Spam Volume Jumps 35% In November

gregleimbeck writes "Spam volume soared another 35% in November, an e-mail security vendor said Thursday, and the month saw spam tactics that reduced the efficiency of traditional anti-spam filters. 'There's been a huge increase in spam volume,' says David Mayer, a product manager at IronPort Systems, 'from 31 billion spams a day on average in October 2005 to 63 billion in October 2006. But in November, we saw two surges that averaged 85 billion messages a day, one from Nov. 13 to 22, the other from Nov. 26 to 28.'"

Comments

I'd say more than 35%

[twiggy]

Maybe it's just me, but my spam volume seems to have jumped at least 200% in recent months.

Are we finally going to reach a point where only trusted addresses can email us? Seems the arms race is being severely lost. I've got a pretty good spamassassin config and I can't keep up anymore, I find myself having to manually delete literally hundreds of messages a day now.

Re:I'd say more than 35%

[sam_paris]

i'd say try a different webmail provider. I get a LOT of spam per day, (about 100+) and 99.9% is categorised at spam by gmail. In the last month i would estimate i've had 2 spam messages hit my actual inbox. The rest were filtered out by gmail.

Re:I'd say more than 35%

[mcrbids]

I'm using greylisting and a number of RBLs, including DUN and SpamHaus.

I see perhaps a dozen or so spams/day despite my email address being plastered all over the Intarweb for the last 6 years. (I've made no effort to hide it)

This combination stops a ridiculous percentage of all inbound email.

Re:I'd say more than 35%

[tacocat]

Even that can be spoofed. And people will complain that they can't engage the customers and that's hurting the economy.

There was a guy who proposed something called RSS-mail a few years back. It was the same guy who came up with SPF I think.

Anyways the idea was that I would send you a notification that there was an email waiting for you to pick up on my server. Similar to how RSS passes data. If I was interested in reading that message I could call upon your server to deliver the email to me and then I could read it.

The key is that now the sender has to own the email. He can't just shoot off 20 million random messages. He now has to store all of them on his server for some period of time so that you can pick them up. Cheap for you, expensive for him. It also means that he has to be honest about his RSS feed otherwise you'll never be able to pick up the email and read it. This also makes it easier to track them down.

Personally, I think spammers won't go away easily. They make a lot of money off pathetic fucktards who think they can get a bigger dick with a pill. The real damage is done by the people who purchase via spam making spam a viable marketing tool.

Re:I'd say more than 35%

[epiphani]

You're missing the point - the spam rate is BEFORE filtering, not after.

I got around 100 per day back a few years ago. When i started forwarding to gmail, I average a spam folder of 4000 (it deletes spam after 30 days).

In the past two months, its gone from between 5000 and 6000 to over 15,000. I would agree, hella higher than 35% though. At my place of employment, we have a million mailboxes. We started running into a lot more problems with spam than usual about 6 weeks ago as well.

Re:I'd say more than 35%

[jrumney]

No, its not just you.

I've always preferred to run my own spam filters, I trust myself not to filter out a genuine email by mistake more than I trust my ISP, but last week the spam level got to the point where I'd go away for a couple of hours and there would be 200 new spams in my Junk folder, so I enabled the filter in my ISP's mail settings to try to get some bandwidth back. But as this article said, the latest batch seems to be evading conventional filters, so I'm still buried and thinking along whitelist lines myself (I had a whitelist system years ago, but one day found I had missed several important emails because of it).

Re:I'd say more than 35%

[Achromatic1978]

Not that it changes your point - but I would hazard a guess at you being a webmail provider, given that the only company to exceed a million employees (well, and make it onto the Largest Companies By Revenue list on WP) is Walmart - and I'd make a guess that all those shopfloor associates don't have their own @walmart.com address...

Re:I'd say more than 35%

[CodeBuster]

I have noticed this as well and so have my friends and family. In fact, the number of daily spams caught and trashed by my Spam Bayes filter has nearly tripled in the last six months. The probable cause of this increase is a recent surge in the number of zombies now controlled by spam trojans in the bot networks. This was covered here on Slashdot last month in Bot Nets Behind Recent Spam Surge. As for the trusted email addresses, some of us are already doing this with whitelists, but as you say the good guys are losing right now. The one good thing, if you can call it that, that might come out of this whole scenario is that the spammers speed the coming of the day when classic e-mail is retired from general use and something better is put in its place. The greed of the spammers may ultimately prove to be their undoing as they collectively kill the goose that laid the golden eggs.

Re:I'd say more than 35%

[complete loony]

You could still spam millions of emails with a scheme like this. Since the email "stored on the server" could be generated at run time, or just serve a single copy to millions of people. With such a horde of zombie machines out there, even the approach of "storing" emails on a server will not help.

Re:I'd say more than 35%

[hamfactorial]

I blame the post-Thanksgiving holiday bloat for this sudden increase in spam, turkey and mashed potatoes volume.

Re:I'd say more than 35%

[dgatwood]

That's definitely one approach. Unfortunately, it means that my mail would then be at the mercy of a thousand servers' bandwidth, and that reading my mail would take a lot longer on the average as a result.

What we really need is E2EASMTP: End-to-end Authenticated SMTP. The design is basically just the existing SMTP. The only changes are as follows:

1. All mail servers require an SSL key. This is assigned by the registrar when you purchase a domain. This key may be shared among multiple hosts within the same domain.
2. All mail servers must require SMTP-Auth for outbound traffic.
3. All mail servers must sign each piece of mail as it passes through their systems. This signature must sign the complete message, including the signatures of previous servers in the path.
4. All mail servers must support an automated abuse handling mailbox, autoabuse@domain for responses to spam messages.
5. All mail servers must forward automated abuse messages appropriately by verifying its own email signature (sending an abuse bounce-back if it does not match) and then forwarding the abuse report to the mail server that send the message to it in the first place.
6. Upon receipt of a certain number (determined as a site policy) of reports of spam or other junk emails from a given user, the mail server should automatically email that user to notify him/her that his computer is compromised and block any and all emails from that user until it is reset.
7. All ISPs should take reasonable care not to reinstate mail sending privileges until they are sure that the user's computer is clean.
8. ISPs are encouraged to manually look at any blocked accounts as soon as they become blocked to make sure that the messages really are spam/phishing.

The key is that the entire abuse reporting process should be automated and that no email messages without an initial host signature should be delivered. This will make it impossible for continued operation of spam zombies in two ways:

1. It will prevent them from sending mail directly by running an SMTP server on the compromised computer.
2. It will prevent them from continuing to send mail through an ISP's mail server by ensuring that the mail messages can be traced back to a single individual user of the originating ISP, where the messages will be automatically blocked in a timely fashion.

In effect, by ensuring a trusted (albeit not necessarily encrypted) path for all email messages, you make spamming orders of magnitude harder with minimal performance impact. Best of all, I think that this could be implemented with relatively minor additions to the SMTP protocol and phased in over a period of time, ensuring a smooth transition from the spam nightmare we have now to a more modern, usable email infrastructure.

Re:I'd say more than 35%

[From A Far Away Land]

I'd be most interested to know if spammers' revenues are going up accordingly. Perhaps their market has been tapped by their previous efforts, and there are no more stupid people to reach.

Yeah, wishful thinking I know... I'll go to my corner now.

Re:I'd say more than 35%

[IronChef]

Are we finally going to reach a point where only trusted addresses can email us?

I've seen spam more than double recently. I'm starting to think about a whitelist, but there needs to be an easy way to give your email address to new people without having to change a config file. Maybe a magic word in the subject, or something like that... It seems like this problem must have been solved by now.

Re:I'd say more than 35%

[networkBoy]

I wonder how much it would cost to outsource to India or (the irony, Nigeria) for a human spam filter. Nothing beats the human brain at pattern recognicion...

Cause you know if it only cost me 5 bucks a day to have someone else scan my spam folder for false positives it may just be worth it.
-nB

Re:I'd say more than 35%

[YGingras]

Kick spamassassin, rules based filters are not what you need to keep-up. Install greylistd and spamoracle. No more than 0.5% of the spam hits my inbox. Spamoracle will detect anything that isn't an image. Greylistd for some reason kill 99% of the images. Yeah spamers are lame and they could get around this setup but for now you have a pretty good solution that will take 30 mins to setup.

Re:I'd say more than 35%

[tsotha]

As others have pointed out, this just means the mail gets generated when you go to read it.

Better, I think, is when you send a mail the server on the other end gives your computer a little mathematical task to accomplish, taking maybe five seconds of CPU time. That way a spammer can only send out 12 mails per minute by tying up 100% of his CPU. A side benefit would be zombies nets would impact the computer owners so much thay'd have to deal with the problem.

Only companies with gobs of money sunk into hardware would be able to spam you, and that would change the economics to the point that it wouldn't be worth it to spam people unless you had a truly spectacular response rate.

I suppose if Pfizer gave out Viagra for free it would help a lot too...

Re:I'd say more than 35%

[antic]

Have responded to this idea before.

Say you're a web developer and outsource your filtering to a human in India. What's stopping them from taking an incoming job lead, accidentally forwarding it to a local web shop paying them for referrals, and pleading ignorance if you question a missing message?

Re:I'd say more than 35%

[Bogtha]

There was a guy who proposed something called RSS-mail a few years back. It was the same guy who came up with SPF I think.

Quite possibly you are thinking of Dan Bernstein, the guy behind QMail, and his Internet Mail 2000.

He now has to store all of them on his server for some period of time so that you can pick them up.

Actually, no, all he has to do is implement a server that emits the same message every time somebody asks for one. You don't have to store a million emails to send a million emails, you just have to store one.

Re:I'd say more than 35%

[daeg]

Combined with an idea like Hashcash (although not a direct copy), you could send a computationally-intensive hash of the message body combined with the recipient's e-mail address. When the receiver picks up the message, the client can verify the notification hash with the message hash. If they don't match, throw the message away (or notify the user, etc).

Re:I'd say more than 35%

[osu-neko]

I simply use greylisting. After that removes 99.99% of the spam, I just don't see the need for any further measures like SpamAssassin or RBLs or whatever, it just wastes time at that point. Greylisting does all the real work.

Re:I'd say more than 35%

[Sam Ritchie]

Being caught doing this (likely, as sooner or later a customer will say something) would make your filtering work dry up pretty quickly - the email scanning employees would probably not have direct access to email in an attempt to prevent this. I'm not saying it's a good idea or that it's not susceptible to abuse, but it could theoretically work.

Re:I'd say more than 35%

[shadowmas]

this is an excellent idea. but rather than having the registrar generate the SSL keys why not add them to the dns like in spf. this would allow the admins to generate the keys the way they want and if somehow a key is compromised (one of the mail servers gets stolen/hacked) they can quickly and easily generate a new key. also it would be valuable if you could have different keys for different servers.

Re:I'd say more than 35%

[Nephilium]

For a while... I used a greylist of a sorts... one thing that got dumped into my "Whitelist" folder was that the people sending the e-mail just had to put the word "whitelist" into the subject line... That seemed to work quite well...

Of course... now that I put this here... YMMV...

Nephilium

A bottle of wine contains more philosophy than all the books in the world. -- Louis Pasteur, French scientist

Re:I'd say more than 35%

[shadowmas]

This would not be practical simply because there are actually some servers which do need to generate lots of emails for valid reasons like order confirmation/status emails which are batch generated at the end of a day.

also cpu time is not a big problem for massive bot net owners who can get a hold of thousands of PCs. as for people noticing the 100% cpu usage on their computers you'd be surprised how much a simple user would brush off as the norm.

Re:I'd say more than 35%

[nuzak]

I could analyze your FUSSP point-for-point, but let me just whack at the most flawed point:

All ISPs should take reasonable care not to reinstate mail sending privileges until they are sure that the user's computer is clean.

Any ISP that actually gives enough of a shit to care what is coming out of their network and manage their users like this has already managed the spam problem. How much spam do you see coming from AOL IPs? Yeah, it's because they got people like Carl Hutzler who actually took the problem seriously and they gave him real power to implement solutions.

I see armchair admins come up with these oh-so-clever solutions every day, but the reality is that solutions exist now, and what stands in the way of their implementation is nothing more than incompetence and greed. Comcast, Brazil Telecom, Orange/TPnet, all of them could stop their massive armies of zombies overnight, but it's just too expensive. Their cost-benefit analysis lets them keep polluting our mailboxes with direct-to-MX zombie connections rather than deal with the support costs of the 0.01% of users that will ACTUALLY have a problem with port-25 blocking.

We have to make it expensive for ISP's to continue letting their zombies send us spam. That is my FUSSP.

Re:I'd say more than 35%

[tsotha]

I think you'd have to use it along with whitelists. I'd happily put amazon.com and some of the other vendors I use on my whitelist, and I wouldn't even blame them for saying "If you want email from us you need to put us on your whitelist."

I'm at a loss to think of an example of a service that generates large volumes of legitimate unsolicited email.

As for the botnets? Well, that's still only 12 per minute, which is a heck of a lot better than what we have now.

Re:I'd say more than 35%

[lnjasdpppun]

The hard thing about coming up with a way to deal with spam is not requiring 'all mail servers' to do something. As soon as a prevention method requires all mail servers to start doing something at the same time it becomes too difficult to implement because people/companies hate missing emails and if they stopped receiving email from non-verified servers emails would be missed/lost.

There are a few ways the deal with most spam already deployed but because they require all mail servers to do the same thing (and it's very hard to get ALL mail servers, even the legitimate ones, to do something) they have to allow the standard SMTP protocol to function as normal otherwise they will lose emails.

Re:I'd say more than 35%

[smilindog2000]

Are we finally going to reach a point where only trusted addresses can email us?

Yes, I think we are. I recently had a very enlightening discussion on /. with a strong opponent of challenge/response. It seems that the servers can be configured to eliminate most spam. Well... they haven't been configured, and the spam keeps coming. I hate to have to use it, but challegen/response is the only way I can effectively participate in the on-line community, now that my e-mail is well publicized (bill@billrocks.org). I have to say, I love the freedom to post my e-mail address. It makes me feel like a real person.

Re:I'd say more than 35%

[twiggy]

I appreciate the suggestion, but I host my own email, and I don't have the time/resources of someone like Google, unfortunately.

Re:I'd say more than 35%

[walt-sjc]

I'm seeing modern spam engines that are designed to handle greylisting. While it's still in the minority, it's a heck of a lot more than 0.01%. of the volume I see. The 419ers at hotmail / yahoo, etc. alone account for more than 0.01% (more like 0.5%.) Of course I DO use DNSBL's which cuts down the amount of data greylisting deals with to a nice low 5%, which make it easier to identify the broken legit mailers that don't handle greylisting. Don't know what you plan on doing when 50% of the spamware gets around your greylisting (it's just a matter of time...)

Re:I'd say more than 35%

[walt-sjc]

Only problem is that this would allow spammers to make up any number of keys which would completely kill the effectiveness of this idea.

Re:I'd say more than 35%

[thogard]

Why not just buy an x.400 email server? It does all that already.

Re:I'd say more than 35%

[JonathanR]

Sure, you only have to store one message, but your server gets bombarded with multiple requests to read that one message, and has to be sufficiently robust stay up to accept the requests. To spam from a botnet, you would have to spread the load further than currently done, and must effectively publish the identity of each bot for the system to work.

Re:I'd say more than 35%

[TomTraynor]

My spam volume is staying about the same. I have my family use my Yahoo account to register anything so our personal accounts don't get much spam. I track the volume daily and the following is the summary below. I use this as an example to friends and family on why they should protect their personal email ids and use disposable accounts when registering anything that asks for their email id.

Month Legit Phish UCE Porn Scam all spam TOT % legit
January 165 21 53 116 31 221 386 42.7%
February 121 3 52 59 9 123 244 49.6%
March 141 13 147 59 8 227 368 38.3%
April 131 13 221 189 33 456 587 22.3%
May 141 9 569 1,027 21 1,626 1,767 8.0%
June 153 13 485 288 21 807 960 15.9%
July 125 5 346 60 7 418 543 23.0%
August 152 6 382 43 2 433 585 26.0%
September 141 2 329 60 4 395 536 26.3%
October 140 5 295 11 11 322 462 30.3%
November 134 2 376 24 18 420 554 24.2%
December 110 3 299 32 16 350 460 23.9%
YTD 2006 1,654 95 3,554 1,968 181 5,798 7,452 22.2%

For me the real bad month was in May. The only thing I have noticed in the last few weeks is that the Yahoo filters are missing more of the spam and putting it in the inbox. Not a problem in that I report it as spam so their filters get better. Besides going after the spammers maybe the authorities go after those who purchase the services.

Re:I'd say more than 35%

[1u3hr]

outsource to India or (the irony, Nigeria) for a human spam filter.

Yes. Because nothing confidential ever gets sent by email and you can trust sweatshop workers not to be tempted to take advantage of anything they read.

Re:I'd say more than 35%

[craqboy]

It's worth while to say that senders need to also follow some best practices such as:

• Ensure sending mail servers have valid mx or a record for the sending IP address
• Sending IP of mail server should have a valid reverse dns record (PTR) and should match the A record for the IP.
• The information in the HELO/EHLO portion of the smtp session should be a valid hostname and should resolve to the sending IP address or PTR.
• SMTP Authentication for outbound
• Published SPF records for the sending domain. http://www.openspf.org/
• Domain Keys
• plus more that I can't think of at the moment.

RFC 2505, while out of date contains some good information: http://www.faqs.org/rfcs/rfc2505.html
Of course putting all of these into effect wouldn't fix the problem with spammers but if companies would put more focus into researching and having the facts then we could decrease a lot. Working in the email industry, the most common thing I see slowing down spam fighting is a global adoption of new protocols and getting them implemented (which I am sure applies in places well beyond email).

Re:I'd say more than 35%

[McFadden]

you can trust sweatshop workers not to be tempted to take advantage of anything they read.

Ironically I would trust the sweatshop workers' honesty more than I would the CEOs of the companies that own the sweatshops. But that's for a different debate...

Re:I'd say more than 35%

[PotPieMan]

My ISP recently added C/R to their mail servers, and I've lost mailing list traffic as a result. To me this illustrates a key problem with C/R: by being selfish, you win in the short term. If everyone acted so selfishly, email would not be an effective tool for communication.

See also Justin Mason's collection of anti-challenge-response links.

Re:I'd say more than 35%

[MobyDisk]

Yes, but at least they couldn't send the spams without exposing what domain the generated the keys from. Then someone could notify the registrar and have the person's credit card pulled.

Re:I'd say more than 35%

[commodoresloat]

Being caught doing this (likely, as sooner or later a customer will say something) would make your filtering work dry up pretty quickly

Who cares? By then you would have another job based on the job lead you got from the email. ;)

Re:I'd say more than 35%

[jcr]

I don't think this scheme helps. It just adds a level of indirection to mail retrieval, and makes potential spams even smaller (that is, faster) to send.

He can't just shoot off 20 million random messages. He now has to store all of them on his server for some period of time so that you can pick them up.

No, he can send off N million pointers to the same message just as easily.

-jcr

Re:I'd say more than 35%

[dcollins]

I totally agree. I bet they'll report an even bigger jump in December... it seems like a week ago my spam received doubled one day, and again the next day, and again the next. For me it's reached a critical mass where I can't find the actual mail messages anymore (just in the last few weeks).

Re:I'd say more than 35%

[javaxjb]

I don't think the reverse IP requirement would be workable. Many mail servers are private addresses behind a NAT/PAT/firewall, so the first hop would have a meaningless address. Even if you went with the first hop on the private side, there may be a single IP address handling many names. I like the idea of a cryptographic chain of authentication -- even if it is not universally adopted, it would speed up processing of good mail, and as more servers adopted it, pressure would increase on the non-adopters as senders become more frustrated with the false positives stopping their legitimate messages.

Re:I'd say more than 35%

[RealGrouchy]

More importantly, Gmail has a very low false-positive rate.

I skimmed through my spam folder last night for the previous four days' spam, and didn't see a single message that shouldn't have been marked as spam.

Many of my friends who use Hotmail complain that if they don't check their spam box every couple of days, they lose a few legit messages in the regular cleaning cycle. That's just crazy on too many levels.

- RG>

Re:I'd say more than 35%

[kenb215]

When i started forwarding to gmail, I average a spam folder of 4000 (it deletes spam after 30 days). In the past two months, its gone from between 5000 and 6000 to over 15,000.

That is because gmail doesn't delete old spam anymore. I'm not sure if it is because the deletion function broke, if the old spam is being used to help train filters (i.e. spam that the user had to mark), or something else. If you go to the spam filter and look at the oldest messages, they should be from around October 23 at 7:00 AM (GMT).

Re:I'd say more than 35%

[Matt Perry]

I get a LOT of spam per day, (about 100+) and 99.9% is categorised at spam by gmail.

That doesn't sound like a solution to me. If it's categorized then why isn't it deleted? If it's not safe to delete then it's still something you have to deal with even if it 99.9% gets sorted to different bins.

Re:I'd say more than 35%

[Darkforge]

What we really need is E2EASMTP: End-to-end Authenticated SMTP.

Your post advocates a

(x) technical ( ) legislative ( ) market-based ( ) vigilante

approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)

( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
(x) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
(x) Users of email will not put up with it
(x) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
(x) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
(x) Anyone could anonymously destroy anyone else's career or business

Specifically, your plan fails to account for

( ) Laws expressly prohibiting it
(x) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
( ) Asshats
( ) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
(x) Huge existing software investment in SMTP
(x) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
( ) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
(x) Extreme profitability of spam
(x) Joe jobs and/or identity theft
( ) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
( ) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook

and the following philosophical objections may also apply:

(x) Ideas similar to yours are easy to come up with, yet none have ever been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
(x) Countermeasures must work if phased in gradually
( ) Sending email should be free
(x) Why should we have to trust you and your servers?
(x) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough

Furthermore, this is what I think about you:

(x) Sorry dude, but I don't think it would work.
( ) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your house down!

Re:I'd say more than 35%

[sunset]

From TFA:

Scammers have been able to turn up the spam volume because of the seemingly limitless number of systems vulnerable to hijack, using an individual bot for only hours to send out large quantities of spam, then discarding that PC to move on to another.

This suggests that greylisting with a delay of an hour or two will have a major impact.

I use both DNS blocklists and greylisting, and until today I've had my greylist delay set to just 15 seconds, on the theory that spambots will not try again at all. Evidently they are getting smarter, but what I'm seeing is that most of the junk getting through was delayed less than 2000 seconds by greylisting. So I've upped the delay to 2700 seconds (45 minutes) and expect that to result in significant improvement.

Keep in mind, at some point the DNS-based blocklists will have enough time to identify most of the spambot IPs. Surely greylisting is a solution that has staying power.

Re:I'd say more than 35%

[sholden]

There are enough people for whom email is useless due to spam that they're willing to move to a different system and no longer have access to standard email. Sure not everyone can do that, not even most people are willing, but enough are that such a "do over" has a chance of getting a foothold now.

Seriously do you remember when email *never* went missing... Unreliable in theory was so much nicer than the current unreliable in practice version.

But yes might as well ditch SMTP at the same time, maybe ECMTP.

Re:I'd say more than 35%

[clem]

Maybe it's just me, but my spam volume seems to have jumped at least 200% in recent months.

Ah, but my spam volume decreased by 130%. So it all works out, you see?

Re:I'd say more than 35%

[martin]

I suggest further tuning of Spamassassin - make sure you've got 3.1.7 the SARE rules, fred and Jennifer's rules from www.rulesemporium.com, URI-RBL's running, dcc and Razor2.

This is the setup I've got (and some more custom rules) and we hardly see any spam in the inbox.

Get on the spamassassin-users list as ask for further advice, if your still stuck

Re:I'd say more than 35%

[Technician]

i'd say try a different webmail provider. I get a LOT of spam per day, (about 100+) and 99.9% is categorised at spam by gmail. In the last month i would estimate i've had 2 spam messages hit my actual inbox. The rest were filtered out by gmail.

I've simply dumped e-mail. My home account hasn't been opened in over a month. My internal work e-mail simply dumps everything from offsite into a folder to filter later. I haven't opened that folder in months. I carry a pager and a phone. Those who know me have my work voice mail, my home number, my pager, and my address. It's removed a lot of stress.

Last year I finaly got broadband. The cable company sent a welcome packet with instructions on how to set up 5 included e-mail addresses. They have never been set up. It wasn't worth it.

Re:I'd say more than 35%

[heinousjay]

That's because you've been trained by Hollywood and Slashdot and all the other happy lefty bullshitters to believe anyone in business must be a liar and a thief. It's a generalization that isn't even close to true, but that doesn't stop it from being propagated in the name of populism. Unfortunately, the idea of the noble poor is just as much a myth.

Everyone has equal potential to be scum. It's just easier to make people hate successful scum.

Re:I'd say more than 35%

[Knutsi]

My workplace has also noticed an increase in spam, and also spam that gets through. The once that do share the feature of being an attached picture with a message, then a text message that does not appear to be spam. I think the IT manager managed to get it under control now. However, I must add that for private mail I use Gmail, and it is amazingly good at catching spam. I keep thinking Google should extend the service into the business market.

Re:I'd say more than 35%

[asb]

I have been keeping track of the amount of SPAM in my GMail spam box. After the thanksgiving weekend the number of SPAM has increased more than twofold:

2006/11/22 4257
2006/11/29 6668
2006/12/07 8394
2006/12/14 9262

Obviously spammers getting ready for the holidat shopping season too.

Re:I'd say more than 35%

[Pippinjack]

I have a gmail address that I have never used. This address gets about 100 spam emails per month. so either

1. gmail are testing their filter with fake spam
2. spammers are guessing gmail addresses
3. google have told someone my email address

I assume it's the first...

Re:I'd say more than 35%

[Fred_A]

Their cost-benefit analysis lets them keep polluting our mailboxes with direct-to-MX zombie connections rather than deal with the support costs of the 0.01% of users that will ACTUALLY have a problem with port-25 blocking.

Not to mention that that tiny % of users should be savvy enough to be able to figure out how to disable the blocking themselves (since they managed to set up their own MTA). So the support cost should *really* minimal.
At my ISP it's a setting I can toggle on an administrative interface that handles my connection details. The port is filtered by default.

Re:I'd say more than 35%

[gsslay]

"i'd say try a different webmail provider."

How is this either informative or helpful? This is about as useful as telling someone who has problems with their delivery truck that they ought to get a new motorbike.

Everytime there's a story about spam on slashdot we get the same useless response; "gmail removes all my spam, use gmail." Amazingly, many people work where there is an email system that is not based on a free web provider. Amazingly, many businesses prefer things that way. Touting an external, unsecure, unsupported, advert supported, webmail system as the all-purpose solution to spam is just dumb. Stop doing it.

Re:I'd say more than 35%

[smilindog2000]

Adding C/R to the mail servers is not a good approach. There are better things the servers can do, essentially by trying to verify that the sender is real before passing on the mail. However, if you cannot configure the server (like my Yahoo account), the spam gets to you, and you need a way to filter it. I run C/R on my local machine, in addition to spam filters. The mail it filters out just goes to another folder that I can still search through if I want. I agree with the general opinion that C/R is not the best solution, but if you're like me, you have no other choice. If your mail server administrator is bone-headed, there simply is no other way the end-user can get his mail without having to read hundreds of horrible spams each day. It's just the ugly truth.

Re:I'd say more than 35%

[smilindog2000]

I agree that C/R is a poor solution. However, with the bone-headedness of the whole freaking world's mail server administrators, spam is getting through in record amounts. Until they come around and fix the problem, C/R is the ONLY viable mechanism guys like me have to participate in the on-line community. Also, it is simply untrue that C/R breaks down if everyone switches to it. Instead, the spam simply goes away. Many people like me have been forced into C/R. If anyone knows a better solution for me, I'd love to hear it, but it can't include having me modify Yahoo's mail server.

Re:I'd say more than 35%

[Richard W.M. Jones]

The parent (Darkforge) is absolutely right. Authenticated chains of SMTP servers are no match for spam zombies using grandma's email address to send out their spam.

The basic problem is unsolvable. I want anyone in the world to be able to send me email (because I run several FOSS projects, and I want people to contact me about business matters). At the same time I don't want anyone in the world to contact me (spammers). This is not a circle that can be squared.

Rich.

Re:I'd say more than 35%

[Tom]

The key is that now the sender has to own the email. He can't just shoot off 20 million random messages. He now has to store all of them on his server for some period of time so that you can pick them up. Cheap for you, expensive for him. Wrong. For legitimate mail, you shift the costs to the sender. For spam or other mass-mailings, the additional cost is negligable, because the same mail is delivered to everyone who comes calling, and you don't even need to store a list of who is authorized - you just give the spam to everyone who comes asking.

It also means that he has to be honest about his RSS feed otherwise you'll never be able to pick up the email and read it. This also makes it easier to track them down. In theory, yes. In the real world, they'd just use other people's machines, like now. It would make a little difference, yes. But it wouldn't eliminate the problem. Just another round in the arms-race.

Personally, I think spammers won't go away easily. They make a lot of money off pathetic fucktards who think they can get a bigger dick with a pill. The real damage is done by the people who purchase via spam making spam a viable marketing tool. 100% agree. We should shoot the spammers, and fine everyone who ever bought anything from a spammer the costs of the bullet and assassin.

Re:I'd say more than 35%

[CastrTroy]

For some reason, I received no spam on halloween. No kidding. My Email was working, I received all my regular mail, but no spam. I usually receive 30-50 spam messages a day, all but 1 or 2 of which are blocked by gmail. On Halloween, no spam, kind of weird....

Re:I'd say more than 35%

[slim-t]

I must be doing something wrong, because there's only 1 message in my gmail spam folder, and it's from MLB.com, a site I've made purchases from this year. I haven't seen any email from any genuine "spam" sources in a long time (probably never since I switched to gmail). Anything that hits my inbox is a conversation with a friend or an advertisement from a site I've done business with recently.

Re:I'd say more than 35%

[kv9]

Touting an external, unsecure, unsupported, advert supported, webmail system as the all-purpose solution to spam is just dumb. Stop doing it.

ORLY? it's not so bad.

Re:I'd say more than 35%

[winnabago]

I'll confirm this. I had seen the number growing and assumed it was due to higher volume, but apparently something else is happening over at Gmail. Seems like it would be noticeable if their servers were storing 2X spam (and growing daily) instead of the usual, but hey, it is Google, where all the world's information must include these messages too.

The oldest of 2050 messages I found has been there since October, just like you said:

Received: from shelf-d058.slag.nifty.ne.jp (225.202.119.7) by gl320-a841.mail.goo.ne.jp with Microsoft SMTPSVC(5.0.2195.6824);
Mon, 23 Oct 2006 12:56:08 +0600
From: &#65533;X&#65533;&#65533; &#20174;q <burdensome988@nifty.com>
To: xaxisx@gmail.com
Subject: &#65533;&#65533;&#65533;l&#65533;&#65533;
Date: Mon, 23 Oct 2006 10:56:08 +0400 EST
Message-ID: <42700.35746.9698233799@harry-bhy61.dion.ne.jp>

Wonder what they're up to.

Re:I'd say more than 35%

[stretchsje]

I agree. I work at a small ISP and our e-mail server load is through the roof. We've seen a compounding increases every month for a several months and are now at the point where our hardware is simply inadequate. Just six months ago, our server was only using a modicum of its resources. Spam-Assassin has some CPU-intensive filtering options that we tried long ago to increase filtering accuracy (though the difference was negligible), but keeping them on isn't even an option for us anymore. Spam traffic is killing our e-mail server. This will inevitably raise the cost of providing e-mail service (though it's still so cheap per customer, I wonder if it'll actually affect most consumers). It's interesting to chart e-mails sent and e-mails received. E-mails sent from our server are not even 1% of peak between 2am and 5am, but e-mails received are within 85% of peak during those hours. Spam never sleeps. Actual spam hitting my inbox has not gone up nearly as much as the volume of spam hitting our mail server, thankfully. It's higher, but certainly manageable.

Re:I'd say more than 35%

[Just Some Guy]

This comes up a lot, so skip this if you've read my take on the matter before.

One of my clients has a website that features an opt-in email newsletter. Each message is roughly 1MB in size (many pages, lots of images, etc.). He has about 25,000 subscribers. This means that near the first of each month, he's sending about 25GB of email out to people who want to get it. Under SMTP, this is no big deal - just give Postfix a list of recipients, and let it work out the delivery details. The mail queue gradually shrinks over time, and in the case of many customers at the same domain, his server can group all of those recipients into a single connection.

Under DJB's plan, he would send out 25K notices that the newsletter is ready. Whenever people arrive at their office in the morning and check their mail, his WAN connection would catch on fire as they all try to simultaneously download the message (or at the least overwhelm it in predictable waves: 9AM EST, 9AM CST, 9AM MST, 9AM PST). His service would completely fall apart.

Not only would spammers hurt under this plan, but so would every legitimate bulk sender (such as my friend and every mailing list operator). That's a price I'm not willing to pay.

Re:I'd say more than 35%

[JJC]

Sounds like DomainKeys.

Re:I'd say more than 35%

[kilodelta]

In my book the only good spammer is a dead spammer. It'd be pretty easy to hunt down the originators but I think if we found out who is really behind spam there would be some serious outrage. Think about it for a minute. The spammer makes money by sending out the emails, but who makes the money on the product? Sure, mob interests get some of it, but even legitimate business interests are in on the spam game. I've proposed setting up and finding funding for a team that does nothing but prosecute/persecute spammers and their sponsors. But we'd have to cross swords with law enforcement in various countries to do it right.

Re:I'd say more than 35%

[TheOldFart]

I don't know if you've figured this out yet, but you've just delayed all incoming email by 45 minutes. I guess you don't do anything too time critical with your email.

Only the first email from a given address. It's then cached and no longer subject to the bounce.

Re:I'd say more than 35%

[mdomb529]

No, it's probably because he's been trained to think that sweatshop owners, as a specific subset of people in "business," are unethical, if not liars and thieves in the literal sense. And for the record, there's nothing "ironic" about trusting the exploitee (sweatshop worker) more than the exploiter (sweatshop owner). 10,000 spoons when all you need is a knife, now THAT'S ironic.

Re:I'd say more than 35%

[Kaetemi]

You say the spam in GMail gets deleted every 30 days, and indeed, that is what my GMail account is claiming to do also, but actually however.. My spam filter has also doubled (to 6000) the past month, and guess what... the oldest mail is from 23 October, which is 60 days ago, not 30... ^^ I think that would be one of the main reasons for the 'increase', at least for me.. :P

Re:I'd say more than 35%

[Conficio]

Sorry, your proposal is complicated and impossible to implement:
* first it is not backward compatible and nothing that isn't has so far reached any acceptance, so I guess we will have to build this in. We need something that does not require everybody to implement it before it is effective.
* In your proposal ISP's (and their filters) decide what is spam and what not. This is never acceptable, because your spam (trash) might be my ham (treasure). Just think of all the people that decide the mail form that list they signed up for is now spam to them. At what point does an ISP decide to stop that list? What is the harm to the users who want to receive it still?

But I think you are not that far off. Digital signing is the solution. Why does not everybody (every single end user) implement digital sining with PGP in his or her e-mail client. Then all we need is a spamassassin that can classify the e-mail by our trust level for each signature.

With all (or just a significant portion of) e-mails signed I can reliably filter on the sender. I now know who the sender of a signed e-mail is. I (the recipient, that is the only one who should decide what gets filtered as spam) can then filter:
* everyone that bothers me and does not stop sending me into trash
* everyone I know and have cleared by signing his or her signature (locally or publicly) into my Inbox
* everyone that has a signature that is signed by someone that I trust into where ever I want to deal with
* every e-mail that is not signed into the queue that reflects its priority to me

Optionally, list servers can sign the messages going through their means, just to make it easier or they can sign publicly all signatures that have legally registered with the list (giving them a trust level I can determine).

This solutions uses existing technology and is backward compatible. It even can migrate with everybody that wants. It delivers already benefits if I can safely filter my trusted correspondents (friends, family, teachers, clients, customers, etc.). It also does not assign control and economic power to any agency that controls the master keys. Everyone can create signatures and have them authenticated by everyone else. It is up to the recipient to decide with trust authorities she trusts. Off course commercial entities can provide keys and trust services just as with SSL if there is demand for this.

I'm still hoping for a spam assassin module to emerge that checks for signatures and the assigned trust level in my keyring. The only problem I see is that spam assassin needs the pass phrase to access my keyring, but I think that could be solved somehow as well (Shadow keyring with only external keys?)

Another problem could be to teach non geeks to handle keys correctly. Because understanding what key signing means and how trust should be handled and when to revoke a key needs is not trivial. But this could be then a commercial service. And I believe it is in many cases a UI design question (wizards, etc.)

If anybody knows of such an implementation, please let me know.

K

Re:I'd say more than 35%

[PlusFiveTroll]

guess you don't do anything too time critical with your email.

It's not wise to use email as chat, if its time critical use a phone. SMTP is not a real time system what so ever. It happens to work that way most of the time because the communication channels are clear. Almost every SMTP server out there queues your email message to disk. A separate thread (or process) then comes along and attempts delivery. If the queue is backed up, or the remote host is busy or down, your email can sit on the server for quite a long time. That's the way its designed.

You may get away with real time mail in side of a corporate firewall or on your own mail servers, but anything public (hotmail, yahoo, etc) it rarely works that way any longer.

Re:I'd say more than 35%

[PurifyYourMind]

I've seen my Spam folder dip up and down around the 3500 mark, and I'm not deleting any of them myself. But I believe you're right that, at the very least, the 30-day figure is "fuzzy".

Re:I'd say more than 35%

[Cycnus]

If you use your own server, I'd suggest adding greylisting capabilities to it. I too had a serious increased of spam like anybody else and even after heavy filtering I used to have at least 50 spam a day getting through.
I recently added greyslisting and now I'm down to 1, maybe 2 at most a day. I'd say that 99% of the connection attempts to my mail server are for delivering spam, that's for me a few thousand mails a day that I don;t have to deal with.

Don't know if it's of any interest to anyone, but I've got an extensive article on how to set-up your own mail server on Linux: http://etc.nkadesign.com/EmailServer/EmailServer

Re:I'd say more than 35%

[gumpish]

Unfortunately, the idea of the noble poor is just as much a myth.

Everyone has equal potential to be scum. It's just easier to make people hate successful scum.

Actually it's usually the scummiest people (the people most willing to step on others to get to the top) who are "successful".

People who have to actually work for a living have been far more trustworthy per capita than high-level white-collar types in my experience. But don't let me rain on your Objectivist parade.

Re:I'd say more than 35%

[Dion]

I'd say my address is well published as well (ff-sd1@partyticket.net) and I get on average 0.5 spam mails pr. day with no filtering.

I use 4 independant RBLs 3 of them are driven exclusively by spamtraps and the last one is spamhouse, the RBLs are combined with greylisting.

Greylisting is very effective due to two things:
1) it effectively tests the senders mail server to see if it's a real mail server.
2) it multiplies the effectiveness of the spamtrap RBLs by giving the spamtraps an extra 30 minutes to catch the spammer.

Now to use greylisting you certainly need to have control over the mail server, but that's just an argument for running your own mail server:)

C/R is a pain in the ass for the sender, so it is seen as impolite by people like me who just want to send email and be done with it.

Re:I'd say more than 35%

[smilindog2000]

I'm a big fan of greylisting, and I totally agree with you. Most of my spam is from our company's e-mail server hosted by Yahoo. I'm basically screwed, and stuck with C/R, so far as I can tell. Yahoo sends me nearly 200 spams per day.

Re:I'd say more than 35%

[dgatwood]

I can't think of any reasons why this wouldn't work (and indeed, the keys should be distributed via DNS whether they are signed by a certifying agency or not), but it's worth spending some time and thinking through it carefully just to make sure that self-signing wouldn't weaken things too much.

Self-signing would certainly be preferable in some ways, since it would be cheaper for small domains. On the other hand, it would be problematic in some ways, as verifying the key would require performing a DNS request since you couldn't just locally verify that it was signed by someone you trusted. This means that you'd have to figure out what to do with mail where the DNS server didn't respond. You could very easily DOS someone with such a mechanism by claiming to be sending from a domain whose DNS servers are down.... The same flaw exists in SPF, though, so I guess it wouldn't be making things any worse.

One other small point of weakness is that someone hijacking a domain's DNS server could then send spam emails masquerading as that host... which would mean that such a scheme wouldn't be as good in terms of being absolute proof that the company or group sent the spam, but it would still be a lot better than what we have now.

All in all, I'd be more interested in seeing an open certification service in which people get a free cert every so often in exchange for authenticating somebody else and assigning them a cert... sort of a giant, recursive pyramid scheme for key signing. That way you have an audit trail for the host keys, albeit not as solid an audit trail as a key from Verisign, Thawte, etc.

Re:I'd say more than 35%

[dgatwood]

I haven't seen their spec, but yeah, what I'm seeing in Wikipedia looks like maybe somebody actually listened to my rants a few years back. Either that or it fails the patentability test for obviousness---not sure which.... :-)

Re:I'd say more than 35%

[dgatwood]

Actually, they would do pretty well, and if you'd read my post, I addressed spam zombies fairly thoroughly.

1. It would force grandma's email to go through a real mail server.
2. It would cause that real mail server's normal per-user email throttling to set off red flags or at least limit the rate of message delivery.
3. It would provide an auditable trail back to grandma whereby the ISP would be forced to block emails from her account until she got her machine fixed.

Of those, the most important is #3. If spammers know that the very first time somebody reads one of their messages and clicks "report this as spam" in their MUA, the spam bot that sent it is out of business, they'll have to work a lot harder and have a much larger number of spam bots to get the same results.

That said, you shouldn't underestimate the importance of #1. If a typical legitimate mailer at an ISP has a limit of three messages per minute and a 100 recipient limit, that's a limit of 300 spam messages per minute. On a 1.5Mbps internet connection, that same server could sent a 1k message 150 times a second. So there went another order of magnitude.

I would also add that mail applications should never auto-deliver messages without explicit clicks by the user. As long as this policy is in place for any MUA that supports this scheme, spam would be much, much harder, as it would first have to find a way to sniff the user's mail server password in order to send mail in the first place. Remember, I said SMTP auth would be required for the hop from the MUA to the MTA.... (At least I think I did. That was certainly my intent.)

Re:I'd say more than 35%

[Dion]

Yeah, I had somewhat the same problem with a few legacy addresses where I'd get the mails forwarded.

What I did was to reject all mails from the old addresses with a message that my new address could be found at http://dion.swamp.dk/ but I take it that's not what you want:)

Why don't you move your company mail server "home"?

Re:I'd say more than 35%

[smilindog2000]

I wish I could move it home. bill@billrocks.org is at my house, but my work email is at Yahoo. We're a small company of only 7 people, so I have trouble justifying to the boss that we should save the $20/month by paying me to maintain a server :-)

Re:I'd say more than 35%

[McFadden]

That was largely what I was trying to say, but didn't quite word it as well as you. Thank you for putting it a hell of a lot better than I did.

Re:I'd say more than 35%

[tacocat]

I disagree with some of this and here's why:

All mail servers require an SSL key.

All mail servers will not have to pay to have a CA signed SSL key resulting in millions or even billions of dollars consumed on what amounts to regulatory expenses.

All mail servers must sign each piece of mail as it passes through their systems. This signature must sign the complete message, including the signatures of previous servers in the path.

I'm not sure how this is going to be much different than Received By: headers other than it now comes with an SSL key that is either made up on the fly or very expensive for the mail server to keep available (see comment one)

All mail servers must support an automated abuse handling mailbox, autoabuse@domain for responses to spam messages.

Why? So you can deliver spam to this address like you do postmaster today? Are you going to automate it to shutdown accounts? That's an awesome DOS tool that you are handing out to everyone in the world to use.

Dude. I'm not even going to finish with the rest of these.

Perhaps it would be more effective if we simply hunted down and executed the top spammers in the streets and made it clear that it won't be tolerated. When you have some dickhole like Alan Ralston living in Birmingham MI and articles are published in the local paper about how he is the Spam King AND THERE IS NOTHING YOU CAN DO ABOUT IT then you have a problem. A friend went by his new house he was building (bought by penis adds) and was chased down and almost driven off the road by one of his ghouls. The police disputed the video footage and implied it looked like he was driving recklessly and they might need to review his driving records...

Shoot the fuckers on the street is OK with me.

But what you propose won't do anything other than make it really expensive.

And how do you seperate the hard spam from the marketing material that every company has a right to deliver?

Re:I'd say more than 35%

[tacocat]

There is one idea I've seen applied again and again but with limited degrees of success.

It's somewhere around Razor, RBL, and spam filtering.

RAZOR works in two modes: submitter and query. Most people do not run RAZOR as a submitter. My experience a few years back with RAZOR was that is was not very effective compared to local filters like spamassassin and bogofilter. So who wants to waste the bandwidth testing all the time?

RBL tests against a given domain. Effective but implementations vary from prissy to multi-warhead nuclear assault.

I found one RBL that I liked in concept but it was badly implimented. The idea goes like this:

1. If you find spam, you submit the HELO address the connected to your server and they are registered with a score+1.
2. When you get a HELO request you check it against this RBL.
3. With enough participants and a high enough ratio of HELO-spam and HELO-good emails you can an effective and dynamic blacklist.

If you used a ration of something like 50:1 then you would shutdown a mail domain and keep them on the RBL for a period of time ( Cumulative spam ratio or 24 hour ratio > 10:1 -- list for 12 hours. Cumulative or 24 hour ratio > 100:1 -- list for 168 hours (1 week). Cumulative ratio of 1000:1 -- list for 12 months or permanently.

Re:I'd say more than 35%

[tacocat]

How about we only allow ascii/text and block any html?

Continue to allow attachments, but kill the embedded crap that is so evil.

Mass Destruction

[tacocat]

If Bush wants to regain some popularity he should consider nuking some of the spammers.

It's not going to stop. It's a multi-billion dollar industry.

Re:Mass Destruction

[MP3Chuck]

I know trying to educate users is about as futile as trying to end spam completely ... but maybe instead of better filters or stronger laws, that's what we need. I mean honestly, how can someone be connected to the world enough to use the web and email but still be ignorant enough to buy into something that a spammer is hawking? Who's taking investment leads or buying penis pills based on a random email advert?

Every major email provider has pretty good spam protection. One peek in the Spam folder is enough to realize "Hey, this must be some bad stuff." It hurts my brain to try and figure out how spam could possibly be a viable business model.

Re:Mass Destruction

[thogard]

Laws won't help because its an international issue. The only way to stop it is to follow the money and while two systems exist to do that, they aren't even used by the banks that pay for them. I'm talking about MasterCard and Visa anti fraud departments that have the ability to pull merchant accounts so fast that it will make a dodgy ISP's head spin. Both groups need to get together (which they do anyway) and decided that ISPs that host phishing sites will deal with them on their terms instantly and not in the slow ways that tend to happen now. The same goes for domain registrars. Do you think godaddy and NSI will start getting a human to read the applications if they have have their merchant account turned off? I'm guessing both companies would be bankrupt in a month if their ability to take credit cards was pulled. I'm wondering why the banks won't push this. The banks own MasterCard and Visa and the banks are the ones that pay when the scammers win.

Once phishing is fixed, then they can use the same system to nail spam.

Re:Mass Destruction

[SuluSulu]

If Bush wants to regain some popularity he should consider nuking some of the spammers.

We can't rely on Bush to go after the spammers since they don't have any oil. We have to take it upon ourselves to show that advertisements for "male enhancements" and low interest rate loans support terrorists and encourages child porn. If we do well enough we may even be able to send the spammers to Pakistan for "interrogation". After this it will still be necessary to for all of our e-mail to be read by Homeland Security, but this will be a small price to pay for a 5% reduction in spam.

Re:Mass Destruction

[Bostik]

Bugger that, he already signed a law that made it illegal for credit card companies to process online casinos' transactions. Yeah, the law was lobbied by all the casino moguls and, surprisingly, some quite powerful religious groups, but it shows that with suitably motivated people driving an agenda, you can make anything illegal.

How about giving the same kind of shaft to those entities whose products are spamvertised? "Endorse or use spam, and your bank will ensure that you won't do any more business." If you could eliminate money from the spamming equation, at least some of it would go away. I also understand that this wouldn't to squat to penny stock scamming, which is a shame.

Pump & dump for PHYA

[gvc]

It appears to me that the increase is almost all due to a small number of messages swamping us. One advertises the stock symbol PHYA and has no link. The scam is that if you Google for that symbol, there will be a full-width paid ad for a fake broker/analyst site. About 10% of my email for the last couple of weeks (i.e. over 100 of 1000 spams/day) advertises this stock symbol.

Re:Pump & dump for PHYA

[gvc]

P.S. Feel free to Google PHYA and click the ad. It costs them money.

Re:Pump & dump for PHYA

[cashman73]

Stock ticker PHYA belongs to Physicians Adult Daycare, Inc. They recently put out this announcement saying that they have nothing to do with the email spammers, and are trying to catch them.

Basically, the way this scam works is that the scammers buy a bunch of worthless stock (as in a few cents/share), then email fake stockbroker advice websites and fake advice emails to people, trying to get them to buy the stock. When the stock is worth a decent amount of money, the scammers sell and leave everyone else that bought into their so-called, "advice," with worthless stock.

Re:Pump & dump for PHYA

[gvc]

On what exchange? I'm not saying they are a front, but I wasn't able to find any real information about this company.

Re:Pump & dump for PHYA

[cashman73]

According to Yahoo Finance, their ticker symbol is actually technically PHYA.PK. Yahoo's list of exchanges shows that the PK suffix is the United States Pink Sheets Exchange .

Also, in a bit of irony, did anybody catch the Avoid Scams link at the top of the PHYA info page that google links to?

Re:Pump & dump for PHYA

[hedley]

Its a constant battle against that pumper: (here is my spamassassin user_pref for them)

body __LR_PUMP_A /Symbol:/
body __LR_PUMP_C /Short-Term Projected Price:/
body __LR_PUMP_D /Long-Term Target Price:/
meta LR_PUMP_1 (__LR_PUMP_A && __LR_PUMP_C && __LR_PUMP_D)
score LR_PUMP_1 5.0

body LR_PAD_1 /Physician Adult Daycare/
describe LR_PAD_1 Physician Adult Daycare
score LR_PAD_1 5.0

H.

Re:Pump & dump for PHYA

[wintered]

Done

Re:Pump & dump for PHYA

[IL-CSIXTY4]

Generally, these scams are done against "over the counter" or pink sheet stocks, which are not traded as part of any exchange.

Re:Pump & dump for PHYA

[hedley]

I am also trying to see a way for the mkts to help combat this. The pink sheet market can help here. If spam for a symbol on their market reaches some predefined high water metric, remove the symbol from trading for one week. Another alterative is to allow short selling on the thinly traded issue. The pumper has already taken a position and is most likely the reason why the ask price is so high when the emails start arriving. Shorting would be a clear brake here on exuberance. Once the symbol is out of play, remove the short selling allowance.

Re:Pump & dump for PHYA

[gvc]

Except PHYA is just the lure to get you to the "broker" site. Then they bait-n-switch you to another stock. By the time the exchange notices the scammers are long gone.

Re:Pump & dump for PHYA

[Pharmboy]

Also be sure to go to Yahoo.com and MSN.com and do the same, since they use their system that charges seperately.

Re:Pump & dump for PHYA

[Sax Maniac]

I was awash with those, too. The target company changes week to week, and they are innocent. Go to rulesemporium and there's a ruleset for pump 'n dump stocks. Works great. Combine that with SURBL (God, I love them) and you'll be in good shape.

Re:Pump & dump for PHYA

[Dunbal]

When the stock is worth a decent amount of money, the scammers sell and leave everyone else that bought into their so-called, "advice," with worthless stock.

      So what happens if I short the stock every time I get one of those damned emails? :)

Re:Pump & dump for PHYA

[Echnin]

That would rely on your broker having a number of these stocks to lend you, which is very unlikely given that it is as mentioned in a post below you hosted on the United States Pink Sheets Exchange.

Re:Pump & dump for PHYA

[kalpaha]

Some more terms you can google and click the ads:

WBRS
FPMC
APPM
PPTL
APWL
WEXE

Does someone know if it's of any use to repeatedly click on the ads, or does google detect that somehow?

Re:Pump & dump for PHYA

[kalpaha]

One more:

SORD

Re:Pump & dump for PHYA

[19061969]

Would I be right in thinking that multiple clicks from the same IP are evidence of click fraud? Would that cause them problems?

If so, remember everybody, don't click multiple times on the ad. That would be naughty.

Re:Pump & dump for PHYA

[kalpaha]

And one more: USBO

Someone with knowledge of adsense could make some calculations as to whether we can really cause any annoyance to them this way.

Re:Pump & dump for PHYA

[TheSHAD0W]

If you took a large short position in the stock you might be investigated by the FTC and other law-enforcement bodies. They might think you were involved with the people sending out the spam. Further, the fact that spams are being sent out is not necessarily public information, which means those entities might charge you with "insider trading".

Silly, isn't it? But that's our government. Frankly, I think it'd be better if we didn't have these rules; let the unwary be fleeced.

Re:Pump & dump for PHYA

[hankwang]

On keywords without competition, the advertiser pays $0.05 per click. I.e., you have to work hard to really cause financial harm - and probably you will trip a clickfraud filter if you do so...

Re:Pump & dump for PHYA

[gvc]

PHYA ad seems to have been withdrawn. At first I thought maybe they'd been shut down but apparently that entry just became too expensive.

Here are some others to try:

ARSS|CNPM|CVNI.PK|DTGP|LITL|PHYA|PKGH|PMHD|PPTL|PR GJ|THRI.PK|WBRS|WBRS

Plus, SMS Spam

[SRA8]

If it wasnt bad enough get 10 to 15 stock "tips" via spam a day, in mid-December, i started getting the same stock spam via SMS! Yes, SMS! I got a burst of 6 one morning, then another 5 later in the day. Theres $1.10 of SMS fees courtesy of Cingular. I cancelled my SMS service (which they enable automatically) immediately. Wonder how many people are unknowing getting charged for these messages. Starting January 07, Cingular will start charging 0.15/sms -- perahps a response to record SMS revenues :-) ?

Re:Plus, SMS Spam

[j00r0m4nc3r]

I wouldn't be surprised if Cingular was behind it

Re:Plus, SMS Spam

[QuantumRiff]

Cingular charges for incoming SMS? Wow, my cell phone company, as well as all the others I know of in my area (no cingular) only charge for OUTGOING SMS messages.. Just for that reason! Cause pretty much any spammer can send an email to 1234567890@email..com and have the email forwarded as an SMS to your phone..

Re:Plus, SMS Spam

[quenda]

> Cingular charges for incoming SMS? Wow,

How is that any worse than charging for incoming calls? (as i believe is standard in N America)
Most of the world is caller-pays, which seems to work well.

Re:Plus, SMS Spam

[ArcticFlood]

You don't have to answer the phone when someone calls you. With SMS, you cannot reject it to save money.

Re:Plus, SMS Spam

[Constantine Evans]

Interestingly enough, even not answering the phone can still result in charges for the receiver of the call with US providers. T-Mobile USA, for example, charges a few dollars per call for calls to cell phones roaming outside thet US even if they aren't answered.

Re:Plus, SMS Spam

[Alioth]

You get charged for *incoming* text messages? Ye gods! Run, don't walk - to a better cell phone provider who doesn't rip you off for what is essentially almost a penny a byte.

Just One

[HaeMaker]

I remember when there was just one... http://groups.google.com/group/rec.autos.antique/b rowse_thread/thread/5a53273717099e12/c43de9e0b0e50 166?lnk=st&q=nike%40indirect.com&rnum=200&hl=en#c4 3de9e0b0e50166

Whatever Google Uses

[eieken]

Works great, even though some spams get through they do seem to identify and eliminate quite a bit of spam.

I'm still worried why so much spam recently though. Is there anyone out there who seriously READs this garbage and actually considers sending money to these people? Seems like the problem with spam is only going to get worse and worse until the big email providers can come up with some mechanism to prevent spam that still allows independent non-business email servers to still serve their purpose. I don't see this happening any time soon.

Re:Whatever Google Uses

[tacocat]

Yes. They made several billion dollars from spam related sales last year. If it can generate that much sales do you really think it will go away? Ever?

Why do we fight this at the end?

[cliffski]

I use (amongst other thing) spamhilator. It's free, and its pretty reliable. The trouble I have is that I *have* to allow everyone to mail me. When you run a business, you *do* occasionally get people guessing your email address from your domain and sending you a potentially vital email. I just can't afford to block emails by default. And anything (like captchas or auto-response systems) that makes it hard for my customers to contact me is just BAD.

I don't see why we are always fighting this problem at the reception end, rather than the source. Spam filters can work quite well, but why are they mostly applied right at the very endpoint of the chain?
I'd be very happy for some basic filtering to take place on my outgoing mail at the ISP level. If it meant the odd automatic email with a captcha saying "are you sure you intended to send this mail?" before a spammy-looking email went out, thats fine with me, and wouldn't that approach cut down on all those twits whose PC's are part of a botnet without them realising it?

Bah, why is firefox suddenly getting me to spell check in American?

Re:Why do we fight this at the end?

[Elyas]

There are a number of difficulties that arise from spam fighting at the sending point. If the ISP allows pop/smtp access the server, there is no standard way to transmit the captcha to the user. You have to return an url, and hope their email client will display the url, and that the user will be able to figure out to go it. The other is that as long as only some ISPs present captchas on outgoing mail, users will be inclined to switch to ones that don't. There is little benefit at this point to an ISP to filter the outgoing mail. Much easier to let the receiving end be responsible for mistakes. And all of this ignores the fact that the majority of spam is sent via compromised home machines not routing the traffic through an ISP mta, or vulnerable formmail/web scripts.

Re:Why do we fight this at the end?

[LurkerXXX]

That's crap. It shouldn't cost anything to send email. The answer is authentication on both ends. This requires a technical solution, not bureaucracy and government/corporate profits.

Re:Why do we fight this at the end?

[LurkerXXX]

And all of this ignores the fact that the majority of spam is sent via compromised home machines not routing the traffic through an ISP mta, or vulnerable formmail/web scripts.

About half the ISPs I've used have blocked port 25 by default except to their MTAs (they will lift the block if specifically requested to by the user). Since a lot/most home users have no need to have port 25 opened to other hosts, that should kill off the bulk of the spam problem. If all ISPs blocked by default except by user request, spambot-armies would be a lot less useful.

Re:Why do we fight this at the end?

[robinvanleeuwen]

And if i hack into your computer and turn your computer into a zombie delivering
a few milltion mails a day you won't mind paying the bill for a couple of million?

or would you mind?

i have some objections to it.

kind regards,

Re:Why do we fight this at the end?

[arminw]

..... you need to make a conscious decision to send a letter in the USPS....

As if I did not get plenty of paper junk mail even though it costs the sender more than 5 or 10 cents. Why can't email servers be programmed to only accept mail from the same ip address at a slow measured rate? Then it would take a long time to send thousands of spam from any given computer. If the sending server only allowed two emails per minute from any given sender, than sender could only send 120 emails in an hour rather than thousands of even tens of thousands.

Re:Why do we fight this at the end?

[Anonymous Brave Guy]

Absolutely. The cost to society of spam e-mail is getting silly: we're all indirectly paying for all that extra infrastructure ISPs are setting up to try and filter it, we're all losing precious time dealing with what gets through, and those of us who are admins spend too much of our working (or volunteered, in my case) time checking for false positives in the junk mail folder rather than doing more useful things.

Since most spammers are engaged in otherwise illegal activities anyway, and they're sending out a gazillion e-mails per surge, and there has to be some way to reach them in order for them to benefit, it really shouldn't be that difficult to find the serious offenders and... deal with them in a reasonable and proportionate way. If they're hiding in foreign countries, perhaps the governments of our countries should "encourage" the foreign governments to take more drastic action to curtail the immense economic damage being done by someone on their soil. Suffixing the phrase "Please be kind enough to get your house in order" with the phrase "...or we'll do it for you" in some suitably diplomatic terms should do the trick.

As another aside, since the vast majority of recent spam is caused by botnets, at what point are we going to wake up and stop pretending that allowing anyone to connect to the Internet using any software with no guarantee about their authenticity or the security of their system is a long-term viable strategy?

Re:Why do we fight this at the end?

[ahodgson]

I don't see why we are always fighting this problem at the reception end, rather than the source. Spam filters can work quite well, but why are they mostly applied right at the very endpoint of the chain?
I'd be very happy for some basic filtering to take place on my outgoing mail at the ISP level. If it meant the odd automatic email with a captcha saying "are you sure you intended to send this mail?" before a spammy-looking email went out, thats fine with me, and wouldn't that approach cut down on all those twits whose PC's are part of a botnet without them realising it?

The vast majority of spam is being sent from home Windows machines that have been taken over by viruses and are under the control of the spammers.

For this to work on this scale, you have to understand that the big broadband companies, worldwide, have literally millions of customers whose computers effectively belong to someone else, and are routinely used to commit illegal acts, some worse than spamming (ie. widescale DDoS's).

Since these ISP's can't seem to get their shit together well enough to even start to put a dent in this problem, do you really imagine that they are going to take the time to filter the outbound mail from these machines?

Re:Why do we fight this at the end?

[Iron Condor]

... and then what do I do on those one or two days a year when I genuinely need to send an email to the ~40000 email addresses on the registered-users list of my software who have opted-in to receive updates on new developments?

There are a lot of people who have a genuine need to send out large quantities of emails. Mailing lists for example.

Re:Why do we fight this at the end?

[arminw]

....and then what do I do on those one or two days a year when I genuinely need to send an email to the ~40000 email addresses......

You could apply to the ISP for a business account and tell them you need to do this. They could then unblock your IP so you could send your email to those on your list at normal speed. Any ISP that caters to spammers could be blocked, so only legitimate users, such as you could get the ISP to allow your mail. It would be in the interest of ISP to block out spammers so their own domain doesn't get blocked by others.

The NEW 640k quote...

[illuminatedwax]

"Two years from now, spam will be solved" - Bill Gates

Re:The NEW 640k quote...

[mdmarkus]

"Two years from now, spam will be solved" - Bill Gates

Yes, but this time, he'll always be right.

Re:The NEW 640k quote...

[zakeria]

Of course and I here he only gets a few a day now.... so yeah he did get it sorted!

Outlook

[milo_a_wagner]

I'm no MS fan, but I have to admit, a quick bit of maths show that Outlook gets over 95% of my spam. Gotta hand it to them.

Re:Outlook

[tacocat]

Bogofilter gets >99% of my spam.

dspam gets >99% of my spam.

What were you saying?

Re:Outlook

[drinkypoo]

I don't know, but it looks like you get more than 100% spam... over 198%. How did you manage that?

Re:Outlook

[tb3]

That seems only fair. According to a random sample of spam headers, Outlook Express has sent an average of 100% of the spam I've received.

Re:Outlook

[dgatwood]

Indeed. I actually have a filter rule that says that by default, any mail sent by Outlook goes to the spam filter.

Re:Outlook

[canuck57]

I'm no MS fan, but I have to admit, a quick bit of maths show that Outlook gets over 95% of my spam. Gotta hand it to them.

Outlook didn't stop a thing, some add on anti-spam package that didn't come from Microsoft got it.

Microsoft's view on spam is simple. They LIKE spam because it makes people buy more mail systems to scan them ever more aggressively. There is not money in simple approaches. Just the complex ones.

Re:It's that damn picture spam

[gvc]

Apparently, image spam beats a number of spam filters. But not all. Try another filter. I haven't done an extensive test in the post-image-spam era but OSBF-Lua is the best available filter I know of, and I haven't noticed that it is compromised by image spam. It is free.

Spike

[God of Lemmings]

Spam has had a tendency to spike around election time for one reason or another.
Not to mention this is the 4th quarter, when everyone and his cousin is trying to
sell holiday gifts. How about some data for the past 6 months?

Re:not for me

[tacocat]

Actually, 95% is pretty aweful. If you can't get to 99% then you are selling yourself short. The tools for identification of spam are very effective these days. 95% is junk.

White List.

[headkase]

Well I'd just switch to a white list of e-mail addresses and everything else be damned! Captcha based filtering for application to join my white list if I wanted it too.

Re:White List.

[DigiShaman]

I have two e-mail addresses.

One is my general "public" account. I throw this around when I need to sign up for something online, or if I will be expecting something soon from whom-ever I gave this address too. It automatically gets flushed once a week, so spam away...

My other address is based on a whitelist. My friends, family, and co-workers are on this list by default. If you are someone whome I know (and trust), I will manually add you into my accepted list.

I find the public vs private system works the best. It requires no form of filtering, and there is no work-around for spammers to use.

Re:White List.

[owlnation]

I own 3 domains, 2 have been created for a while, the 3rd is new. Since the middle of November, for the first two I have now moved to a whitelist. I use Thunderbird, but it has vast room for improvement in the way its filters work. It is far too time consuming to keep adding things to the filters, its hard to redesign new filters with the clunky TB interface, and I don't have the power I need, I can't repel attachments for example (at least as far as I know).

Despite this, I was winning up until November, but now I have surrendered. Spam has won.

For the 3rd domain, I didn't even set up any email addresses, I just set up Gmail accounts. Possibly this doesn't look as professional as it should, however, that's the way it's going to be from now on for me. I'm happy to have Google do the anti-spam work for me - successfully so far I may add.

I really wished I lived in Korea and could let the old folks send their email, while I did something more productive.

Congratulations to our new Spam overlords, they own us.

Why does 'Picture Spam' get through ?

[Anonymous Coward]

I don't know of ANY reputable person or business that uses pictures to send email. For some reason email filters (either product or service) let this stuff through.

Why ?

Re:Why does 'Picture Spam' get through ?

[Kelson]

It gets through for two reasons:

1. It's harder to extract useful data from an image than from text or a markup language like HTML. OCR is possible, but wasn't worth the effort until the volume jumped up recently.
2. Without that meaningful data, it looks a lot like messages that people forward each other. A picture sent from a cell phone, for instance, or the latest funny animation, or pictures from last week's party, or whatever. The filter is left with header info and not much else.

Filters aren't just acting on spam vs. business mail -- they're also acting on spam vs. personal mail.

Re:Why does 'Picture Spam' get through ?

[drinkypoo]

I don't know of ANY reputable person or business that uses pictures to send email.

Uh, practically everyone sends MIME mail with images when they send you an advert in your email - and I mean people you've done business with before.

I wish I knew why Thunderbird refuses to believe that bassproshops is a spammer.

Anyway the feature I want is to automatically deny anything written in a foreign language - since I don't read them anyway. As a bonus, leet speak may be misdetected as a foreign language (as opposed to a sign of brain damage) and I might not have to read any of that, either.

Re:Why does 'Picture Spam' get through ?

[binarybum]

are you kidding? My bank, credit card co., bill-pay service, and many other companies I deal with online and consider reputable use images in their email. I also use images embedded in my emails and receive emails from colleagues that also embed images. "Why use images in email?" say the purists, but that's like asking why use images on webpages - multimedia emails are often very obnoxious, but they can also be incredibly useful forms of communication. I simply can't imagine how one could not be receiving emails from individuals or companies with pictures when so many do use images. The answer is in better handling options for images (ie. require whitelisting for images or bayesian learning for automatic building of allowed/unallowed image sender lists) and perhaps in image recognition software.

Re:Why does 'Picture Spam' get through ?

[walt-sjc]

Interesting. I've received maybe 5 emails this past year (at a volume of around 500 / day legit mails) that have contained an image that I needed to see in order to understand the email. They were all screenshots showing a problem on some web site.

More frequently rich text is useful (tables), but it's still a pretty small percentage of the overall mail (less than 1% of what I get.)

A text based client for me works 100% of the time (since it can pop-open a firefox window with the HTML content of a message if needed, or an image viewer.)

Personally, I have no need for a GUI based mail client, and my need to support images / multi-media / html is VERY limited (less than 0.5% of my mail volume.)

Re:Why does 'Picture Spam' get through ?

[Dunbal]

I don't know of ANY reputable person or business that uses pictures to send email.

      As a physician I get and expect lots of pictures in my emails, from case photographs, to x-ray, CT, MRI and ultrasound images. I don't think you're quite right in what you said.

Re:Why does 'Picture Spam' get through ?

[amper]

As I mentioned in another comment, my primary mail system is Apple's Mail.app fortified with C-Command's SpamSieve, which uses Bayesian Filtering. Image spam simply doesn't get through. I haven't even trained it all that well. I've also been using Thunderbird, with its built-in Bayesian Filters, and SpanBayes on Outlook 2003. I have a bit less success filtering out the image spam, but then, those systems have little to no training at all. At least with SpamSieve, I made something of an effort. My corpus now has about 48K words, and I've only been using it for about six weeks.

See it grow on Gmail

[jmarkantes]

I haven't emptied my spam box on gmail for the heck of seeing how many spams are in the box in the last 30 days. For most of last year it hovered around 2000-2400. Then over a week it doubled. Right now there's 5700+ unread spams in the spam box.

Pretty crazy seeing the growth first hand. It's an interesting metric to have right there to see how bad things are getting. Plus, I'd say there's 2-6 spams in the inbox each day. I guess that's alright, wouldn't mind none though.
J

Re:See it grow on Gmail

[d'fim]

Last summer I took over admin of my company's catch-all mailbox. It was pretty steady at about 200/day until November, then it shot up to about 12,000/day for a few weeks, and now it's suddenly down to less than 100/day.

Re:See it grow on Gmail

[Kelson]

Oh, the spam folder! *Whew!* Since we're talking about spam, when I saw the phrase "See it grow," I was afraid for a second that it meant something else entirely!

Re:See it grow on Gmail

[Duncan3]

There are 187 in the spam box of a Gmail acct I have NEVER used. Amusing.

Who reads it?

[Kelson]

Is there anyone out there who seriously READs this garbage and actually considers sending money to these people?

The great irony of the spam arms race is that the better we get at filtering the spam, the more garbage the spammers send out just to get the same return. You can't stop filtering it, because the mail you want would be buried in a torrent of spam. But filtering more just raises the bar for the next round of spam.

Eventually it may get to the point where (a) email is unusable or (b) spammers have to send such a massive volume of cr@p that it no longer becomes a cheap business, and it ceases to be worth spamming. Until then, things will keep escalating.

Re:Who reads it?

[SQL Error]

Most spam is sent out using hijacked Windows PCs - zombie networks - and costs the spammers nothing. So they ain't gonna stop.

Having said that, the level of obfuscation they have to use even now makes their ads almost unreadable. You want me to 3nl@rg3 my what?

Re:Who reads it?

[Kelson]

Most spam is sent out using hijacked Windows PCs - zombie networks - and costs the spammers nothing.

Well, it doesn't cost them more in terms of bandwidth, but I understand there's a thriving black-market business in selling access to the botnets.

Having said that, the level of obfuscation they have to use even now makes their ads almost unreadable. You want me to 3nl@rg3 my what?

Yes, obfuscation, at least, seems to be one tactic they've embraced that ought to be self-defeating.

Re:Who reads it?

[mcrbids]

The great irony of the spam arms race is that the better we get at filtering the spam, the more garbage the spammers send out just to get the same return. You can't stop filtering it, because the mail you want would be buried in a torrent of spam. But filtering more just raises the bar for the next round of spam.

But that's not the case at all. Technologies other than filtering work well. In fact, I've stopped using filtering altogether simply because it doesn't work and is increasingly server-intensive.

Use some RBLs (such as SpamHaus, DUN, a few others) along with greylisting and you'll see a dramatic improvement with very little cost. Other things you can do include requiring strict adherence to the SMTP protocol, valid domains on to/from addresses, IP addresses with a reverse DNS, etc.

All these checks cost almost little to nothing on your server, yet are remarkably effective at stopping SPAM. If you're getting lots of SPAM, then either

1) Your ISP has a sysadmin that sucks, or

2) You're hosting it yourself, and you suck as a sysadmin.

Not much more to it than that.

Re:Who reads it?

[Kelson]

I was speaking of filtering in the general sense, not just content filtering. That includes RBLs, greylisting, etc.

To take RBLs as an example, the more IPs you block, the more spam they have to send out to get the same amount of stuff past the blocks.

Re:Who reads it?

[mcrbids]

You're still not on the money.

Spam won't just grow forever, just as the outlaws of the old west eventually saw the end of their reign.

In the broad sense, crime-fighting is a form of "filtering".

Eventually, we'll develop the appropriate techno-social mechanisms that will deal with this problem. It may not be until E-mail as we know it is dead - but I doubt it. Email is too important and too useful to truly die any time soon.

Re:Who reads it?

[OriginalArlen]

If Microsoft are to be believed, Vista and TPM (aka Untrustworthy Computing) will start reducing the size of the pool of potential botnet zombies. I don't think they are to be believed... idiots will always be out there thinking "Hey, a cool screensaver, I'll install that". Either MS removes their ability to install executables, or the spam problem continues growing.

Re:Who reads it?

[sbaker]

The nasty thing about the image-based spam is that it capitalises on the fact that our eyes and brains are very very good indeed at spotting patterns in noise. This allows them to obfuscate their text message to the point where image recognition approaches to rejecting it are doomed.

They are doing what we planned to do - we wanted to somehow make sending each message computationally expensive so they couldn't send as many. In fact what's happened is that the computational cost of filtering has now become so extreme that we can't really consider doing it.

Worse still, if we put in the effort to make really good text recognition that can detect the spam and discard it - the bad guys can use that exact same software to break capcha's.

It's really depressing.

Stopping the morons who reply to these adverts has to be our best line of attack. I'm not sure how we should do that - but getting some publicity out there would help. We need government-funded TV ads telling people that THERE ARE NO PILLS THAT'LL MAKE YOU DICK BIGGER. NOBODY EVER, EVER WANTS YOU TO TRANSFER 5 MILLION DOLLARS FOR THEM. ABSOLUTELY NO GOOD STOCK TIPS ARE EVER GIVEN AWAY FOR FREE VIA EMAIL.

It's going to be tough.

Re:Who reads it?

[yog]

Yes, I actually know someone who opens spam and even has spent money on it. She (sorry ladies but it's a she) signed on to this legal advice service for $19/month and hasn't yet used it at all, even after several months. When I advised her to NEVER open unsolicited email but delete it instead, she said "But some of it's interesting!"

Never underestimate the stupidity of the average nontechnical person. They may be too well trained to be scammed in a retail store, but put them in front of a computer and they completely suspend all their inhibitions and common sense.

As long as money--big money--is to be made, this problem will persist. The only solution is to take away the financial benefits. It would also help to get rid of all those damn compromised Windows boxes, maybe replace the crappy OS with Vista or Linux, but that's going to take years.

I'm almost thinking we should create a second internet, for those who pay a certain fee and can prove their client machines are not compromised. If your machine passes muster, you can join. Linux/Mac clients will be preferred.

Eventually, it will be the nightmare so many politicians have ranted about--the Digital Divide come true. The haves and have nots. The haves with a nice clean safe system where you can publish your email address fearlessly like back in the '80s, and the have-nots down there in the gutter with muggers and rapists in every alleyway.

I use a different approach.

[khasim]

#1. Aggressively whitelist - since I have the records of all the email received I can just send my users a list of all the email addresses that have sent mail to them and they can pick out the legitimate addresses.

#2. Block email during SMTP transmission - this is where the whitelists and blacklists come in. Everything else gets greylisted. I also use fake addresses to create my own blacklists.

If something is rejected, my phone number is included on the rejection notice. A person will see it and can call.

#3. Monitor the reject logs to see any names that may be useful (legit and fake). You'd be amazed at how many times the spammer's software trashes an address in a unique enough way that you can use it as a spam trap.

#4. Use anti-virus on anything that makes it this far.

#5. Use SpamAssassin on anything that makes it this far that is not on a whitelist.

These practices won't help so much with a personal account. But they've cut almost eliminated the spam where I work. But we don't sell over the Internet. 90%+ of our email is with the same people at the same mail servers and the same IP addresses every day.

Re:I use a different approach.

[whoever57]

If something is rejected, my phone number is included on the rejection notice. A person will see it and can call.

I don't know why it is, but I have found that many quite intelligent people are utterly incapable of reading rejection notices.

Re:I use a different approach.

[Nogami_Saeko]

I'm running my own mail server and using a system I read about which delays the initial SMTP "HELO" for 20-30 seconds before acknowledging the incoming connection.

If someone is sending spam, they're not going to wait that long before starting a new connection (it would slow them down something fierce, to maybe only sending 1 or 2 emails a minute).

This catches about 75% or more of the spam coming in - anything left is mopped-up by either spam assassin at the mail server level, or POPFile before my email client.

Sort of a 3-tiered approach. Very little (maybe 1 or 2) spams per-week get through.

N.

Re:I use a different approach.

[walt-sjc]

Some MUA's / MTA's don't pass on rejection data (5xx level messages) to the user. A certain company in Redmond puts out software that does that...

Re:I use a different approach.

[thogard]

The delay won't help if they already sent the entire data. I wrote a patch to log the size of the rest of the data in the TCP buffer for sendmail a long time ago and that was a great way to locate the high speed spam senders.
Another trick is change the hello message to be more than one line but that breaks some major mailers.

Re:I use a different approach.

[secolactico]

The delay won't help if they already sent the entire data

Exim lets you disallow pipelining, and any peer that tries it without it being advertised to them gets dropped.

Re:I use a different approach.

[thogard]

If there is any data in the que when the helo line is processed, the message can be discarded. RFC pipelining happens after the server claims it can do it. Turning off pipelineing will only slow down some mailing lists

Re:I use a different approach.

[Anonymous Brave Guy]

I'm not incapable of reading them; I just choose not to. Given that the vast majority of rejection notices I receive are caused by some spammer sending mail forging an address I use as the sender, and not in response to anything I actually sent myself, is it really any surprise that I delete them unread unless I recently sent a genuinely important mail?

Re:I use a different approach.

[MoogMan]

it would slow them down something fierce, to maybe only sending 1 or 2 emails a minute

I can't personally see this happening. Some basic threading would enable parallelised mailing.

Filled corporate Internet pipe

[AaronW]

Spam has become such a problem where I work that it has completely flooded the corporate Internet connection. I personally feel they should host an external mail server and spam filter off-site someplace. For my personal server I use various RBLs and country blacklists, like blocking all of China, Korea, Russia, Nigeria and a few other countries. Those seem to block most of the spam from even entering my mail server.

I know people talk about legal solutions not working, but I think if law enforcement made use of existing laws and went after these people it might make a difference. I'd love to see the FTC go after the pump and dump spammers and confiscate everything they own before locking them up, or the food and drug administration go after all the enhancement pill spammers. Also, perhaps a law to fine idiots who buy from these spammers.

Just change the federal law to let some of the state laws take effect, i.e. defeat the Can-spam act.

I think if law enforcement made a good effort to go after these spammers and lock them up then it might make a difference.

-Aaron

Re:Filled corporate Internet pipe

[xra]

You should add the United States to your list. According to wikipedia http://en.wikipedia.org/wiki/E-mail_spam#Origin_of _spam/, it is the first source of Spam.

Re:Filled corporate Internet pipe

[AaronW]

In my case I was getting not only spam, but constant probes and attacks coming out of China, repeatedly from known problem IP addresses so I shut them off at the firewall. A few months back, at least half of my spam could be traced to China. Since I do not know anybody in that part of the world, I have no problem just blocking it. For personal use, I see no problem blocking email geographically. Since I don't know anyone in Nigeria, Malaysia or Russia, I might as well just block it off.

About half of the spam is blocked by country before even hitting the other RBLs. I don't know anyone in Russia, Nigeria, China, Argentina, Malaysia, Thailand, China or Korea so I just block them. In the past most of my spam came from China, as well as most of the attacks on my firewall, so I just blocked the whole country.

While most of the spammers are likely in the US, most of the machines trying to send me spam appear to be outside the US.

In the time I've written this, my logs show spam being blocked from Argentina, Korea, Malaysia and China, as well as one from Great Briton, three from the US and one from Germany.

The amount from China appears to be less, but then it's hard to tell because I blocked off the worst offending subnets at my firewall.

-Aaron

Re:Filled corporate Internet pipe

[dbIII]

The USA situation - what if most of your business is with China and your Church is run out of Nigeria?

Blocking by country is silly - most of my spam comes from IP addresses in the USA. And no folks - I am not an American and don't belong to the homophobic Church that decided it was better off being run by a bishop of Nigeria that doesn't even live where he is supposed to work. I just thought that was a good example. The company I work for does have clients in China, Nigeria and Russia so blocking those countries would be a disaster.

Perhaps the answer is education - teach everyone in America that their genitals are big enough and that mail order drugs may not be the real thing.

Re:Filled corporate Internet pipe

[ObsessiveMathsFreak]

Also, perhaps a law to fine idiots who buy from these spammers.

Of course. This should have been done by default. We fine people for possession of illegal drugs or stolen goods. Why shouldn't we fine people who buy from spammers? They're feeding a beast that is crippling out internet society!! Think of the digital children!!!!

Re:Filled corporate Internet pipe

[tancque]

I was almost tempted to do just that but I found another way to stop USA targeted spam.

Our company is based in the Netherlands. I use a spamassassinrule to give a high score to mail coming from .com domains, which are not much used here for eMail. And it is 1 of the most triggered rules in preventing spam. We hardly get any spam trough this way. It even helps blocking the gif/jpg stock-shit.

Tancque(.nl)

Bandwidth

[tef]

If for example each spam message was around 1k of info, that's on average 63 tera bytes of info! Using the new Seimans 107gb speed record connection, that would take almost 10 minutes to transfer all that spam! I just wonder how much faster the internet would be without spam.

Re:Bandwidth

[Shados]

I was about to post the same thing. Honestly, it is time email gets banned from the net altogether or something. All these problems come from an obsolete protocole that was created in the days before we realised just how the internet would be abused. As useful as email can be, it has to be replaced, even if its by something less useful. All that spam is definately slowing down the internet.

Yeah, spammers will just move to the next thing...but we have to work our way up. Email is slowly becoming useless now... so it won't be a big loss.

Re:Bandwidth

[AaronW]

My Internet access at work would go a *lot* faster. Spam has managed to fill the entire 8Mbps pipe, completely saturating the link, 24 hours a day. It's not a very large company either.

-Aaron

Re:Bandwidth

[Dunbal]

I don't know about YOUR spam, but I just looked at my mailbox. You're off by a factor of about 20 as far as size is concerned. My average size for spam is around 20kb (out of 30 spam messages in my bulk mailbox). Now let's say we pretend that the entire internet is running at 107Gbs - which is not true, this was an experimental situation - we're talking 1260 Tb. Assuming your calculation is correct this would take 200 minutes, not 10 minutes. There are 1440 minutes in a day, so 200/1440 = 14% of the day is spent sending spam. And remember we're running everything at a theoretical speed of 107Gbs. That's a fair chunk!

Re:It's that damn picture spam

[tacocat]

This looks interesting but it's in a really obscure language. WTF is Lua and why didn't anyone have the foresight to make this into a simpler to use module?

If this was simply written in C you could at least use it in C or port libraries to other languages

Re:It's that damn picture spam

[homer_ca]

Yeah, pretty sneaky. The message is non-spammy text with a spam message in an embedded picture. I block images by default, though, so I all see if a broken image icon.

Re:It's that damn picture spam

[gvc]

I think Lua's pretty easy to download & install, but if you want a good filter written in C, try Bogofilter.

Victory Conditions

[Doc Ruby]

And that's why the US Treasury announced a surplus, from all the fines collected from all that spam violating the CAN-SPAM Act. We're funding free WiFi for every American, while exterminating all the spammers!

Re:Don't be hasty!

[vertinox]

He's got 9 days left!

Maybe we might just need an alternative...

[Jugalator]

I know there's instant messaging, but I think the way of messaging by e-mail also has its place. Maybe it's time for a standardizing organization to pick up on this with a new "e-mail"-like standard and try get it backed by a lot of software company software. It could be with e.g. HTML, can it be done again, or do the current companies carry too big egos, only believing in their own solutions? There was some hope with both Google and Yahoo using the Domain Keys initiative, but since it's so little supported pretty much everywhere else, it's still a completely useless standard like so many others. :-(

Re:Maybe we might just need an alternative...

[AndySilva]

Check EmailXT (http://www.emailxt.com/).

(I have replied to another poster below, but here it goes again on a different perspective)

It is a new standard proposal from an independent group. No corporate obscure agendas here.

And it is not vaporware: There is already a bare-bones prototype demonstrating the concept. The beauty of the concept IMHO is that it is compatible with the current MTA infrastructure so you can just install the EmailXT client and start using it right away, even with your current spam-stuffed email address.

Two persons are enough to make EmailXT usable. No "chicken and egg" problem here. Just pick a friend and test it together. As more people and their networks join together, old email phases out; spam buyers will be forced to switch to the spam-free EmailXT system; spammers money dries out and mass spamming activity stops; mail server congestions end and maintenance costs goes down; peace of mind returns...

I know, I know. A very pretty scenario but certainly achievable through EmailXT.

My 0.02c.

Geographic filter is great

[caller9]

If you don't do business outside the US, filtering by geographic registration for the subnet works wonders. A little hard to set up but once you use the geographically filtered email to train your Bayesian filter, you really get 99.9% or better. Currently getting approx 99.97% accuracy and very little false positives. Pleased as punch.

Re:Geographic filter is great

[AaronW]

Several years ago I found a RBL that works by country. For example, I use cn-kr.blackholes.us which effectively blocks all of China and Korea.
Also, the following code will grab all the subnets by country, this example grabs them for China:

#!/usr/bin/perl
$ctry = shift || 'cn';
$_ = `wget -O - http://www.apnic.net/apnic-bin/ipv4-by-country.pl? country=$ctry`;
print join "\n", /([0-9\.]+\/[0-9]+)/g;

Re:Geographic filter is great

[RealGrouchy]

What about your idiot friends who use obscure foreign e-mail providers?

(Assuming the obvious answer to this question from the above use of the word "idiot")

- RG>

Re:Geographic filter is great

[smash]

Fuck 'em :D If they're really good friends and they need to contact you, and they're incapable of getting a legitimate email account, they can use the telephone.

Thanks, A-holes.

[Beefslaya]

That's an underestimate.

You have to wonder what drives these idiots sending so much junk?

Re:Thanks, A-holes.

[phillymjs]

The thought of the idiots who receive the junk and buy the crap advertised in it.

~Philly

Re:not for me

[Anonymous Coward]

not really, not since spammers wised up on the spam blockers and have been using embedded images. 99% maybe six months ago or so, but now I'd say 95% isn't bad at all.

Yeah there is a lot, but it is easier to see

[rogerborn]

I frequently get spam with these kinds of headers, changing slightly every few days -

Irvin Zimmerman Irvin wrote:
Vonda Hoskins Vonda wrote:

Donald Key Me again Key
Kimberly Slater Me again Slater

Marianne Whitney Marianne
Marlon Wilkinson Marlon

Lizzie Longoria it me Lizzie
Odis Lund it me Odis

Ismael Waters Waters message
Russel Huggins Huggins message

. . . you get the idea. there is so much of it that the pattern on your mail app stands right out.

where do these spammers get off thinking nobody would see through their tactics?

regards,
"sorry. no refunds"

Re:Yeah there is a lot, but it is easier to see

[Ucklak]

Part of it is to junk your spam filter if you mark it as spam.

The generic Thunderbird spam/junk filter is useless on these.

Re:Or server admins could just do their jobs.

[Anonymous Coward]

With a little effort, it's possible to prevent over 98% of all spam a server gets from ever reaching a user's inbox. And that's with absolutely no false positives. Many of these systems are self-learning, so they get better with time, and with the more mail they filter.

Spoken like someone who hasn't tried to maintain spam filters for a large number of users.

Re:It's that damn picture spam

[gvc]

WTF is Lua and why didn't anyone have the foresight to make this into a simpler to use module?

I daresay that Fidelis Assis -- the author -- wanted to spend his time as effectively as he could building the best spam filter he was able. I can't say that he made the wrong choice as his filter is outstanding. He did take the trouble to make it an available open-source project, which allows anybody to repackage it as they see fit.

Scum

[skinfitz]

Spammers are scum. Introduce the death penalty for them - I'll gladly throw the switch, however I would argue a new extra painful method of execution should be devised just for them.

Re:Scum

[Mogster]

new extra painful method of execution should be devised just for them. Just make them use the products they're hyping.. Make em use their penis enlargement pills, breast enhancement creams and hair tonic formulas while buying up endless stocks using money inherited from their rich second cousin's uncle-in-law from Nigeria.

Re:Scum

[oni]

Spammers are scum.

That's like saying spiders are scum. Spiders exist because there are flies. Spiders and spammers fill an ecological niche. Spammers send spam because there exist in the world, legions of brainless, drooling, morons who will get an email for V1g4a and think to themselves, "duh, eye wood really lieke to geet medercine from some a-non-a-moose email, har har."

Those are the people who should die. We should be setting up honeypots to catch them. The government should be sending spam and then executing the people who respond to it. We need some kind of natural selection to weed these people out of the gene pool. It's really bad for our species.

I mean seriously, WHAT THE FUCK are these idiots thinking?

Re:Scum

[skinfitz]

I like the cut of your jib.

It's not worth worrying about spam

[banerjek]

Although there are many very effective antispam techniques, some common methods are worse than the problem they are attempting to solve.

Content filters are code that effectively say "I know spam when I see it." Given that people can't say exactly what spam is, why would they trust code written by humans to do the same. Likewise, blacklists are dangerous. We have a mail list machine that hosts hundreds of thousands of subscribers. A lot of people classify any email they don't want as spam, so we occasionally get blacklisted, because a handful of people weren't expecting something (though many ISP's have whitelisted us).

We deal constantly with people who lose email because they set antispam measures as paranoid as possible (alternatively, their mail admins do this for them without their knowledge). This inevitably intercepts a certain amount of legitimate email. Then they get upset because they presume email is 100% reliable and mission critical communications are getting lost.

Only accepting mail from trusted senders is hopeless unless you already know everyone you need to communicate with. Frankly, anyone who knows everyone who needs to be in touch lives in a pretty closed world......

Re:A correlation with Vista?

[Achromatic1978]

Only on /.

I notice you didn't consider updates to various MTAs in various distros as a possible vector. There may well be flaws in Vista (which isn't completely new code, btw), but to say that there's (potentially) a huge exploit, which is widely distributed (to so many spammers) but yet has gone completely unnoticed seems exceptionally unlikely.

Or you were just trolling.

what for??

[nunodonato]

someone enlighten me please!
i dont understand why there is so much spam! 90% of the spam i get, EVEN IF I WANTED TO READ IT, i dont understand it!! its just full of crappy stories, spelling mistakes and stupid stuff....
WHAT FOR??

is someone on the other side just getting pleasure in annoying people all over the world? (seems like a bofh story, or dilbert strip)

Re:what for??

[KillerBob]

Just pulling numbers out of my ass... but let's say that one in a million people is dumb enough to fall for the crap they're trying to sell, and actually falls for what they're doing. Let's say it's your typical buy/dump scheme where they buy up, say, 50,000 shares of some penny stock. Net cost to them, $500 for the stock, and, let's be really generous and say $100 to send a million e-mails. Realistically, it doesn't cost them nearly that much to do it, but that's beside the point....

The idea is that they'll create a run on the penny stock. Create some demand on a stock that's worth $0.01 a share, even a little, and it might go up to $0.02/share. Not a significant jump, except when you consider that they could have $50,000 invested in the company already. That run would turn into $50,000 profit overnight. And that's assuming a relatively small one in a million people being dumb enough to fall for it. People in general are a hell of a lot stupider than that.

And here's the rub... it's not illegal to create a run on your stock like that. It's not fraud, it's not stock manipulating, it's not deceptive marketing. The company whose stock is being traded usually has absolutely nothing to do with the scheme. And thanks to overly relaxed laws in countries like China and the USA when it comes to bulk e-mailing, it's not illegal to send the spam. They word it in such a way that it looks, to an idiot, like they've received an e-mail they aren't supposed to have received, talking about some sure-fire hot stock, and enough people will fall for it that you're able to turn a profit.

Spam in general is like that. They don't care that 99.999% of the messages they send out get ignored. They care that 0.001% arrive in the inboxes of the criminally stupid.

Bayesian Filters, and work on MTAs

[amper]

I'm not so sure what everyone is complaining about. I'm using SpamSieve as a plug in to Mail.app, and it catches just about everything without much in the way of training. Currently, my statistics as of 2006-11-01 say it's 97.1% accurate (with 71% of my total mail volume being spam, but that includes some legitimate marketing mail that I no longer really want, and I'm too lazy to track down the list maintainers), and that number gets higher every day.

On Windows, I'm using either Mozilla Thunderbird (usually), or SpamBayes as a plug-in to Outlook 2003 (when I have to), and I get similar results.

Of course, what we really need to do is rethink the way that the whole email system is designed, just in terms of MTAs that work separately from MDAs, etc. This kind of filtering really needs to take place at what we currently call the MTA level, with a configurable corpus for each user. The filtering should be done before the mail is permanently accepted, so that the impact on storage resources is as minimal as possible. Granted, it still takes a lot of processing power.

Another thing I need to spend some time thinking about is how RFC822 messages are structured in general. I'm just pulling this out of my ass right now, but the fact is that message envelopes are much to easy to spoof. Why have a separate message envelope to route the mail when the addressing information is already supposed to be contained in the headers? With the way spam is going, the message needs to be processed in its entirety in any case, so perhaps the envelope has outlived its usefulness?

It's called a surge

[Ranger]

I'm sure that it'll go back down to normal levels real soon now. Why heck, it may even withdraw from the Internets.

--
My God! It's full of tubes!

Re:It's called a surge

[anaesthetica]

Yes, it's clear that the spam phenomenon is in its last throes.

I noticed that too, on top of the gradual one...

[buserror]

In october and november the volumes have rocketed. There was a weekend alone where I saw over 80000 messages being trashed. At some point procmail was too slow to digest the message as they arrived and I had to install a hook to "help".

Here are my monthly stats for over the last year on my own personal domain, that has the unfortunate privilege to be in every blasted spam file ever.. These are pre-rejected spams, some still pass to the "next level"...

http://oomz.net/spam-monthly.png

Re:A correlation with Vista?

[Kelson]

The only association I've seen so far between Vista and spam is an insane number of messages offering "discount" copies of the OS.

Re:A correlation with Vista?

[afaik_ianal]

Wow... Yeah, umm, wow.... What more can one say?

Anti-MS zealot: "The increase in spam is caused by Vista".
MS Fanboy: "Don't be silly - it was obviously the 2.6.18 kernel release that did it".
IT Professional: STFU, both of you.

Re:It's that damn picture spam

[Conception]

Fuzzy OCR for Spam Assassin. It does a pretty great job on it.

Re:Or server admins could just do their jobs.

[Anonymous Coward]

The spammers are 'self-learning' as well. Spam blocking has the same effect on spam as antibiotics have had on bacteria. Only the spammers who know how to get around the blocking software survive--but they soon multiply. Since everyone has some sort of spam blocker today it is sort of futile. Until we write and enforce laws against spam this problem will only get worse. I'm not saying we ban spam. I suggest something like a nationwide do not email list. Anyone who violates that can be subject to nuclear bombardment.

Your p3n!5, of course

[Anonymous Coward]

nt

Re:email2

[dgatwood]

No need. As I've been saying for several years, only servers really need to have a cert. If every server had a cert and no messages from machines without a cert were accepted, spammers would have to have a cert or would have to send through normal channels through people's ISPs.If they get a cert, you know who and where they are and you can arrest them.

If they don't get a cert and their spam bots go through people's ISPs, you can set up an automated "this is spam" reply mechanism that would stop the spam bots at the source much faster than existing measures, thus making the amount of effort needed to maintain zombie botnets orders of magnitude greater because they'd be going offline after sending a much smaller number of messages and would be affected by email message rate throttling at the ISPs.

Either way, spam becomes much, much harder....

They hide from OCR, so why not detect that?

[a16]

The image spam is the one thing that gets through my (and gmails) spam filtering. I know people are working on OCR solutions, but spammers are already actively avoiding this with all the random dots and lines you see over their stock spam images.

So what I'm wondering, and I'd be interested if anyone on Slashdot knows about or is working on this - surely it wouldn't be too hard to detect the presence of these anti-OCR techniques? The standard way seems to be putting extra lines and edges, and a spotty background to throw OCR recognition off - why not look for those signs in an image, and add to the "Spam" score if this is present?

Re:They hide from OCR, so why not detect that?

[dkf]

It would be easier to just assign a high spamminess score (or maybe a spamminess multiplier?) to anything that includes an attached image.

Re:They hide from OCR, so why not detect that?

[Dr.Ruud]

procmail to the rescue:

    procmail code by Dr.Ruud
    -> procmailrc.anti-gifspam, or
    -> procmailrc.anti-gifspam.mini

they sure did

[zakeria]

I got my first ever spam today in 12 years!!!

1 filter, 99% of spam gone.

[Duncan3]

Content-Type contains "multipart"
or Content-Type contains "text/html"
and not in address book.

What those don't catch, along with a couple filters for non-english, Thunderbirds filters do. Haven't had a false positive yet. It gets all that image spam, and before that, it caught all that HTML. That same logic working in Mail.app.

Re:1 filter, 99% of spam gone.

[Dachannien]

This is what I did as well, and I'm very happy with the results. I've been sanitizing most HTML tags (including IMG) out of my e-mails for years now, but a nonzero number of spams that contained IMG tags were still making it through to my inbox (they'd be blank or have nonsense text unrelated to the spam, but I'd still have to deal with them).

Unfortunately, it won't work for people who need to accept e-mail from unknown non-tech-savvy parties, since when people use those fancy-schmancy editors that put in things like stationery backgrounds or letterhead images, they may be sending a legit e-mail with (unnecessary) attachments.

Re:1 filter, 99% of spam gone.

[JakartaDean]

I find Thunderbird does a good job at all the spam I get -- prolly get 2 or three through out of a hundred or so, which is acceptable for me. I did have to lower the spam detection threshold to 75, and after that everything works fine for me.

Re:1 filter, 99% of spam gone.

[dargaud]

Hmmm, everyone sends html mail now (except me), so I fail to see how that would help. As for the 'not in address book' part, a lot of businesses need to receive messages from strangers (although using a web form can solve that).

Re:1 filter, 99% of spam gone.

[crabpeople]

Thunderbirds spam filter is ass. WAY too many false positives. For instance, everyone that responds to your craigslist ad will be flagged as spam. That was a fun thing to find out after weeks of use.

Anyone can use gmail's anti-spam too!

[a16]

Something worth pointing out to people who don't want to use gmail, is that you can use gmail as an enterprise grade anti-spam filter for your personal inbox.

Simply forward all of your mail on to gmail, and then either collect it from gmail using POP3, or set gmail to forward it back to a "clean" account on your server that you can pick mail up on. You can set gmail to delete the mail after it forwards it, so you essentially get one of the best anti-spam filters out there, for free.

Of course, what is annoying me is all of the penny stock image spam that gets through most spam filters. It's getting to the point where I really am considering stripping image attachments from messages. See this post further down for a bit more on my thoughts on image spam.

Re:Anyone can use gmail's anti-spam too!

[gknoy]

Can you REALLY trust GMail to Really Truly Delete the contents of your mail? I don't.

Re:Anyone can use gmail's anti-spam too!

[Scott7477]

I have had good results doing exactly what you suggest for my personal email. I find that Gmail does keep 99.5% of the junk out of my Mozilla Thunderbird inbox. My work email, on the other hand, comes directly from an ISP and they seem to be failing at identifying some of the recent spam iterations like penny stock touts.

Re:Anyone can use gmail's anti-spam too!

[M1000]

Why not ? You think your email didn't travel in plaintext across the internet to reach you ?

Re:Anyone can use gmail's anti-spam too!

[Arancaytar]

Indeed, Gmail's filter is the best I've seen.

I got around 100 spam messages a day before (it jumped to about 200 a day in the past month), and less than one a day arrived at my inbox. My Gmail address is the only one I don't obfuscate anywhere, for this reason.

My only worry is that in the hundreds of spam messages, there could a false positive - but the number of times this has happened so far can be counted on one hand, so it's not much of a bother. Just a cursory check through the subjects in the spam folder, and then I flush it all down.

Re:Anyone can use gmail's anti-spam too!

[crabpeople]

Yes, but id rather not have it all centerally located on a CIA server farm with all my browsing habbits and search queries easily cross referenceable.

Re:Anyone can use gmail's anti-spam too!

[PurifyYourMind]

Their false positive rate is exceptionally low. On my account that I've had since January or so, I've had maybe two false positives, and I believe both of those were auto messages from sites I'd just registered with... the kind of thing one should have a junk yahoo/hotmail/whatever account for anyway.

use Postgrey (works for me)

[keeboo]

We use Postgrey to filter the spams out.
It works wonderfully even without additional filtering (blacklists, for example.. Which we do still use, though).

Postgrey is a grey-list system por Postfix (for a description on how it works, click here), and there are probably other good greylist filters around.

We've had (like everyone else has) massive amounts of spam going through Spamassassin, our server was down its knees all the time.
Now the machine is typically 95-98 percent idle and the spams we receive (remember I've said we use blacklists aswell) is only the ones which come from our intranet (from hijacked machines we quickly disable when discovered).
That tool saved the day.

Eventually those bastards will have a way around it, but for now it works very well.

Re:use Postgrey (works for me)

[__aalwyc6372]

i use this too. spams reduced from 10/day to 1/month.

Re:use Postgrey (works for me)

[stu42j]

Some spam/phish do get through the greylisting. They don't have to queue, just send to everyone twice. It does still help a lot, though. I only greylist dynamic looking hosts based on rdns to avoid delays of legit mail and that seems to work quite well.

Re:Don't be hasty!

[Sponge Bath]

He's got 9 days left!

Nine days ought to be enough for anybody.

Statistical spam filter

[gvc]

I suggest that you use a statistical spam filter instead. Training its (few) errors is all-in-all less work and more effective than composing ad hoc rules. Even if you use Spamassassin, just turn the Bayes way up and forget the ad hoc rules. But there are better statistical filters. OSBF-Lua is the best (at least the best available) and Bogofilter is also very good, and more mature.

Here's a suggestion

[dmsuperman]

This is a really easy one. Get 2 email addresses. Make one private, and only give it to people you actually need to be in contact with, and make one public. Use it for posting, signing up, one for everyone else to email you, what not. Use GMail for said public address, and now your SPAM is almost completely redirected to a GMail spam box. Problem solved. It's what I do, I haven't gotten a junk mail in my Thunderbird's junk mail folder in weeks. And I use my public email address all over the place.

Re:Here's a suggestion

[kaatochacha]

which works until you have some "trusted" person with your address gets a virus, or they use it to send you some email that they've forwarded to umpteen million people that you DON'T trust, or at some point your critical address just plain gets out in the wild.

Re:Here's a suggestion

[teutonic_leech]

Yeah, I tried that and all was well for over six months. Then some idiot used one of those 'send page link to friend' links some site and they day after my spam started increasing steadily. Could have killed that guy for doing that. Moral of the story: it only takes one clueless idiot to flush a perfectly good email address down the toilet.

Re:Here's a suggestion

[dmsuperman]

You could also just use 10minutemail.com to get a disposable email address to sign up for things, another quick n dirty solution.

Re:not for me

[KillerBob]

I get an average of 1 untagged spam in my inbox every couple of days. The systems I'm using to block the spam are trapping an average of about 5,000 spams a week that's actually addressed to me personally. Exactly one of those messages has been image spam in the last month.

Those systems are:
milter-greylist
SpamAssassin
SpamHaus and other DNS Blacklists

That's it. Just those three systems in place, and I'm trapping better than 99% of the spam that's getting sent to me. That's with out-of-the-box configurations on milter-greylist, and an SA sensitivity of 2.0. Most of it doesn't even reach my server, as my mailserver is refusing connections from anything in the blacklist, and is only accepting the "RCPT TO" line of any message that doesn't come from a whitelisted server. I could probably cut the amount of spam significantly if I changed the greylist error time to something like 4 hours instead of half an hour, but that would come at the cost of usability: I can't be waiting half a day for an e-mail from somebody I've never heard from before. Maybe on personal e-mail, but it's simply not feasible for business purposes.

I'd still say that 95% is utter crap. You should be able to trap a lot more than that, if your sysadmin knows what he/she is doing.

Easy Spam Filter For Newbies..

[sc0p3]

I couldnt be bothered setting up SpamAssassin on my server so just forwarded all 100+ emails a day to Gmail where it filters. It was a fast, 0-effort, way to get effective spam prevention. Plus with 2.7gb I dont think I'll run out of legit space anytime soon.

Fallacy: automation can't better human

[gvc]

The assertion that a program must make as many mistakes as the human that programmed it is preposterous. I daresay I can write a program that computes a million sums and it'll get more of them right than your average human.

Content-based spam filters can be much more accurate than humans. In particular, they can have lower false positive rates. That is, a good spam filter is less likely to discard good email than a human is to overlook good email in a sea of spam.

I'm not exactly sure how the article supports the title "It's not worth worrying about spam." Does this mean you freely distribute your email address, and you simply sort through all your messages by hand, and you've never overlooked a good email, and you have some way of knowing whether or not this is the case?

If you want to test your own ability to separate spam from good email, visit www.spamorham.org

Thunderbird Gets 90%

[Clete2]

I use Thunderbird and after about a month of training the filters, it gets about 90% of my spam. The only thing is that if someone who hasn't e-mailed me before e-mails me, it goes to spam. :( It seems to be so strict that it only trusts people I e-mail. At least it figured out which e-mails are REALLY from eBay, PayPal, and Bank of America and which ones aren't. I've learned not to click any links from e-mail but to go straight to the address. Still, I check every single spam message I receive (400 a day or so), just to make sure. It's such a pain. If I ever get my hands on someone who writes the trojans that do all this, I'm going to have to beat their face into a pulp. It's caused me way too much trouble.

Re:MOD DOWN

[gvc]

Parent does not understand grandparent. The Google ad points to a stock market manipulator, not PHYA.

Re:MOD DOWN

[Omnifarious]

It's not actually pump-and-dump in this case. It's using social engineering to trick people into looking at an ad they might otherwise not see. I'm sure the Google adword price for PHYA was very low.

Re:zo'o cai...dumbasses

[Archangel Michael]

Your right!

I just passed that through Perl and wouldn't you believe it, it created a word processing program. Damn your good.

Re:Or server admins could just do their jobs.

[thogard]

Maybe the best solution is to stop filtering at all for a bit. Let everyone know just how bad the problem is. This was a technique used in the Usenet community every once in a while to let more people know just how much work is being done behind the scenes.

I propose that we turn off all RBLs and filters for 24 hrs the day before congress sits for the 1st time in the new year.

Spam is just the symptom...

[TropicalCoder]

The real disease is: those vast botnets. Really, it's a scary thought. We are lucky that they only being used for spam and the usual phishing scams and the like - as far as we know! Imagine if the terrorists buy themselves some botnets for some nefarious purpose, or the Chinese or North Korea government corner the market on them to run millions of bots to steal corporate secrets or IDs or who knows what? What I'm saying here is that the large increase in spam should be triggering off alarm bells everywhere. The spam is not the problem - it's the botnets. Why in the world don't responsible world governments unite to put a swift end to this problem? Really - it could be dealt with swiftly and effectively in a hundred different ways that I will up to the imagination of the reader. I am just astonished this hasn't happened. I mean - couldn't our friend and champion of democracy George W. include this in his initiative against terrorism? He would probably have more luck tackling this problem then he is having in Iraq. What if he put that on his agenda - and set loose all his military might along with the help of some coalition of the willing? Perhaps he could salvage what's left of his image? Are you listening Mister Bush?

http://www.magma.ca/~gtaylor/AudioTestFileGen.htm

Re:Spam is just the symptom...

[iangoldby]

I'd like to know how to report a botnet. I've been to ShadowServer but (a) you have to register to report and (b) they only seem to be interested in the Command-and-Control servers.

I have a list of IP addresses and times of attempts to exploit a mail form with a mail injection attack. It seems to me that the owners of most bot machines would be completely unaware of what is happening, and therefore might even be grateful to be told that there is a problem.

But we need an automated system for submitting IP addresses (and time and date of attack in case it is a dynamic IP address so that it can still be traced to an individual computer). The system would look up who is responsible for the network containing that IP address and ultimately send an email to the best-placed person to get the computer cleaned up.

(Yes, I do know about WHOIS.)

Re:Spam is just the symptom...

[AaronLawrence]

Yes, just recently it occurred to me that spammers effectively have access to a bunch of supercomputers. Would be a great way to crack difficult encryption...

Re:MOD DOWN

[VENONA]

Bummer. That means I would have to hit it with a script instead of a mouse to cause them any pain. That would be really hard to do.

I'd have to wget or curl http://www.stockmarketenews.com/s/PHYA.html?gclid= CMeN9bSEpYkCFQdZYQodZiTxOA. I'd have to sleep for a few, possibly random, seconds. Then I'd have to rinse and repeat. Until I walked into the office tomorrow morning, and hit CRTL-C. If a few (hundred) people were to do that, for a few days, it might cost them some serious money.

But that would be evil. I'd better not do that.

Home server under Debian

[DimGeo]

I was thinking of using some light side tech (hey, I can't turn to the dark side completely in just 3 months, right?) and setting up a home server with Debian/Sendmail using the guidelines of fighting spam (graylisting and others) laid out at acme dot com. Does anybody know if those work well outside acme? I mean, they obviously do work, but has anyone have any experience to share?

Re:Home server under Debian

[Retardican]

I use tuffmail.com. They do all the tricks, grey listing, etc, and its only $38/year for 1Gig of space. I really like their filtering at mx level configuration also. It has cut down my spam *drastically*. I'll never setup a home e-mail server again.

Re:Home server under Debian

[DimGeo]

Interesting... Thanks!

Apply Existing Laws

[Steve B]

The existing laws are strong enough (once it is officially recognized that "spam tactics that reduce the efficiency of traditional anti-spam filters" are simply another version of computer cracking), if the government simply enforced them often enough to make spamming risky.

Re:email2

[Alphager]

Easy: people like myself who run their own mailserver won't pay for a cert. And if certs are free, every spammer will get one.

I'd like to see sting operations

[soft_guy]

The FBI/Interpol ought to advertise spam services and then give out huge prison sentances to people who attempt to hire them. I think it would help people to think twice about hiring a spammer.

This, of course, would not stop the people who are using spam to send "stock tips" for pump and dump schemes or otherwise promoting their own shit, but it might help reduce some spam.

I use the spam filter in Apple's Mail client. It is basically worthless. It blocks many legitimate emails and lets lots of spam through. The filter we have at work on our Exchange server is worse, though. It has marked every legitimate email I have ever received from outside the company and let through about 50% of the spam.

Re:I'd like to see sting operations

[antispam_ben]

This, of course, would not stop the people who are using spam to send "stock tips" for pump and dump schemes

The appearance of a stock in a pump'n'dump spam should be enough to freeze trading in the stock and look at recent buyers. Hmm, looks like that's been done at least once:

http://news.yahoo.com/s/zd/20061219/tc_zd/196808

But clearly this isn't done enough. I've been getting a lot more pump'n'dump spam in recent weeks and months.

Re:I'd like to see sting operations

[Petronius]

try Thunderbird. I think it does a much better job than Apple's client.

Re:I'd like to see sting operations

[Legion303]

"The appearance of a stock in a pump'n'dump spam should be enough to freeze trading in the stock and look at recent buyers. Hmm, looks like that's been done at least once:"

That's not a bad idea. When I have spare time I look up the CEOs of the companies whose stocks are being spammed and tell postfix to redirect the shit straight to their inboxes, but this is less than ideal. Let the SEC deal with it.

Not as good as it seems unfortunately

[KKlaus]

If the messages are the same (or very nearly), the amount of space used drops pretty quickly. In fact, it probably doesn't cost any extra space to the spammer because the only non unique part of the email is the name or the address, and he already had to store that list.

And unfortunately the tracking down idea I think wouldn't be too useful either, as spammers are just using zombie boxes anyway. Maybe a system could be built (with the help of ISPs) that would disconnect boxes that were spamming and in that sense making it easier to find them is a plus, but it will never catch the spammer.

It's a tough game.

But still not anywhere near enough

[drewzhrodague]

I manually block spammers. I use several RBLs, Spamassassin, and I also get my anti-spam list from a good friend at a major university who hates spam even more than I do. Still, I've seen a big jump in spam. I'm seriously paying attention to this discussion -- something's got to work.

Re:But still not anywhere near enough

[martin]

Extra rules from www.rulesemporium.com, use dcc (free if you're reselling the service), make sure you're running SA 3.1.7, and get yourself on the spamassassin-users email list.

Spam fighting is not a set and forget sport ;-(

Has potential

[KKlaus]

Well the FDA can't really do anything because what's being sold are "supplements" that are of course "not designed to treat, diagnose or cure any disease." But... for those who are selling actual products, I would like to see more authorities purchasing the products and then giving american express a call to find out where that money went and then seizing whatever they find there. I don't know how to deal with the pump and dump spam (maybe the FTC) but if someone is accepting credit cards, they should just get hammered. And if we can force them to only use paypal, which would severely impact their bottom line, I think that's a step forward too.

Bring It On

[JusticeISaid]

I'm writing this from my chateau in France. I flew here earlier today from my horse farm in Virginia in my new Gulfstream. Can't believe my good luck: couple of months ago, I discovered this unsolicited stock tip in my email. The stock was cheap and the tip seemed pretty solid, so I invested my life savings in it. And my grandmother's life savings, too; I have her power-of-attorney. The next day, I got nervous. Remembered the old line about if it seems to good to be true, it probably is. So I decided to unload the stock. Damned if the price hadn't gone up 6000 percent! In one day! Incredible! Anyway, I sold it all ... and here I am. Grandma's taking a round-the-world tour in her Gulfstream -- we bought a matched pair.

Its a shame...

[amemily]

...that we can't get the IRS to audit the pump-n-dump scammers - I doubt they are reporting their income from these scams. The IRS has got to be good for something.

Remember, Al Capone was finally brought down for tax evasion.

And it's all from about four people

[Animats]

This month's incoming spam is incredibly uniform. A very small number of spammers are generating most of the volume. There's the stock pump and dump guy with the noisy backgrounds. There's the text only stock spammer. There's the pill guy, with the same ad in different formats. Those three are probably generating half the spam on the Internet right now.

What we need is for some of the big mail operators, like Google and AOL, to put a million dollars or so into investigating each one of those annoyances. They may have to hire ex-FBI and ex-SAS people and fly them all over the world, and work the diplomatic circuit when some country needs to be leaned on to get cooperation. But it would be cheaper than adding whole buildings full of servers just to handle the spam.

Re:And it's all from about four people

[Fantastic Lad]

They may have to hire ex-FBI and ex-SAS people and fly them all over the world, and work the diplomatic circuit when some country needs to be leaned on to get cooperation. But it would be cheaper than adding whole buildings full of servers just to handle the spam.

I'm not altogether convinced the spammers aren't working under the direction of the guys in black suits and sun glasses.

That is, if the web becomes annoying enough, it will be easier to justify massive government internet oversight and control.

We all know it's coming. Maybe with even with barbed wire and machine guns if we're somewhat less than fortunate.

-FL

TrashMail and others

[AvenNYC]

Spam sucks, but a big part is giving out your email on webforms. My yahoo mail is interesting...it lets you create fake emails at will. But they're tedious to set up. the new firefox has TrashMail plugin which allows u to just right click in an email entry field and say 'Paste disposeable email address' then it puts a bullshit email, which you then get 2 emails from that address forwarded (in 48 hours) and then it deletes itself. It's all so automatic, and you get whatever password you want from the website but nothing else. It's fantastic.

A HUGE percentage is zombies...

[WoTG]

I wish ISPs would cut off home users who send mail beyond some threshold, say 1000/hr. I've been fiddling with mail filters a lot the last couple months, and watching the logs scroll by, it's clearly dynamic IPs that send the bulk of the SPAM.

BTW. Greylisting still works pretty well. Now if only I could figure out how to compile milter-greylist with DNS block list support on my RHEL VPS...

#1.1 Block REMOTE images!!! PERIOD

[cheekyboy]

An important feature that is used by the spammers to verify that the email has been sent and read is external
images, if you completely block those they cannot use the servers statistics/unique session id to figure out
which mails worked or didnt.

2. Use those remote image location to flood their session stats and pollute their databases and tell their ISPs to drop them too.

make a port 25 blocker virus

[cheekyboy]

Someone please make a virus that blocks port 25 outgoing that is different to the one that is configured in the
outlook/thunderbird / default route to ISP range.

Product Specs.

1. use every method possible
2. once in, update the firewall windows settings and/or other firewall products.
3. Delete self on next reboot.

Try telling dump admins in sth korea that....

[cheekyboy]

Its one thing to do that, but theres a lot of stupid admins that have no clue
around the world. Yes, their upstream major ISP should terminate their pipe if spam is known to be coming from them
or drop their pipe to 64kbps so they will NOTICE the spam.

The problem...

[FliesLikeABrick]

I'll keep this short and to the point:

The problem isn't that we have too much spam. The solution isn't getting better filtering. The solution is finding an annihilating the problem.

The problem and source of probably 95% of all spam is sent directly from Windows zombies. Prevent Windows computers from turning into zombies. To do anything else is like taking Advil when you have cancer and expecting it to cure you just because it makes a symptom or two much less noticeable.

Either use Linux () or better yet... close the holes like MS has been trying to do for so long.

Lastly, ISPs should block outgoing connections on port 25 if they think that their customers should not be sending mail directly and give them a server to relay through instead. This is better than blindly dropping e-mail they think is spam and leaving sender+receiver to wonder whats going on. ISPs should also be more proactive in notifying their customers of infected computers by looking for port scanning and large volumes of traffic on port 25.

Re:The problem...

[smash]

The problem is that people are obviously buying shit advertised this way.

The level of sophistication involved these days requires programmer effort/money to spam and get past filters. If no one buys crap advertised this way, the problem will stop.

While its still profitable, all bets are off.

Plot to log our emails?

[Web Goddess]

I have also, the last three to six months, seen a skyrocketing of spam (a few per week, to many dozens per day) despite a properly-configured spamassassin. It's almost forcing us to move to gMail, where Those in Power can more easily subpoena ad infinitum records of our our emails... <end theory>

Authentication

[CustomDesigned]

I saw a huge increase in spam stats also. I currently get around 11000 messages a day. But I only have to manually delete 1 or 2 a day. My customers enjoy the same convenience despite 100000+ spams a day to their company. There is no administration of filter rules. I run my own filter software (pymilter) on a 600Mhz celeron with 256M ram. My content filter is quite old (dspam-2.5.6.2 with pydspam).

The secret is that I reject all but a few hundred of those 11000 spams in SMTP envelope. Correspondents must have some form of id, currently one of:

1. a valid rDNS
2. a valid RFC 2822 HELO that resolves to connect IP
3. an RFC 4408 sender policy (SPF) with a PASS

If you can't get one of the three right, you should fire your email admin.

That gets 3/4 of the garbage. Next, SPF FAIL is rejected, including for HELO. You'd be surprised at how much spam has my own domain for the HELO! For SPF SOFTFAIL, since the sender is requesting debugging info, I send a DSN to the purported sender reporting the SOFTFAIL. For senders with no SPF, I match domains with HELO and rDNS, and look at MX to try to get a match - which is then treated like and SPF pass. For SPF neutral, I do a CBV, and blacklist the sender if it fails.

This reduces the spam from 11000 to several hundred. The content filter is auto trained. A honeypot mailbox provides spam training. Messages from (verified by SPF PASS) senders that users reply to provide ham training. Users have a web interface to the quarantine.

The false positive from content filtering is extrememly low. The biggest problem is VIP correspondents with clueless email admins who are unwilling to educate or fire them. (E.g. one admin insisted I didn't know what I was talking about and "JUPITER" was a valid HELO name...) In these cases, I have extensions to the sendmail access database to provide policy exceptions. I can also provide local SPF records for correspondents to get them a PASS.

One customer had to resort to spamsoap.com because they were getting 2 million spam connection attempts a day, and my python based filter could only process 80000 or so on his 400Mhz server.

Let's get creative and HELP the spammers!

[sbaker]

Since we believe that spammers are targetting a very small section of society who actually reply to this crap, we could try to identify who those people are.

A 'good guy' at the ISP could set up a deliberate fake-Spam-sending operation to his own customers intentionally bypassing the ISP's spam filters - and in a form that uses techniques similar to the ones the real spammers are using. The general community would be somewhat inconvenienced by this - but we don't intend to do it often - each customer would only get a handful of extra spams per month - they'd never notice. The plan is to use these 'white hat' spams as a honey pot for Spam-respondants. They want to take up these fake offers - so they reply to the email - or visit a fake web site set up by the ISP. Either way, the ISP now knows who the idiots are.

Because our 'White hat' spams bypass the ISP's spam filters - but they test the client's filters realistically, they reach a wider number of respondants than a real spammer could - but they don't reach people who are effectively filtering current spam techiques. The honeypot will therefore capture a wider number of gullible idiots than the real spammer ever could - the offers the white hat spam makes can be even more tempting than real spammers can afford to be.

Now the ISP has a list of his customers that are gullible idiots who are likely to respond to spam. He could just cancel those people's service - or send them notices pointing out that they are the cause of all the problems. There aren't many of them - so the ISP isn't going to make a big dent in his bottom-line. If all of the ISP's did this, it would have a long-term effect on Spammer's profit margins. The idiots would be kicked out and blacklisted by ISP after ISP getting more and more inconvenienced and spending less and less time online until they either find they can't get an email account anymore or they learn that what they are doing is antisocial - so they stop. Company email providers can use training and actual punishment of employees who abuse company email systems for these purposes.

Perhaps an even better solution is to offer to give this list of idiots to known spammers and offer not to filter email to those people - ON THE CONDITION THAT THE SPAMMER NOT SEND EMAIL TO ANY OTHER OF THE ISP's CUSTOMERS! The spammer would have a ready-made list of high-grade customers. That's gotta be more profitable than going through the hassle of blasting out millions of emails. By letting him do what he actually wants to do - we can avoid the anti-social consequences of the lengths he is normally forced to go.

The spammer gains because he can "go legit" and talk only to people who are very likely to respond. The ISP gains because they lose that big spam burden. People who don't respond to spam win because they don't get anywhere near so much spam anymore and the idiots who respond to spam are (presumably) happy because they are getting more "valuable stock tips" offers to buy "fake Rolexes" and more opportunities to deal with Nigerians with unlikely amounts of cash to transfer.

The ISP could actually deliver encrypted addresses to the spammer for the gullible idiots and decrypt them in the ISP's mail server. If the spammer is found to continue to spam addresses not on the list then the decryptor for those primo addresses could be turned off as punishment.

Ultimately, if this worked, we'd evolve into an opt-in advertising infrastructure that would allow ultra-cheap advertising rates with "no questions asked" - with ISP's, "busnessmen" and customers working together. ...well, we could hope.

          Steve

Re:Let's get creative and HELP the spammers!

[DavidShor]

Wish I had points for this

Re:Let's get creative and HELP the spammers!

[pipingguy]

That might work unless a major profit centre for spamming is actually selling email addresses to gullible wannabe spammers/"businesses".

Surges?

[Jotii]

we saw two surges that averaged 85 billion messages a day, one from Nov. 13 to 22, the other from Nov. 26 to 28.'"

That's over a third of the time. I'd call the other times low instead.

HUGE spam problem on Rogers Wireless Blackberry

[bigjarom]

In November I went from never getting a single spam to getting about 100 per day on my Blackberry. Roger's Wireless automatically gives you a blackberry email address (in addition to any others you may set up) and doesn't give you the option to disable it from being pushed to your phone. Their filter system is too simple and insufficient to do what I need it to, so I have been forced to turn off message notification and just check and delete every half hour or so throughout the day. Rogers has not been helpful on the phone or via email. They tell me they're working on it. I'm ready to chuck my $600 phone out the next open window I see.

Jeeeezuz! Shut your mouth, man! SHHHHH!

[Fantastic Lad]

I am just astonished this hasn't happened. I mean - couldn't our friend and champion of democracy George W. include this in his initiative against terrorism? He would probably have more luck tackling this problem then he is having in Iraq. What if he put that on his agenda - and set loose all his military might along with the help of some coalition of the willing? Perhaps he could salvage what's left of his image? Are you listening Mister Bush?

Hell, Shrub and the old Nixon crowd are just waiting for somebody like you to talk loud enough. You think they like people being able to use the web to network information and grow beyond their ignorance? --That's how the world learned of all those U.S. secret prison camps, (oh, sorry, wrong century), detention facilities dotted all over the globe. (More specifically, the secret flights which service them. Discovering that was an internet job. We wouldn't know about it today if that story hadn't been broken by the people for the people, without the media.)

Knowledge about the Diebold voting scandal was also entirely thanks to the internet. (The last election was won by the Democrats, buy there were still about 3,000,000 votes which went snafu, which only means that they won because the number of people pissed off by Bush was greater than the number of planned votes to be stolen. And that only happens when people are informed!

The U.S. admin would positively orgasm if they could find an excuse to impose massive controls over the internet!

Can you imagine trying to learn something real about the world if we went back to the bullshit paper and television media? Man, we'd be like a bunch of ignorant twits living in the Eighties all over again.

Whose direction are those spammers working under, exactly?

-FL

Some of this new spam is almost fooling me

[bigjarom]

I've been getting messages that I think are from within my company until I read them through a couple of times. We have six other branches and I don't know everyone's names. Some of these messages are like "Hi everyone, I just wanted to let you know that I can now be reached at ext. 233. Hope all is well at the Calgary office." Then it will give a full phone number and sometimes an address. I traced one of the addresses to a mortgage brokerage in Toronto. It's almost as if they've been reading my legitimate mail and then making crap up that fits the profile of a typical message to me. And they're spoofing the "to:" field too. I hate that.

Re:One word

[Anonymous Coward]

That's right "Nail some sense into 'em".

email is dead

[someone1234]

Maybe it is time to simply shut down all email servers and invent some new ways of communication.

"Two years from now, spam will be solved" - Bill G

[Joce640k]

"A spam-free world by 2006? That's what Microsoft Corp. chairman Bill Gates is promising."

http://www.cbsnews.com/stories/2004/01/24/tech/mai n595595.shtml

Microsoft could have solved Spam by leveraging their monopoly for good (instead of evil), but they didn't, and show no signs of doing so.

There are limits to how far you can battle it out

[unity100]

Its very hard on providers' side to fight spam, even more than the end user-side, with spamassasin and such.

First of all, it is very hard to discern legitimate email from spam with the recent tactics employed by spammers. an email with only a subject of "Re:" and 1.5 lines of text can be a reply from a friend, as well as viagra spam. Keyword rating, content examining (auto) can only take you so far, as you cant risk a client not receiving an important business related email.

Up to this botnet thing, we heavily relied on trustable blacklists to filter en masse instead, which did a very good job weeding out spam, due to defining the most-highest rated spammers. However with the advent of the botnet issue, blacklists are not much helping either. Incoming spam, (means spam that is able to bypass the rbl, and land in mail transfer agent) has really increased in dramatic rate in the last 1-2 months.

The solution to this lies on the botnet issue i believe - botnets are providing a means for spammers to unload much spam without the fear of getting blacklisted with their ips - like the old method of infected computers sending spam. If we can find a solution to botnet thing, we might be able to use the same method also in reducing the virus infected computer spam.

SPAM DESENSITIZES...

[scottsk]

Spam isn't effective and is the domain of bottom feeders. The big players like spam because it wears people down so they're more likely to spend money for other things. Every day, for years, you see -- sex enhancers, mortgage scams, credit scams, worthless herbal drugs, scams, gambling, etc etc etc -- it absolutely must wear people down. The next time they have to make a moral decision in life, the years of seeing this junk in their inboxes have to give it some sort of weight, even subconsciously. After years and years of daily seeing that the worth of men is solely based on their penis size, and that women are only sex objects, that has to make a certain percentage of people more susceptible to buying porn. The big players encourage spam because it essentially costs nothing - no reason not to have this fire-hose of desensitizing garbage being spewed into every inbox on the planet for years on end. No one makes money off of spam, I don't think, except the spammers themselves - it's just that bottom feeder frenzy for a few crumbs.

How?

[amake]

I assume you mean

(Content-Type contains "multipart" || Content-Type contains "text/html") && (not in address book)

How can you get this boolean setup working in Mail.app? As far as I can see it only lets me choose that "all" (A && B && C) or "any" (A || B || C) of the rules apply, neither of which result in the filter you're suggesting.

Re:email is dead - EmailXT is born

[AndySilva]

Yes, I agree that email in its current incarnation is pretty dead by now.

We need a new email. But we all know about the huge inertia surrouding email changes. To avoid being trapped in the email change inertia, we need a new system that:

- Can still use the current email infrastructure
- Does not require cooperation from everybody at once in order to be usable/useful

The protocol that can achieve this is EmailXT (http://www.emailxt.com/). It offers a seamless transition path from the current to the new system, even on the same mailbox. It adds new features to email, defeats most spam, viruses and phishing, and pretty much returns mailbox control to you.

However,

- Still in pre-alpha specification phase
- Bare-bones, buggy-prototype client application available
- No public protocol specification available, although claimed as a free, public protocol.

But I still see much promise in it, judging from my (rather limited) tests. We will have to wait and see if it reaches critical mass. For now it needs word-of-mouth. If you like it and want to make it grow tell your friends about it (actually that's what I am doing!)...

Re:MOD DOWN

[Inda]

Sod it. Click them all. I know I did.

Merry Everybody!

Real status from a Financial Institution

[Lokatana]

I run an enterprise level messaging department for a large financial institution.

The increase in November of 35% is pretty accurate - but where the real story is is when you look at the 6 month trend.

In July of 2006, my enterprise was blocking approximately 20 million spam messages per week. Last week, we blocked 86 million spam messages - over 400% increase in 6 months.

Most of the growth occured in September & October. We're projecting to hit 100 million per week by the end of January.

The only good news here is that the amount of valid email that we're letting into our enterprise is remaining flat, indicating that pretty much the entire increase is successfully blocked by our anti-spam. *whew*.

-Lokatana

Spam ? What spam ? Easy free tools eat spam !

[BigJim.fr]

I now scrub mail for friends and familly through my Postfix mail server using Fetchmail, Fetchyahoo and Gotmail. Amavisd-new, Clamav, Spamassassin, various DNS blacklists includung URIDNSBL and a sprinkle of bayesian filtering have pretty much solved the problem as far as I'm concerned. The only remaining annoyance was image spam, but that has even been solved thanks to FuzzyOCR that is now in Debian !

I you still have spam, it just means that you are not using the freely available tools to eradicate it. Just do it ! I found it is suprisingly easy and we have to thank Debian for that !

Cloudmark

[IceDogg]

I use Cloudmark Desktop and it removes about 99.9% of the spam. I get one or two spam email each week, but thats about it. The best part is that it is virtually impossible for it for falsely hit on valid email (of course, anything is possible in certain situations though). The downside is that it runs on the client, not the server. And I'm not sure, it might be only for Outlook and Outlook Express. Not sure about support for other email clients. But, it works very well in my specific configuration.

Why even accept gifs?

[wytcld]

All the image spam is gifs. I just toss anything incoming with a gif attached - which is easy to do with mimedefang-milter/spamassassin in front of sendmail. I have one relative who occassionally sends funny gifs so I should whitelist her, but what place is there for gifs in business correspondence?

Also, toss anything with "stocknews" as part of the sender e-mail - that's all from a huge botnet. Toss anything where the earliest received line claims it was received by one of my own domains - but without the machine name/subdomain that my actual mail servers list. And toss anything that includes machine names as domains in the To address (i.e. someone@sub.domain.com), since our "from" addresses never include the subdomain, but for some reason spammers like to include it. All that's done without notice. Stuff with high SpamAssassin scores gets bounced with notice. And everyone not on a whitelist gets greylisted.

The spam that gets by all this is only a couple a day.

spam the spammers

[anybirdwilldo]

Most proposed solutions attack at the wrong place. Spamming is not financed and made profitable by the providers or the spammers. The only way to stop it is to attack the source of the money paying for all this crap. One of the of big players (Google, yahoo Aol, MSN) who can withstand attacks and have the servers necessary needs to step up and offer to set up a database of the people paying the bills. Then the Internet community has to use frontier justice in the absence of real law to attack and destroy the sites owned by the spammers' clients. A million email responses for every one they send us; a million phoney orders for their product; 7/24 downloads of whatever they have on their site; DB hacking; DoS attacks, and anything else that will bring them to thier knees until they stop financing spam. Of course modt of that is illegal, and like passive societies throughout history we will continue to be beatup on by thugs and those who pay them until Marshall Google or Sheriff Yahoo goes into action. This thread is typical of what we see all over the web; spineless whining. All this because most of us are law-abiding and we continue to support general priciples of law or lack of law that protects the criminal but will put us in jail if we try to take effetive action agaisnst them.

How about an IP-based firewall block?

[phorm]

What I wonder is, how vast are the botnets? If there are 1000 botted machines in one spammers botnet, how long would it take to build up a list of IPs for said machines?

What I would like to do is keep a running list of dates + IP's. Any IP that's been in the list for the last 30 days should get the following rule in my firewall:

iptables -A INPUT -p tcp -s ${SPAMMY_IP} --dport 25 -j DROP

or if you want to be a little less friendly, set a rule that rate-limits your packets to about 8 to 32 bits/sec (1-3 bytes). The spammer's machine is going to waste a *LOT* of time sending it's data through. If you wanted to go further with this, a co-worker has suggested you could re-route these connections (iptables -A REDIRECT ... --to-ports 1234 ) to a secondary local SMTP server on an alternate port that will actually accept the message (once it finally gets through), and analyse it to update the spam filters of the primary SMTP server.

Perhaps when I've some extra time I'll add some postfix+iptables fun to accomplish this.

Drop the packets/images

[Blackknight]

I'm seriously considering setting my server to reject anything that isn't plain text. With OpenBSD you can also filter packets by OS type so dropping anything that comes from a Windows box on port 25 might work.

Public Humiliation

[ukemike]

There are several major blacklist providers, like Spamassassin. I think it would be very worthwhile to publish a monthly list of the names and ADDRESSES of the top 10 spammers. Get it in one of those colorful charts the put in USA Today and other major dailys. This would publicize the problem, put a face on the problem, and put real fear into the hearts of the perpetrators. Another thought... Hasn't anyone tried setting a few honeypots and then sue for the per spam fines? If you got damages from suits like that you could really make some $$ (until the spammers sent their thugs with baseball bats after you!).

Well, that's not going to work...

[Dion]

It's hard for countries other than the US to threaten the US into getting their chickenboners under control.

volume

[john_uy]

even yahoo bounces e-mail from itself. the increase in volume is probably true that yahoo groups marked my yahoo e-mail as bouncing!

i would welcome a new better messaging system to replace the quite outdated e-mail system. i suspect, we cannot keep the cycle of upgrading bandwidth and server capacity just to filter all the spam. someone has gotta give (like a recent article where an isp just drops the e-mail.)

Gha it's starting again...

[buserror]

The spam-storm is picking up again as I type...

Re:email2

[dgatwood]

I've been advocating a solution for that for years, too, but I've never had the time or inclination to implement it. Dig around in the archives for a post about an open certification agency. Short version: you request a cert from a site that is paid for by donations and adwords and stuff.

The server generates a series of secret key values that are all unique. One key is sent by mail, one called in by phone, and one is sent automatically by the server in an email message. In order to get the cert, the person must then prove that he/she can receive postal mail at the provided address, phone calls at the provided number, and emails at the provided email address.

To this end, the cert server sends an email randomly to at least three people who haven't helped their quota of other people in the last year or two. It then provides them with the postal mail address and phone number of the requestor. Those three people make a phone call and print and mail a letter.

Once the requester has proven that the address/phone/email provided are legit, that person must send back a photocopy of a government-issued photo ID to any of the people who sent the postal mail to him/her. The lucky verifier would then key in the government agency into the certification site and would get a list of things to look for when verifying that the photo ID was legit. After verifying those details, that person would click the "verify user" button and would keep the copied ID on file for a minimum of ten years just in case.

At the end of this process, the requester gets a cert valid for three years. During that period, they agree to certify up to five people themselves. In effect, the cost of the cert is five minutes, five phone calls, five pieces of paper, five envelopes, and five postage stamps.