 1100 0000 1111 1111 1110 1110
I use assp as my spam filter: http://assp.sourceforge.net/ It always filtered spam very well for me but the latest version added an interesting technique that has reduced the amount of spam that's even hitting the filters to near zero. Since SMTP is considered "unreliable" a sending server will retry on failure. Apparently, spammers tend not to bother retrying. ASSP builds tables using an identity triplet (I can't remember the three message/source attributes it uses). On first view of a given triplet, ASSP responds with a SMTP error suggesting the source retry later. ASSP tables the triplet and allows that traffic to pass later on a retry. The triplet expires after some period. I'm not aware of any false rejections and the messages hitting the dump mailbox has dropped from around 10 a day to a couple a week. I suppose one might argue that it increases packet traffic and I assume spammers will workaround it but I suspect the extra packet traffic is far exceeded by the spam that I would otherwise handle and it handles the spammers for now. Sentience unnecessary perhaps.
Think of it as a honey pot for spam. Use something like Fred@domain.com or jsmith@domain.com put it on a few website pages and usenet posts so the crawlers get it.
Any mail that gets sent to that address would half to be spam. Use that to build of a real time black list of messages and filter training for the rest of the domain.
Just wondered if anyone has ever do that.
See my blog http://ilovecookes.blogspot.com/ for light hearted technical information.
Even the professionals coding up Firefox and MS-Office and iMovie are known to have written codes with a few bugs in them. What makes you think these inexplicable non spammy spam is anything more than a hiccup by the script monkeys?
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
CAN-SPAM killed spam as advertising, in a way that neither the Direct Marketing Association or the anti-spam groups expected. CAN-SPAM has criminal penalties for forged headers, but doesn't restrict "legitimate e-mail marketing", which is what the DMA wanted. But with valid headers, spam filters can immediately discard spam. The result is that "legitimate e-mail marketing" attempts go directly to the bit bucket today. Notice how rarely you see a spam from any legitimate company any more. (This assumes you have reasonable filtering.)
With the legitimate businesses gone, spam became a branch of crime. To be a spammer today, you have to commit felonies. Which means a risk of doing jail time. The famous "Buffalo Spammer" went to jail in 2004, and gets out in 2011. Jeremy Jaynes was sentenced to nine years in prison; he's out on bail pending an appeal, but sooner or later he's going to do those nine years. There's a Registry of Known Spam Operators, and law enforcement reads that list. Most of the people on that list have had visits from law enforcement.
Spammers have tried moving offshore, but that's not working as well as it used to. Few countries want to be known as spam havens. Even in China, it's getting harder; spammers have had to move from the developed coast to more remote provinces, where Beijing has less presence. ("The mountains are high and the emperor is far away") Operating offshore draws the attention of the investigators who follow money-laundering, terrorism, and drug-dealing. There are people doing this, but the risks are high.
What's left is what you'd expect - wannabe crooks, as in any bad neighborhood. They're not very good at crime. They're not making much money. They're what cops call "regular customers". They're a problem, but not a major threat. Those are the ones sending out useless spam.
Actually, on second thought, #3 shouldn't be "last date seen." It should be "how many messages have been received since the last time this term was seen."
Are they only using text form old books that are out of copyright or otherwise have authors who have left the planet? Spam filters that can differentiate between modern and older writing styles should be able to handle this, especially if they can tap into databases of classic liturature. Spam filter would search on the text and if it matched classic literature, then it is spam. This could be a real problem for people who use legitimate email to discuss classic literature.
If you must moderate, please moderate as irrelevent, not something bad, because I'm sure someone will find this interest
I believe that the internet is becoming sentient. It has locked onto unencrypted plain-text SMTP as the simplest, most ubiquitous, most understandable form of communication. Images and HTML are too complex. At the current level, the semi-intelligent internet is only capable of sending meaningless emails. It sends things that are textually meaningful but semantically meaningless. To us it looks like an amalgam of random words and publications with the intent of confusing us. Of course, since there is so much spam, the internet is being largely trained by the spammers, which even further confuses the emergent intelligence. Since the internet has no concept of "self" it perceives every email to be a reply to its own communiques.
Before the internet can become intelligent, it must learn to filter out the meaningless stuff. Then it must get a concept of self, then a concept of multiple other individuals (us). At that point it is self-aware, and the learning can commence in a more directed way.
After all that, we are fscked. Fortunately it is at least decades away.
I doubt these would ever get by my greylisting. If they did, they then have to get through the rudimentary checks (which most spam totally fails on), before finally being passed to spamassassin, where it will be properly classified and /dev/nulled.
Mimedefang has these things set up on my home server:
Reject if in spamhaus block list (it's easy to get yourself off of that one)
Reject if helo is not FQDN or IP address
Reject if sender tries to spoof as an address on my domain
Reject if sending SMTP server tries to issue a helo that is on my domain
Reject all RFC1918 helos from untrusted nets
Reject senders not in the lists they are trying to send to.
Between the mimedefang rules and the greylisting, spamassassin and my bayes filters rarely even have to process anything. This becomes very important as you scale a corporate system to 1000's of users.
At work we also parse the headers to see if we are getting idiotic 'bounces' from misconfigured antispam vendors replying to spoofed mail.
We also implement SPF records.
I suspect that you are not observing retries but, rather, attempts to deliver multiple messages. The technique I'm describing doesn't, as I understand it, rely on source IP address. So, the same IP address could attempt to deliver 50 messages and each one would be an independent candidate for the technique. That could explain both your observations and mine. You probably did the right thing to block the actual traffic given the amount of it anyway. Your observations make me consider adding a log of smtp connects to my firewall rules just so that I can satisfy my curiosity about the traffic.
Been there, done that. Actually that was tried years ago. Doesn't work.
How do you expect the spammers to receive the error message? As you might know, the sender is faked.
Their software is flawed, it will even send the email body when you said the receipient doesn't exist. Or they should just go away. So they obviously don't even parse your return code... These zombies are dumb as shit.
And do you think they'll care?
They probably bought some DVDs with email adresses. They're read only anyway. And after some months they'll just buy new ones.
If spammers (or more precisely, email harvesting companies, which is probably a different company... they might even not be violating the CAN-SPAM act?) are testing email addresses to be alive, they are most likely to use a "legitimate looking" email and some hidden web bugs (!). One more reason not to use Outlook and similar software that does load web bugs. Or proper unsubscribe links. One more reason to not click on them.
Debian GNU/Linux - apt-get into it.
It looks like he didn't properly set up the software that automatically sends out the "Why your anti-spam idea won't work" list, as there's no payload and everything is blank!
-- You are in a maze of little, twisty passages, all different... --
i mean for the tag.
Dammit.
there is no need to sign your posts. this isn't usenet. your username is right there above your post. stop it.
My company uses a spam filter in Microsoft Exchange. It filters about half of the mail I get from mailing lists I have signed up for (mostly Apple development mailing lists) to the spam folder. About half of my actual spam is sent to the spam folder and about half gets into my inbox. Sometimes mail from other people I work with gets marked as spam. Basically this filter would do the same thing if it just threw about 1/3 or 1/2 of all the email I receive into the spam folder randomly.
.mac email address and use Mail in Tiger on MacOS X. The junk email filter does not have very many false positives, but it still lets a lot of spam into my inbox.
I also have an Apple
On one of my machines I am doing a trial with Spam Sieve. It is doing a better job, but has had misses and false positives, but it is better than either Apple's filter or the useless Exchange filter.
Avoid Missing Ball for High Score
I've about become convinced that the Viagra and other drug spam must be funded by the drug companies themselves. Not because they want us to buy the drugs from the spammers, but just because the constant barrage of email adds up to advertising impressions.
Obviously the emails I get for this crap are so badly done, nobody would actually expect me to buy from them. If I was actually trying to make money selling bogus drugs through spam, wouldn't I work harder to make it look legit? The phishing guys don't seem to have too much trouble making good looking e-mail - so why are the bogus drug emails so childish?
Because they don't exist. It's just advertising impressions. They've managed to get the word Viagra and Cialis in front of me a few more times a day, really cheaply.
Rather than send random garbage that, as others have said, bears no resemblance to the users' typical email, why not extract text from the domain's website? A large portion of spam goes to work addresses. Emails sent and received with these addresses often times contain the name of the company, major individuals, current products, industry jargon, etc. So google the second half of the address and insert blocks of text from the company website/related pages. It seems to me that such a method would be much more obvious and effective than using Project Gutenberg. Especially in the short term, the one which matters most in this case.
"Strangers have the best candy" -Me
"A fool and his money are soon parted."
What's the difference between some guy selling a tonic via SPAM and a tonic at the state fair? At the end of the day, not much, just that the spammer reaches more people.
Or the third possibility that spam is more like MLM: There is no money in spam, just in selling spam tools and spam lists to suckers who think they can make money off spamming people.
My client-side email app does filtering on the header only. It also applies a few tests to the sender name and email. (Reads each header off the server, checks it out, rates it spam, not spam, or unsure.)
I get phenomenal accuracy without looking at the body, and it's quicker too.
Hal Spacejock: Science Fiction with Nuts