Spam Doubles, Finding New Ways to Deliver Itself

An anonymous reader noted that the times is running a piece on the rise in spam that you might have noticed in your inbox over the last 6 months. Gates promised the end of spam by 2006, but they figure it's doubled in the last few months. And best of all, a huge percentage of spam is now images that circumvent traditional text analysis.

Comments

Bill Gates promised !

[Rastignac]

Gates promised the end of spam by 2006. He still has one month to succeed. It is still possible. I'm waiting. I really want to see that. Thanks, Bill.

Re:Bill Gates promised !

[eln]

You won't be saying that when Microsoft takes off and nukes the site from orbit in order to stop the spam.

After all, it's the only way to be sure.

Re:Bill Gates promised !

[Gospodin]

Actually, he said "two thousand six..... ty". The last syllable wasn't heard because of the applause.

Picture spam

[millwall]

The picture spam not caught by the gmail spam filters that I receive all look very very similar. Randomly generated sentences with buzz words and a "picture text" haussing a certain stock.

I'm very surprised these all come through the gmail spam filter. By now it should be easy to identify them.

Re:Picture spam

[anotherone]

A huge percentage of legitimate email is random sentences with buzz words and a picture.

Maybe it would be possible to OCR every image as it comes through but then you'll just have spammers sending you CAPTCHA'd messages.

Re:Picture spam

[choongiri]

"Maybe it would be possible to OCR every image as it comes through"

It is.

Re:Picture spam

[spectral]

They already are sending me CAPTCHA'd images.

It's the bottom line, stupid!

[Pig Hogger]

The crux of the problem is the penny-pinching network executives who prefer to run spam sewers where zombies thrive without any supervision.

Competent sysadmins are expensive, and the idea of, say blocking outbound port 25 would never occur to them, or is brushed-off for stupid reasons.

The only way out is to exerce pressure on those network owners and the best way to do so is by simply blocking them left and right until they are left with nothing but their huge intranets.

Re:It's the bottom line, stupid!

[David McBride]

My understanding is that botnets, mostly made up of weakly-secured home machines, are the source of the majority of spam. Thus the main problem is not network administrators not taking good care of their networks (which are usually quickly identified and isolated using blocklists), but rather the woefully insecure configuration of home desktop machines out-of-the-box.

And the blame for that can be squarely placed with Microsoft.

Re:It's the bottom line, stupid!

[A beautiful mind]

You're essentially correct. Greylisting results confirm what you say. The spam that goes through greylisting is miniscule compared to the amount it blocks, for now. The spam that gets through comes from hacked servers, open relays etc, which are much less common than a compromised windows pc.

The blame is mostly on MS. Partly in a different way than people think. MS advertises easy to use windows/computers, while that category is fiction. A computer is a complex tool. You can use it easily like you can use a chainsaw easily. The chainsaw eliminating a couple of your fingers is enough deterrent that most people learn to use it properly before that happens.

A computer is a chainsaw that cuts into someone's finger 2000km away in another country if not used correctly. The user stupidity only causes such big problems because the expectations are out of touch with reality. Computers are not easy to use and can't be made easy to use. Anyone who tells you so lies and sabotages the stability of the Internet.

What I'm talking about here is the "user stupidity" part of the problems. The Windows security side of the issue is another part of the problems. The "user stupidity" part is grave, because even if someone switches to Linux or BSD or something else than Windows, it is still easy to take over any system with a stupid user's cooperation. The answer is education and readjusting the common thinking about what computers are.

Re:It's the bottom line, stupid!

[cadeon]

Hmmn. I hate Microsoft just as much as the next guy, but I'd blame the end users in this case way before blaming Microsoft.

People need to take the time to know how to use the things they own.

Re:It's the bottom line, stupid!

[Dun Malg]

Instead we should be going after the money. It doesn't matter if the source of the SPAM is offshore or not. The products they are selling have some sort of presence in the US -- otherwise, why spam Americans?

The majority of my spam is pump-n'-dump penny stock scamming. There is no product. Just a "wow! this stock is going to take off and go up fifty points! Invest now!" message, and some daytrader jackass somewhere waiting for it to go up half a point so he can sell and make a couple thousand bucks.

Re:It's the bottom line, stupid!

[ummit]

So by your logic, we shouldn't need traffic lights, seat belts, air bags, insurance, or speed limits. If people took the time to learn how to drive more carefully, and stopped having stupid accidents, we wouldn't need these safety measures.

In any case, we've been blaming the "stupid users" for years now, and it hasn't helped. They're still clicking on those easy-to-click executable attachments...

Re:It's the bottom line, stupid!

[M-G]

And the problem is that it appears to work. For giggles, I've tracked a couple of these stocks. If you don't get too greedy, and get out before the spammers (presumably holders of large blocks of stock) dump, you can actually make a good return.

So if you, as a spam recipient, play along with their stock game, you can make money, while helping drive up the price for the spammers to make their profit.

As for buying spammed products, I've long held the opinion that no one need to buy any products for the spam to keep flowing. Much like the pump and dump schemes, I get the feeling that a lot of spam originates from people paying for 'internet marketing' services touted in various 'get rich on the internet' programs. So the actual money-making product is the 'service' that's being sold to those down the chain.

Re:It's the bottom line, stupid!

[kalpol]

This is a truth rarely pointed out in discussions of spam. I see many many comments along the lines of "if only losers would stop buying their product, spammers would go away..." No, as long as there is hope, some idiot will pay some spam gang to blow a load of email across the face of the net hoping that he'll get rich quick. There could be zero purchases, and the guy will just give up, but what do the spammers care? They have their money and there's always some new moron out there with a grand scheme.

Re:ban images?

[Anonymous Coward]

Good for you. Personally I'd rather just email one or two images to the inlaws instead of dicking around with a web based system.

Now, dropping emails that contain images as inline attachments might be a good idea. As would droping any and all emails with a Content-Type of text/html.

anti-spam tactics now anti-filter

[Bananatree3]

Interesting how things come to pass. Websites like this one and many others have used text-in-image capchas for a couple of years to avoid spam bots. Now, spam bots are using text in images to avoid filters. The spammers have caught up for now, but just wait another couple months/year and anti-spam technology will catch up

Re:ban images?

[Shakrai]

Yeah, cuz it's not enough that I can no longer relay e-mail directly from my machine. It's not enough that I now have to have reverse DNS otherwise my e-mail gets rejected. It's not enough that e-mails that aren't SPAM get dropped/flagged. It's not enough that many e-mail providers drop useful attachments and scan so intrusively into them that I need to encrypt them if I want the e-mail delivered.

Let's take away yet more functionality due to spam! That's a great idea. Seriously, I hate SPAM but the zeal to stop it has ruined many useful features of SMTP.

Re:ban images?

[Daniel Dvorkin]

Who's "they," and how exactly is this ban going to be enforced?

If I really want to share pictures I'll put them on a website or Flickr or something.

At which point, we might as well go back to taking pictures on film and sending copies through the mail. [rolls eyes] Practically all the picture-sharing services are an enormous PITA, and not everyone wants to put up every picture they want to show someone on their personal site.

For corporate servers, I agree, the idea of a no-image-attachments policy makes a lot of sense. For personal use, it's not going to happen, nor should it.

Spam 2.0

[choongiri]

"The new breed of spam -- call it Spam 2.0"

No, no, no... please, please don't!

Another problem

[Sv-Manowar]

Good to see them documenting the rise of email spamming, but I'm suprised the article doesn't talk more about the spammers who are running amock across websites rather than people's inboxes nowdays. While the problem of email spam is still growing, it has pretty much always been there and the public are fully aware of it (with mainstream services such as Gmail offering spam protection, etc), the huge rise at the moment is the amount of web applications and sites that are being exploited. Take for instance Youtube (with many of the most popular videos having their comment threads spammed hard), or any mainstream forum software (most commonly phpBB), where spam bots are continually developed to get around registration methods (including OCR) and then spam the forum with either their profiles or posts. Not forgetting the guestbook spamming which many of the people behind these use for SEO purposes, so they can get phising or product selling pages to the top of search engines (even if it is for a day or so before they are penalised/blacklisted).

While email spamming is still the main problem, it would be nice to see the mainstream media realise that there is a growing danger in people exploiting community websites nowdays, because all it takes is for one of these operations to install enough spyware/get traffic from sites/top search engines for banking/insurance etc websites, then they will start taking consumer's data faster than spam would - all without the majority of customers realising, because they think the main threat is in their inbox.

Different ways of thinking about the problem

[anotherone]

Do any large email services compare all email over the entire system to check for spam? If gmail receives 4,000,000 messages from the same IP in 5 minutes, each with the same image attached; you can be sure it's spam. That's still defeatable, though.

The only way I can think of to totally stop the problem is to make it unprofitable. Maybe Bill Gates could stop the problem by producing a high-profile ad campaign telling people to stop buying things from Spam.

A solid solution

[east coast]

We can hire the A-Team to come in and stop them.

I pity the fool who litters Mr T's inbox with ads for home equity loans.

Re:ban images?

[tomstdenis]

Why not use email for what it was meant for?

If clients weren't so friendly to "auto show" images this spam would never had existed.

I too send attachments to folks but usually only source files and/or patches (e.g. really small things).

I want my email client to read/write messages, not the "web". It's bad that HTML emails exist ...

Tom

Using Clamav against the images

[rutger21]

Since about two weeks I am using the image-spam repositories of MSRBL, and of Sanesecurity. Using a cron script to fetch the data and keep Clama's database up-to-date works quite well!

Re:Using Clamav against the images

[Giloo]

I thought about using such a repository for image spams, but the real problem here is to deal with the small differences between each image signature, and that's quite to hard to obtain only from MD5 signatures. When looking around the database FuzzyOCR can create, you won't see much more repetition, which clearly shows that using too "simple" hashes would just not be efficient. When I asked people working on FuzzyOCR they told me that they think a lot about how to find out if an image just looks like another without having to compare the complete file. There's a lot of work to be done for this though ... My idea is that we should start shooting spammers..

Fuzzy OCR

[Conception]

There is a plugin for Spamassassin called Fuzzy OCR. It's false positive rate is pretty low and I haven't seen image spam for weeks.

http://fuzzyocr.own-hero.net/wiki/Downloads

Re:Fuzzy OCR

[jannic]

I could just throw away every message containing an image, and the false positive rate would still be pretty low. And while doing that, throwing away every executable would be useful as well, to discard most of these stupid worms.

Re:Fuzzy OCR

[statusbar]

I get so much spam that if I just deleted all my email, my false positive vs number of emails 'rate' would be pretty low too.

One viable alternative

[A beautiful mind]

Greylisting. All MTAs should be RFC compliant, so this one hurts the broken MTA's only, but some find the delay this adds to the normal mailing process unworkable.

Fortunately you can whitelist known good servers and even use an AWL.

According to some university administrators I've talked to where it is deployed, 93.6% of all mail is blocked this way. The network is around 20k computers strong. No big mail losses reported.

Re:One viable alternative

[E-Lad]

Two weeks ago we implemented 3-factor greylisting here at the university I work at. We went from delivering 700,000 emails per day to 200,000 after turning it on, which works out to about 10 messages per day, per email box on average... certainly a more realistic number. The response from the users has been great (some even thought that our email system was broken at first because they stopped getting so much noise in their inbox/spam folder, the change was that dramatic).

Naturally, the work-around for spammers is to resend their spams, but they would have to do it from the same IP and with the same envelope from and to address. This means that their army of zombie'd PCs would have to work twice as hard if everyone greylisting was common practice, and likely a require a non-trivial change to the software on these zombies. We'll have to see how it pans out, but after watching my greylist logs and inspecting the spams which do get through, it seems that perhaps a few spammers have already caught on to this, but not all. Most of the spams which do get through our greylisting are subsequently caught by Spamassassin and RBLs, and come from open-relays (those still exist!)

Re:One viable alternative

[david.given]

I wrote my own greylister (<plug>Spey</plug>) and it works really well. (I will also point out that people who complain about it making email too slow have a major education problem --- email doesn't guarantee anything about delivery times. If they rely on the email being delivered within a certain amount of time, then they'll be screwed when that doesn't happen for completely legitimate reasons. But anyway.)

So far I've only had one false positive: Yahoo Groups. They have this brain-damaged system which probes to see if an email address is valid when you subscribe to a mailing list. Unfortunately, the probe mechanism, which is a bad idea at the best of times, is broken and doesn't retry after getting a 451 Try Again Later. This violates the RFC, of course. I've tried to complain, and find myself unable to contact an actual human. Whitelisting *@returns.groups.yahoo.com fixes this.

Outlook 2003 blocks all of the image-spam I get

[SpecialAgentXXX]

I have had no problems at all using Outlook 2003 with Junk E-mail settings set to high. I have not seen 1 image-spam. However, when I fire up Thunderbird, the image-spam always shows up. I wonder what settings/algorithm MS is using because it works. My corporate E-mail server also blocks all spam. I have not received 1 spam of any type in my office E-mail account.

So is the problem really an increase in spam or incompetent admins who don't know how to setup their filters to block them? Yes, the size & volume of E-mails may have increased, but if you can filter them they will be deleted before they take up space.

Re:Outlook 2003 blocks all of the image-spam I get

[muckdog]

Do you realize how many valid emails are likely getting caught by your filters? Just because you're not seeing any spam doesn't mean your spam filters are doing what they are supposed to do.

You don't use authentication?

[khasim]

We have people who work from home. But I've set them up with email authentication. They can send anything, from anywhere, to anyone, providing that they have signed on with their username and password.

You do it differently?

The "spam problem" *IS* largely solved.

[wayne]

I know people like to rant about the "spam problem" a lot, but for all practical purposes, the problem has been largely solved for several years now.

If you run reasonable spam filters, including many open source ones, you will not end up with much spam in your inbox. Yeah, there will be lots of spam still being sent, but the real, significant, cost of spam is really mostly people's time, not machines. Any ISP, company or person who gets "too much spam" is simply being penny wise and pound foolish. The same goes for systems that get too may "false positives", that is, legitimate emails being rejected. Almost all of that is due to trying to run "cheap" spam filters, or buying snake-oil systems. Upgrade your mail servers or switch to someone who runs reasonable spam filters.

The "spam problem" of today is really the "you can't do anything about spam" problem. Too many people are convinced that you can't stop spam, so you shouldn't try harder. The problem is low expectations. The problem is people cutting corners.

For email senders having problems getting caught in spam filters, some of this is due to people running bogus spam filters and that is the receiver's problem more than yours. Most of the rest is due to either you not running a standard-compliant mail server on a static IP address that can have a reputation built up for you being a good server, or because you really do send out spam, either due to "bad" customers or backscatter (bogus bounces, challenge/repsonse systems, autoresponders, etc.). Don't be cheap and think you can get away with not running spam filters on your outbound email and catching your "bad" customers. Don't be cheap and spew backscatter. Don't be cheap and say you can't afford to do port 25 blocking of dynamic IP addresses, or not allow customers to configure their reverse DNS.

The vast majority of knowledgable people in the area of spam do not munge their email addresses. The vast majority do not suffer either lots of spam in their inbox nor lots of false positives.

Re:ban images?

[Shakrai]

HTML in e-mail was never standard functionality anyway. E-mail is a text medium, which has grown in some ways without growing the infrastructure to go with it.

HTML e-mails annoy the hell out of me, mainly because for a long time I was quite content to use older e-mail clients that didn't support them. But that's not what I was lamenting.

I was lamenting how anti-spam measures have made e-mail less and less useful. It was drowned out by the righteous replies of "I'll do whatever I want with my mail server". You can do whatever you want with your own server. But I'm allowed to lament the fact that e-mail has become less and less useful.

It seems to me that there is no technological solution to this problem as long as it remains profitable to SPAM. Any technological solution is short lived (i.e: arms race) and will have at least some negative effect. Can't we take away the financial motivation to SPAM? Go after the companies whose products are being sold? The spammer may or may not be offshore or may or may not be using zombies but if that spam message is to be successful then it has to point me at a product. Go after that product!

That's probably naive of me and smarter people then I have attempted to solve this problem. Still, I miss the days when I could just put up an e-mail server and all it had to do was deliver messages to my users. It wasn't the servers job to care about what was in the message -- it was the clients.

Re:Image spam?

[Brandon Hume]

The problem is mainly that the spammers have an absolutely IMMENSE amount of stolen processing power available to them. Botnets with hundreds of thousands of hosts, and many of those PCs have just as much, if not multiple times more processing power than any common server in your rack. Your mail server is built for reliability and I/O, and has a much longer life cycle than a desktop.

It's nothing for the spammers to analyze a captcha, even if they want to. But for every obfuscated image they send to you, you've got much fewer resources to try and analyze it. Even if you build a monster mail transport (muchos dinaros) they'll just bot a few more idiot machines and overwhelm you.

In fact, that's apparently a new tactic some of the more scummy spammers have been taking. If your filtering/tarpitting is TOO good, they'll just unleash the whole botnet onto you and crash your mail servers until such time as you see that it's better to take their crap than try to fight them. I've seen admins complaining about it on NANAE.

It seems outrageous to say this in relation to something as "unimportant" as email... but I really, truly wish we'd start seeing some fatalities amongst the spammer set.

Re:ban images?

[aaronl]

Unfortunately, if you go after the product the spam offers, then it turns into a vehicle to damage a third party. Now when someone doesn't like a company/product, they will pay to have a few millions spam messages sent out, and destroy their competition. Or they will threaten to do the same if said company doesn't pay a large amount of money.

This happens today with email viruses and botnet attacks, and don't think that it wouldn't happen if you attacked products advertised in spam.

Re:Spam is a non-issue for those in the know.

[Overzeetop]

having separate public and limited-distribution email addresses helps, too

I beg to differ. My limited distribution email scheme has been completely foiled by email list selling (by companies I deal with, including pseudo-government departments) and by worms which have harvested emails in the past. Heck, it only takes a single one of my "trusted" contacts (close friends, family) to decide to forward a message to a group with the list recipients viewable and then any of those people who get a virus will let that email into the wild.

I'm tempted to can the whole partitioning of emails altogether and go back to a single email. The system used to work before there were spam filters, and when I could trust the party on the other end. Since both of those are now false, I may as well just simplify.

Re:ban images?

[Daniel Dvorkin]

Huh, so everyone who wants to send pictures through e-mail is either an "ignorant fuck," a high-school kid, or a "tool?" Ooookay. I'm not sure there's much point in continuing this discussion, but I'll give it another shot.

* The executable ban: another PITA, and one that's occasionally caused me real problems. Is it a good idea generally? Sure, but that's the problem with blanket policies that seem like "generally a good idea" -- when they fail, they fail badly.

* The "no images" option: this is a great idea. Would enough people turn it on to make it useful in stopping the flow of spam? Not a chance. And I guarantee you that any ISP which instituted a blanket ban on images would find itself bleeding customers they way people bleed from a severed artery.

* "Frankly if you can't figure out how ..." etc.: Can I figure out how to use Flickr et al.? Sure. Do I want to? No, because their interface sucks. I made my living designing database-driven web applications for seven years, and I can honestly say that by the time I left my last job to return to grad school, I and a team of three other people (count 'em: three) had created a web app that subsumed all the functionality of nearly every DB-driven site I've ever seen (er, with the exception of Google) and looked a hell of a lot better doing it. Making a site for the express purpose of allowing users to post pictures is easy, or at least it ought to be. There is no excuse for the shittiness of sites made for this purpose, or for other single-purpose apps. And there is no reason why I should put myself through the pain of dealing with that shittiness just to send someone a picture of my dog, ferchrissakes.

Destroying functionality is not the answer to the spam problem (or almost any problem, really.) People want the functionality -- that's why it's there in the first place. What we need to do is come up with solutions that work in the existing framework, or they aren't solutions at all.

Re:ban images?

[Eagleartoo]

Or you could just zip/rar/tar/lha your files and attach to the email.

Man you sound like a Karate Movie! =)

Wrong.

[aussersterne]

It's not up to the recipient, it's up to the recipient's service provider; most recipients have no idea what is or isn't happening to their email before they get it.

And we have lost a tremendous amount of functionality due to SPAM. There was a time not so long ago when I could send to a family member: email with an attached photo, email with an attached document, email sent from my own PC and handled with my own SMTP daemon, email that was only two or three lines long, etc.

Now all of these are likely to be rejected. Even plain text email sent with a large subscription SMTP server is now getting blocked by some friends and family members' service providers simply because the domain of the address (my personal web domain) is not whitelisted and this hits the SPAM score where it hurts. A phone call is great... unless you were hoping to do one of the many useful things you used to be able to accomplish by sending attachments (i.e. send an article you're working on to a friend to have them read it and mark it up with revisions before sending it back).

So I suppose your answer is that we should all get an @gmail.com account, have to use it via the Web interface to send plain-text only email with zero attachments that's at least five but no more than twenty sentences long and doesn't use the words "sex," "free," or "mortgage."

Fine, but don't pretend that email hasn't lost a significant amount of functionality due to SPAM or that these restrictions are being imposed democratically by the consensus of common users. Functionality has indeed been lost and the decisions are made by admins at major email providers trying to save costs and manage the tremendous problem that SPAM has become.

The proper solution isn't to filter more. The proper solution is the death penalty for SPAMmers. I'm quite serious. We execute far too many blue collar criminals in this world and not nearly enough white collar ones. SPAMmers should be first among these.

Re:Wrong.

[A beautiful mind]

You're advocating a

() technical (x) legislative ( ) market-based ( ) vigilante

approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)

( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
( ) Users of email will not put up with it
( ) Microsoft will not put up with it
(x) The police will not put up with it
( ) Requires too much cooperation from spammers
( ) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
(x) Anyone could anonymously destroy anyone else's life or business

Specifically, your plan fails to account for

(x) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
(x) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
(x) Asshats
(x) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
( ) Armies of worm riddled broadband-connected Windows boxes
(x) Eternal arms race involved in all filtering approaches
( ) Extreme profitability of spam
(x) Joe jobs and/or identity theft
( ) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
(x) Extreme stupidity on the part of people who do business with Microsoft
( ) Extreme stupidity on the part of people who do business with Yahoo
( ) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook

and the following philosophical objections may also apply:

(x) Ideas similar to yours are easy to come up with, yet none have ever been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
( ) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
(x) Killing them that way is not slow and painful enough

Furthermore, this is what I think about you:

(x) Sorry dude, but I don't think it would work.
( ) This is a stupid idea, and you're a stupid guy for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your house down!

Re:Wrong.

[ultranova]

The "proper" solution would be to find the jackass repsonsible for all this shit and beat him with in a inch of his fucking life.

One down, 124 to go.

Not that I'd ever advocate anyone doing anything illegal, of course. But I just can't seem to be able to shed any tears for Mr. Kashnir. I doubt many are.

Re:Wrong.

[TheRaven64]

Well, I am against the death penalty in general, but it's an interesting question. Assume the average person lives for 70 years. 70 years is 2,208,984,820 seconds. Now, assume you kill someone aged 30, you are taking away 40 years, or 1,262,277,040 of their life. If a single spam takes 1 second to delete, and a spammer sends out one billion of them, they have done as much damage as killing someone aged 30 - they've just spread it around more. Are the two morally equivalent? Well, that depends on your personal ethical system; there's no objective answer.

Re:Wrong.

[A beautiful mind]

I think this is the second time I posted the spam form, but just for you:

(x) Nice try, assh0le! I'm going to find out where you live and burn your house down!

Incidentally I've found a post detailing the origins of the form if anyone's interested.

Re:Wrong.

[fredklein]

I have a simple, foolproof idea to help eliminate spam.

Email certification.

If you want to be able to send Certified Email (CE), you apply for Certification from the company that gives you internet connectivity. They check you out, and 'Certify' you as being a legitimate emailer (ie: not a spammer). Then, you generate a private/public key pair and give them the public one. In the headers of all your email, is their certification, and an encrypted header line that's createdusing your private key.

When email arrives at the recipients server (or this could be done at the client level, as well), the server sees the certification, and connects to the certifying server to get your public key. It attempts to decrypt the header line. If it does it marks the email as 'certified', if it cannot, it marks the email as 'uncertified', and the email client can be programmed to filter messages based on that.

Due to the public/private key cryptography, there can be no certified email spoofing. (Assuming the private keys are secure, the keys are of decent length, etc.) All emails are traceable back to the originating server. CORRECTION- all CERTIFIED emails are traceable. Anonymous email is still possible. People can still set up email servers for mailing lists without "having" to get them certified. And people can still receive non-certified mail.

If an email server sends out spam, the complaints go to it's certifier. They can drop the certification, deleting the public key from their server. When this happens, ALL the email from the spamming server is now 'uncertified', and gets handled accordingly by email clients. If nothing is done, complaints go to THEIR upstream, etc. Individuals and groups can keep their own blacklists, if they wish, and anyone can choose to filter emails according to those lists.

Now, I've looked over that 'form email' that people like to post to shoot down anti-spam ideas. And nothing applies to this idea. (If something seems to apply, it's because I either left out details, or explained something wrong.) This idea does NOT need to be universally adopted, nor does it need to be adopted by everyone all at once. It's primarily a way of reliably tracing (certified) emails back to their originating server. The anti-spam part comes later: if you receive certified spam, complain and get the server un-certified. If you receive un-certified spam... well, just have your email client dump all uncertified emails in the trash. (Not nessisarilly, you could just use it's un-certifedness as a factor in filtering your email.)

This idea does not require anything be changed with SMTP. It simply requires a second connection be made to the certifying server. Now, before you bitch about the extra bandwidth, I'd like to remind you that, once this idea catches on, spam will be greatly reduced. This reduction will MORE than make up for the slight increase in bandwidth created in querying the certifying servers. Also, the certifying servers can set time limits on when the certifications expire, and need to be re-downloaded (kind of like DHCP leases). A 'new' company that just applied for certification might have it's certificate set to expire almost instantly. This way, every email they send requires a download of the certificate. This allows the certificate to be pulled rapidly if they start spamming. After a month or two, it could be set to expire weekly or monthly.

To sum up: Email Certification is reliable way of tracing the certified emails back to their originating server. This allows spammers to be identified unequivocally, and have their certification pulled. Email servers are NOT required to be certified, and anonymous email is still possible. Email recipients can, if they choose, set up their client to send uncertified emails to the trash, or to handle them however they wish. White lists and black lists are still possible. 'Hobby mailing lists' are still possible, certified or not. The extra bandwidth is minimal, and easily overshadowed by the reduction in spam being sen

Re:ban images?

[mgblst]

Agreed, I tried to send a cdrom driver to a friend today, and gmail told me that I couldn't. Thanks a lot spam. Even though the file was zipped up.

WE INVITE YOU TO COME SEE THE 2020

[Serious Callers Only]

If everyone turned off images, html and anything else, we'd get text only spam instead.

The real problem is authentication in email. While mail servers accept email with any arbitrary 'from' address, this problem will persist.

Re:WE INVITE YOU TO COME SEE THE 2020

[Sancho]

But we can easily deal with text-only spam. The problem is that filters don't know how to read the image to detect whether or not it is spam.

Re:WE INVITE YOU TO COME SEE THE 2020

[Shazow]

ASCII art to the rescue.

Re:WE INVITE YOU TO COME SEE THE 2020

[MBGMorden]

They did for a while. I use a filter (Spamassassin, Postfix, and Amavisd-new based) in front of my main mail server, and a plugin called "FuzzyOCR" uses several open source OCR techniques and could stop a lot of the image spam for a while.

Of course now that the spammers know this, they're moving around the letters, putting in noise, and throwing various geometric shapes into the background to confuse the OCR.

The bad thing is, at this point the only thing they're able to use it for is trying to pump up a stock. Any links and we'd kill it dead really quick. It boggles my mind that people could possibly take a "stock tip" from a picture of jumbled up, scrambled words with all sorts of triangles and circles in the background.

Re:WE INVITE YOU TO COME SEE THE 2020

[fosterNutrition]

It boggles my mind that people could possibly take a "stock tip" from a picture of jumbled up, scrambled words with all sorts of triangles and circles in the background. The fact is that most people don't. The real reason these things are so popular is that everyone knows it's a scam. People then feel like they're "in the know," and hence that they can beat the scammer. The idea is that if you know it's a scam, you can buy stock and then dump it before the scammer does.

This never works, simply because the scammer has such an enormous volume of the stock pre-purchased that they can easily undercut your selling price on the market while still making a profit, and hence their stocks will always be dumped before yours are. Of course, in theory, if you have an even larger volume, and can undercut them, you could profit. That would, however, technically mean you are now the pump and dump scammer, even if they do all the work for you.

Who is responding to spam?

[geoffrobinson]

I want to see an article which tracks down the people who respond to spam and make this thing profitable. I'm sure it will take some investigative talent to find people willing to admit their behavior, but that would be interesting.

Re:ban images?

[Fozzyuw]

I want my email client to read/write messages, not the "web". It's bad that HTML emails exist ...

No joke. HTML in email is a lesson in frustration when trying to design an E-Newsletter or some such marketing thing. Though, once you get your feet dirty, you start to know what you can and cannot do easily.

However, I do appreciate HTML emails and they have good uses. It's cost-effective and a great way to deliver attractive marketing messages to customers. Of course, that's when I (or one of my companies customers) ask for that email. Spam sucks. But we don't want to screw over all the people who use it for good purposes. As it is, my Gmail account seems to be handling spam pretty well.

Cheers,
Fozzy

Re:ban images?

[Ryan Amos]

Actually many scanners will not deliver encrypted attachments for this reason. It's a setting you can change in MailScanner, but it's defaulted to block them.

Just do what I did (only better, I hope...)

[mmell]

(1) Get an ISP that isn't currently doing "traffic shaping" (you hear me, Charter Communications? Qwest gave me what you couldn't - a "not shaped" connection to the internet).

(2) Run *NIX on (at least) one machine in your LAN. (3) Run Sendmail on that machine (or postfix, or whatever MTA you like).

(4) Listen to your wife and kids complain that their family/friends aren't getting e-mails from them.

(5) Correct the configuration on your MTA (oops - mea culpa).

(6) Listen to your wife and kids complain that they're not getting e-mails from their family/friends.

(7) Correct the configuration of your MTA (again).

(8) Listen to your wife and kids complain that they're still getting spammed into oblivion.

(9) Configure mail filters to hold the spam.

(10) Listen to your wife and kids complain that they're missing valid e-mails.

(11) (Repeat steps (8)-(10) recursively until (8) and (10) no longer happen.)

(12) ???

(13) Profit!^H^H^H^H^H^H^HRelax!

Just send using your ISP

[vdboor]

Yeah, cuz it's not enough that I can no longer relay e-mail directly from my machine..

Everybody delivers e-mail messages through the SMTP server of their ISP. What is wrong with that?

Network administrators get thousands of connections from infected machines. They drop those connections, except the connection from the official SMTP server of that IP-block. If someone can't put aside their blind determination to ignore the SMTP of their ISP, or lack a damn good reason to send email directly, their deserve to get rejected by recipients. Politely sending a reject message back would double the bandwidth wasted on spam, nobody is waiting for that either.

"Normalization of deviance"

[Beryllium Sphere(tm)]

We're all frogs being boiled alive because we kept getting used to the temperature as it went up.

When and why did we accept needing elaborate programs to throw away our email before we looked at it? When and why did we accept not being able to send files in email, after spending years defining and implementing MIME?

There have been cities that got so accustomed to street crime that people starting blaming the people who got attacked instead of the criminal. When and why did we get to the point that someone could tell a normal (and savvy) user of email
>You don't have to be a complete fucking tool you're entire life you know.
?

Not that I have a solution, I'd be out getting rich if I did.

Graylisting + Honeypot DB = goodbye spam

[RonBurk]

I always feel a little guilty when I read people's spam problems. Graylisting plus a database of honeypot addresses (addresses fed to spammers that no human could have ever seen, a la the CBL) sure let me quit fussing with spam.

No filters (text or otherwise), no false positives, hundreds of spam messages arrive at my server every day, and approximately 1 a day gets through. I can live with that. Sometimes, a legitimate email will get delayed by several hours. Since I often don't check my email for hours at a time, I can live with that too.

I'm sure there must be some problem that keeps this solution from being widely deployed. But if you're geeky enough to run your own mail server, give it a try. It sure beats fussing with all those filters and crap.

Has there been an increase in spam? Huh. I didn't notice.

Re:ban images?

[TheRaven64]

Compromise, and whitelist. Anyone can send you plain text emails, but only people you have emailed can send you emails that are anything other than plain text. Since spam filters do pretty well on plain text emails, this should cut down the incoming spam a lot. If someone wants to send you an email containing an attachment and you haven't emailed them before, then all they need to do is first send one saying 'Hi, I want to send you some pictures, is that okay?' If you reply, then the mail server lets them through the next time.

Re:ban images?

[geekoid]

" It wasn't the servers job to care about what was in the message -- it was the clients."

And it still should be.

As you point out, the admins have not solved this problem. Mostly because most solutions go after a specific 'attack' and not the problem.

AS I see it, the best way to help this problem is personal whitelist autogenerated be demanding a one time responce from the sender. No response in 30 days(or whatever) it gets trashed.

Once an email address has been authorized, then it's golden. If it is authorized, but not used in 90 (whatever) days, it gets deauthorized.

Content no longer matters, on a valid emails.

If they have a domain that they keep to be avle to respond, then you can find out who is sending and get their ISP to deal with them.

Also, telcoms need to stop selling large pieces of bandwidth to bulk senders.

Re:ban images?

[TheRaven64]

You could always try sending spams for free penis pills, and sending cyanide capsules to everyone who responds...

Timing VERY Crucial In Pump n Dump

[cmholm]

And the problem is that it appears to work. For giggles, I've tracked a couple of these stocks. If you don't get too greedy, and get out before the spammers (presumably holders of large blocks of stock) dump, you can actually make a good return.

You should revisit your data, and reread the article. The "problem" is that the scammers buy the stock pre-scam, and dump immediately at the first sign of a price blip. When I plug whichever penny stock into Yahoo, the price spike has always been a day or two in the past by the time my server receives (nevermind by the time I read) the spam touting it, and hasn't lasted more than a few hours.

So if you, as a spam recipient, play along with their stock game, you can make money, while helping drive up the price for the spammers to make their profit.

No you can't, unless you are "lucky" enough to be among the first recipients of the spam, and act upon it immediately. Depending on the number of shares outstanding, it may well be your buy of maybe $500 to $1000 that triggers the scammer's sell order. Face it, this is a total non-starter. Research already suggests that the scammers are only netting about 5%, which means they're doing about as well as a successful day trader, with only a little less effort. Since you will be in a reactive mode, you will be putting in more effort with significantly greater risk.

Missing option.

[sbaker]

Your form is missing an answer to the one I came up
with a while back. It's a hybrid legislation and
vigilante approach in which the law legalises one
very specific form of vigilanteism:

Here is my law:

    Make it not illegal to send hot cheques or
    bogus credit card numbers to spammers.

This permits a kind of reverse spam. We know that when
some item is offered for sale via spam, only a very tiny
percentage of people respond to buy the stuff. If outraged
recipients were allowed to send bad cheques and incorrect
credit card numbers to these bozos, they would fall victim
to the exact same set of problems that we suffer...that
of separating good money from reverse-spam that we would send
to them.

Just as it doesn't take many respondants out of the millions
they spam to make a profit, it doesn't take many of the
millions of victims to send a bad cheque or a bogus credit
card number back to the spammer to mean that they have to
chase down hundreds of bogus payments just in order to collect
a handful of actual payments.

They could try increasingly sophisticated ways to 'filter'
our reverse spam - but we'd find ever cleverer ways around
that.

Well - it probably wouldn't work - there is bound to be a
flaw - but it brings a smile to my face to imagine the
spammer sitting with a million dollars worth of orders
made up of 20,000 cheques for $50 each - knowing full well
that only five of them are real and that the only way to
tell the difference it to attempt to cash each one of them.
He's made several hundred bucks from the idiot buyers - but
in order to cash their cheques he's got to pay in 19,995 bad
cheques - and because of my law, he's got no legal recourse.
If he fails to cash the handful of legitimate cheques, he
upsets his 'real' customers who bought something that didn't
ever arrive...yeah, their cheques didn't get cashed - but
they'll probably think twice about ordering stuff that was
promoted via Spam the next time.

Banks and credit card companies seeing the cost of
bouncing very large numbers of cheques and credit card
numbers would pretty soon impose a hefty surcharge onto
their banking fees for doing this - and voila! No more
direct sales spam!

Actually, I wonder whether it's even necessary to have
the law. Merely having a few tens of thousands of people
ask questions about the product - sending empty envelopes
that need to be opened, slashdotting their web servers, etc.

Anyway - feel free to shoot this idea down in flames too.

Re:ban images?

[nametaken]

This is going to sound awful, but I've almost stopped trying to come up with solutions. I've implemented some that others have tried and like, but I don't go out of my way. Nothing works well without serious compromises.

Honestly, I'm glad spam has doubled in the last six months. I say pile it on... but not because I'm some sort of masochist. It became clear to me a long time ago that the current technology for sending email just don't cut it anymore, and we need to move to something new. Anything new is going to be painful, and it has to be ubiquitous. The only way to get people to make a huge shift like that is to make it the obvious decision.

So, if spam levels are so bad that email isn't even useful anymore, people would consider switching. Now we need some smart people to come to a sweeping consensus on what we should move to so we can all hop on board. :)