100 Email Bouncebacks - Welcome to Backscattering

distefano links to a story on Computerworld, excerpting: "E-mail users are receiving an increasing number of bounceback spam, known as backscatter, and security experts say this kind of spam is growing. The bounceback e-mail messages come in at a trickle, maybe one or two every hour. The subject lines are disquieting: 'Cyails, Vygara nad Levytar,' 'UNSOLICITED BULK EMAIL, apparently from you.' You eye your computer screen; you're nervous. What's going on ? Have you been hacked? Are you some kind of zombie botnet spammer? Nope, you're just getting a little backscatter — bounceback messages from legitimate e-mail servers that have been fooled by the spammers."

Comments

De-standardize, and make it worthwhile.

[Rockoon]

The solution is to de-standardize email.

Re:De-standardize, and make it worthwhile.

[erikina]

Ugh, care to elaborate? Anyway, I think the solution is simple. Just publish a giant list of all mail servers not configured properly. It wouldn't be hard to write a script, to verify if a domain is configured or not. It would function as a name and shame list. But more than that, all spammers would harvest from it, and absolutely smash the listed servers until they were forced to configure them properly.

Re:De-standardize, and make it worthwhile.

[Dan541]

Because email is an open medium!

How do you suggest we change it?
Because right now your comment is no more useful than "We should fix it"

Re:De-standardize, and make it worthwhile.

[Anonymous Coward]

MY JEWELER COULD NOT TELL
IT WAS NOT A REAL ROLEX!

More information how to buy an AAA+ quality replica!

Re:De-standardize, and make it worthwhile.

[Badanov]

My guess is you either don't write spam header filters, or you hate it so much you're trying to find an easier solution.

Helluvua lot of mail servers out there not configured "properly." I can't block some mail even from "legitimate" mail servers because they are not configured well enough some of my spam rules don't pick them up, so how would a "list" fix that?

As it is, the lists from the anti spam houses work very little. There are so many zombie mail servers out there, I guess, no one can really effectively police these things except through spam filters. And Google are the only folks who can afford a full time staff writing spam filter rules.

Any more properly used to mean not an open relay; now it can can mean not in the same network segment that does have spamming email servers. Lists just add to the insanity and often punish legitimate mail servers.

Re:De-standardize, and make it worthwhile.

[tepples]

Why are (most) forums spammed less than inboxes? For one thing, free reg. req. For another thing, a lot of forums block blind people from signing up because there are more spammers that look like blind people than actual blind people.

Re:De-standardize, and make it worthwhile.

[smittyoneeach]

Just publish a giant list of all mail servers not configured properly.

And then I manipulate this list to effect a soft kill on my competitor. If Acme Widgets has an apparently bad email server, who will do business with them?
Think Machiavelli.

Re:De-standardize, and make it worthwhile.

[morgan_greywolf]

Uh, hasn't that been tried already?

Re:De-standardize, and make it worthwhile.

[KillerBob]

You're talking about CAPTCHA.... most CAPTCHA algorithms have been compromised. Also, most forums that actually use it have a working e-mail address listed on the CAPTCHA page, asking people to e-mail the admins if they have problems with it. I've created accounts manually on the forums I administer, for people who have problems with CAPTCHA.

One of the main reasons forums don't get hit by spammers is because the admin staff knows what they're doing. They lock down threads, respond quickly, and keep the software up to date. Temporary bans, and permanent bans... You also need a working e-mail address in order to register, which blocks an awful lot of spam. Finally, there's over 150 domains on the banlist for my forums... some of the most popularly used (by spammers) freebie e-mail accounts, like mail.ru.

Oh... and it helps to have a robots.txt file. Mine looks like this:

User-agent: *
Disallow: /

The forums are served up from a subdomain... the actual site shows up in search engines, but having the separate domain with robots.txt helps keep the forums off the search engines. If they don't know you're there, then they can't spam you. :)

Re:De-standardize, and make it worthwhile.

[Rufty]

Much easier to write a list of mail servers which are configured properly. At 66 lines per page, I'd reckon on about 5 sheets.

Re:De-standardize, and make it worthwhile.

[Loether]

Oh... and it helps to have a robots.txt file. Mine looks like this:

User-agent: * Disallow: /

Maybe i missed something but why would a spammer's robot care what you put in your robots.txt file. If anything wouldn't that tell the spammers bot where the good stuff is. robots.txt only works for well behaved robots like googlebot.

Re:De-standardize, and make it worthwhile.

[Anonymous Coward]

You know what else? You could make vehicles a lot faster if, instead of putting them on logs, you put four little round disks at the corners! I know, let's call them wheels!

Re:De-standardize, and make it worthwhile.

[Dark_Gravity]

Just publish a giant list of all mail servers not configured properly.

It exists. See http://www.backscatterer.org/

Re:De-standardize, and make it worthwhile.

[mikael]

There's already a few mail reputation systems:

Mail Abuse Prevention System

And there's also a generic checklist for all anti-spam ideas:

Anti-Spam Solutions Checklist

Re:De-standardize, and make it worthwhile.

[Anonymous Coward]

In other news, http://www.killerbob.ca/ (your homepage) is NOT on the first google page of the search term "killerbob."
See?

Disallowing everything can hurt you in other areas.

Re:De-standardize, and make it worthwhile.

[FatdogHaiku]

How about we change the delivery method. Instead of an email being sent to me and sitting on my server or service waiting for me to sort it, you send me the headers for the sender, subject, size, date, and attachment status while the message and attachments sit on YOUR server until I chose to pick it up or it expires. The reduction in bandwidth should pay for the increase in storage, and the spammers would have to leave their message sitting on a machine somewhere waiting for me to pick it up (hint, not gonna happen).
1. No servers flooding the net with messages.
2. Easily identifiable spam sources, making bot-nets less useful.
3. Reduced bandwidth as the system replaces the old one.
4. Allow email clients and webmail services to be configured retrieve every message for the few numb nuts that don't/won't get it.
5. Profit (via reduced long term cost).
Just spitballing...

Re:De-standardize, and make it worthwhile.

[KillerBob]

And... if I wanted my personal webmail portal on Google, I'd actually have content besides the SquirrelMail front page... *shrugs*

You missed the part where I said the forums were served up from a subdomain which has robots, and you apparently missed out on the idea that it's possible to serve up multiple domains from a single server. killerbob.ca is where my e-mail goes. The page I'm talking about shows up first in Google when you search for it, under an awful lot of possible search keys (not just the domain).

I've got nothing to do with the bear community... ironically, I do have something to do with LGBT in general, but more to do with the L... but if he wants to make money off it, more power to him. If it were actually a business for me, I'd be more concerned about it showing up high on Google.

Re:De-standardize, and make it worthwhile.

[Rockoon]

How do I suggest we change it? I said exactly what I suggest. First, you can look up the word standard. Then, if you feal really enthusiastic, you might want to think for yourself.

Re:De-standardize, and make it worthwhile.

[_Sprocket_]

I don't know how much more elaborate it could be stated..

Why are (most) forums spammed less than inboxes? You apparently don't run a forum that uses popular software. The little forum I run, on our own private domain, gets more spambots than our catch-all email configuration sees spam.

Of course, this could be argued as another piece of evidence against standardization. I have no doubt we get attention from spambots due to search results looking for the forum software we run. If I hid or otherwise obfuscated this information, we'd probably see less nefarious traffic. I could also do away with the "prove you know something about the subject of this forum" type question that has done wonders to foil spambots (although its also foiled legitimate users before as well).

But that doesn't mean the forum is superior. I still run email addresses on the domain because it remains a really useful tool. Email is powerful because of its standardization. We use it for internal communications and technical administration of the site. People can quickly and easily contact us via email without the additional overhead of forum accounts, etc. Usually the email we get comes from folks having trouble with their forum account.

The forum is a great tool. It serves its purpose well (although not the only way to do things by a long shot). But email serves it's place as well. I'd be really wary of throwing too many wrenches in to either system.

Re:De-standardize, and make it worthwhile.

[PRC Banker]

A nice trick is to put a no-follow link in robots.txt and have a well linked but no-follow (and to humans, obscured) page that when accessed denies that IP from getting anything from the site for a certain amount of time.

Re:De-standardize, and make it worthwhile.

[Rockoon]

SMTP is a near ideal, fully standardized, playground for spammers. If spammers had invented SMTP, it woudnt be much different than it is. Gee, I wonder what the problem is.

Re:De-standardize, and make it worthwhile.

[cliffski]

what's wrong with this idea? It sounds pretty good to me.

Re:De-standardize, and make it worthwhile.

[Eunuchswear]

You are djb and I claim my $1000.

Internet Mail 2000

Re:De-standardize, and make it worthwhile.

[Anonymous Coward]

Problems:

1. Only works for obvious spam. For non-obvious spam it means the user has to download it - which notifies the spammer of a known-good address. That means more spam. (Right now images do this, but images can be disabled while preserving the text.)

2. They'll just advertise in the subject line. Perhaps easier to filter, but seems like a losing battle to me.

3. How do you authenticate?

4. Allows people to associate an email address with an IP even if that IP/address never sends them email.

5. Completely fails to account for offline/IMAP use.

Some of this can be mitigated by having the receiving server fetch the mail when the client requests it, but that adds more problems.

Re:De-standardize, and make it worthwhile.

[FatdogHaiku]

Problems:

1. Only works for obvious spam. For non-obvious spam it means the user has to download it - which notifies the spammer of a known-good address. That means more spam. (Right now images do this, but images can be disabled while preserving the text.)

2. They'll just advertise in the subject line. Perhaps easier to filter, but seems like a losing battle to me.

3. How do you authenticate?

4. Allows people to associate an email address with an IP even if that IP/address never sends them email.

5. Completely fails to account for offline/IMAP use.

Some of this can be mitigated by having the receiving server fetch the mail when the client requests it, but that adds more problems.

1. I'm pretty much whitelisting by hand now, If I don't know you, I don't care what you put in the subject line, your stuff is gone.

2. Set a size limit on all the headers, no hex or encoding, plain text and straight IP addresses for the server holding the mail.

3. Their server sends me a key to pick up the message (a header I forgot), if a server sees the same key a thousand times in a minute or two... hmmmm...

4. Works both ways: Gmail Warning, The message you are about to retrieve is located on a server KNOWN to send spam... Continue?

5. If your offline you are pretty much working with the mail you already downloaded, right?

I'm not saying I have a perfect answer, but there are plenty of people that can figure it out, just like other ideas have been brought to fruition on the web, by cooperation of parties that have a mutual interest... and on this topic, it a BIG group and they have the brain power and bucks to make it work without rattling to many cages.

The point is to reverse it so that the abusers are left holding the bag, botted machines are quickly identified (and hopefully cleaned), and the free ride stops with the death of standard SMTP servers.

All I can offer is my idea of a starting point...

Re:De-standardize, and make it worthwhile.

[raddan]

I think you are misunderstanding the poster. The point is-- do not accept nondelivery (aka "bounce") messages from senders with misconfigured SMTP relays. This would be very easy to implement: bounce senders always set the "MAIL FROM" field to "[less than][greater than]". So if you receive an email from "[less than][greater than]", check it against the list. If it's from a misconfigured server, drop it.

This is one area where greylisting (taking advantage of the SMTP protocol to implement some primitive challenge-response) does not work, because MTAs involved in backscatter are indeed real SMTP servers.

BTW, interpret the "[less than][greater than]" as the actual angle braces. Stupid /. filter.

Re:De-standardize, and make it worthwhile.

[secolactico]

The spammers will move the spam from the message of the body to the headers. Heck, they've been spamming via HTTP logs so why not?

Of course, it will cut down image spam so we do gain something.

Re:De-standardize, and make it worthwhile.

[jfengel]

That's largely how RSS is supposed to work, and I'd like to see more mailing-list situations be replaced by RSS feeds.

To use it for personal mail you'd have to be more selective about authentication,since you don't want just anybody to be able to download mail intended for you.

(I'd also like an RSS feeder which incorporates those feeds into my inbox.)

You still have the usual problems of sorting out spam (black/white/graylist/bayesian), but at least the bandwidth problems would be dramatically reduced.

Re:De-standardize, and make it worthwhile.

[billcopc]

Great idea! Go tell Google, because they're quite possibly the largest source of backscatter spam right now.

The worst thing about backscatter is they are valid messages coming from valid hosts. Greylisting is no help, SPF can't fix it either. Since it has your email address as the original sender, it can be confusing even for the victim.

I also find it extremely ineffective, since I'm clearly not going to click a Cialis link in a bounceback that I allegedly sent out. I'm sure there are some simpler folk out there who would click the link, but would they actually go ahead and participate in the con ? Hopefully less likely than regular spam... I mean, people are astoundingly dumb, but this takes it to a whole new low.

Re:De-standardize, and make it worthwhile.

[galliver]

You might be interested in D.J.Bernstein's Internet Mail 2000 concept for sender-stored email.

http://cr.yp.to/im2000.html

Re:De-standardize, and make it worthwhile.

[lgw]

I'm sure there are some simpler folk out there who would click the link, but would they actually go ahead and participate in the con ? You're looking at it backwards: people dim enough to participate in the con are somewhat likely to click the link - the likelyhood of the rest to click the link is unimportant.

Re:De-standardize, and make it worthwhile.

[SanityInAnarchy]

Hmm, should I pull out the "your idea will not work" items?

In this case, it means that there's both confirmation that you actually read the email -- and that it's actually a valid address -- and there's the fact that they don't care. (How many emails contain URLs in them?)

This would make pump'n'dump schemes slightly harder. That's about it.

Re:De-standardize, and make it worthwhile.

[Lachlan Hunt]

No, that just creates more problems.

1. If you only automatically download the headers, then that requires the user to be online to manually download the body. Not so much of a problem for IMAP users, but ...

2. POP email (or equivalent, in your new system) accounts that download all emails immediately, which then allow the user to read later at their own pace, even without being online, would just download the message anyway.

3. When the receiver downloads the message from the server, that immediately validates the email address as real. That takes away the need to do it with images or other techniques in HTML mail.

4. It's not backwards compatible. There a litterally mllions of legacy systems out there and both email platforms would need to run in parallel indefinitely, while it takes several decades for everyone to switch, only to realise that it hasn't solved any problems.

Re:De-standardize, and make it worthwhile.

[Anonymous Coward]

1. I'm pretty much whitelisting by hand now, If I don't know you, I don't care what you put in the subject line, your stuff is gone.

This makes you an incredibly small minority. I do this too for some accounts, but there are plenty of personal, academic, and business reasons to want to talk to allow people you don't know to reach you.

3. Their server sends me a key to pick up the message (a header I forgot), if a server sees the same key a thousand times in a minute or two... hmmmm...

You are either skipping a step here or leaving the key wide open to interception anywhere along the network. I'll let it go since it's not much worse than current methods when people don't implement SSL/TLS.

As for 'seeing the same key a thousand times in a minute or two...' it would be ridiculously easy to serve up the same email using separate keys.

4. Works both ways: Gmail Warning, The message you are about to retrieve is located on a server KNOWN to send spam... Continue?

This doesn't really address the problem for a couple of reasons. First, it only tells you if the _server_ is known to send spam, not whether the message itself is spam. It's a clue, but not the whole story, which means you may still need to investigate. Second, what about servers that aren't known to send spam? You're still giving away your IP address.

If your offline you are pretty much working with the mail you already downloaded, right?

Yes, but for people who download everything that passes their filters, this solution will _generate_ tons of spam. (Think dial-up users who login, download, logout, respond, login, send, logout.) And it makes 'keeping everything on the server' a la IMAP impossible.

The point is to reverse it so that the abusers are left holding the bag...

The benefit of your system is that servers aren't required to download all that spam. That's a nice benefit, but the price is too steep if you ask me.

It won't really leave the spammers holding the bag. They might spend a little more on bandwidth, but only when they have a live hit. And what they'll be getting in return (more known-good addresses than ever) will more than offset that cost.

Re:De-standardize, and make it worthwhile.

[Architect_sasyr]

If I go away for a week and can't get to my email, it expires and I then never get the photos/data from an important client - sure I can ask them to re-send but it looks dumb.

It's a good idea. Perhaps a refinement on it (i.e. only storing attachments on the email server) - much like packages from the post office where all your letters and small items are sent but the big ones require you to go pick them up.

Of course then we have to worry about high volume of traffic, and resources and all the other things.

Re:De-standardize, and make it worthwhile.

[ralphdaugherty]

Why are (most) forums spammed less than inboxes?

      They are mostly spammed for different purposes, although there is plenty of viagra forum spamming, the kind that go to inboxes.

      Forum spamming is mostly for posting links to sites that will try to download malware and take over your PC. That's their goal, that's where the money is, if not yours they will see if they can follow your connections and get through into a private corporate, government, or financial network. Meanwhile your PC is instructed to probe ports and try to take over more PC's and/or generate even more spam to others.

      Always believe in money as the answer. They try to break in 24 hours a day on forums. They do it because it pays.

  rd

Re:De-standardize, and make it worthwhile.

[HeroreV]

BTW, interpret the "[less than][greater than]" as the actual angle braces. Stupid /. filter. You mean "<>"? Stupid /. posters.

Re:De-standardize, and make it worthwhile.

[Anonymous Coward]

Your solution :

[X] Is often derided by postings in this faux check box format

Re:De-standardize, and make it worthwhile.

[Dan541]

What happens if I'm sending a mailing list?

I might send it to my clients at 1am to avoid high server load. This will dramicically increase my server load since my clients will be grabbing the email all at once.

Also If I'm away and a client emails some documents to me its pretty important that they don't expire on the clients server.

Overall it's not a bad idea, just a few issue's that may need refining.

Re:De-standardize, and make it worthwhile.

[geminidomino]

Pretty much the same way a lot of NNTP (Usenet) clients work, eh... I do like it. It has it's flaws, but what doesn't? That's what engineering's about. Let's fix em. :)

Re:De-standardize, and make it worthwhile.

[geminidomino]

A nice trick is to put a no-follow link in robots.txt and have a well linked but no-follow (and to humans, obscured) page that when accessed denies that IP from getting anything from the site for a certain amount of time. How does "until the heat of the universe" grab you?

You have an evil, BOFHish mind. I like you.

Re:De-standardize, and make it worthwhile.

[Meski]

Just look at them, , and add the misconfigured server's domain and the spammer's domain to your blacklist. (which *doesn't* bounce the emails back)

Re:De-standardize, and make it worthwhile.

[psychodelicacy]

Well, how about trusted email addresses, whose messages get straight through, and any others sit on the server? If this system were widely adopted, you wouldn't "look dumb" to your client who would know when they got an out-of-office autoresponse that there's a chance their message would expire before you got it.

Re:De-standardize, and make it worthwhile.

[raddan]

Maybe you could tell me how you did that instead of calling names.

Re:De-standardize, and make it worthwhile.

[AKAImBatman]

Like this: < >

I'll leave you to figure out how I posted those without getting < and >

Re:De-standardize, and make it worthwhile.

[HeroreV]

instead of calling names I was just trying to make my post mirror your post.

Re:De-standardize, and make it worthwhile.

[Architect_sasyr]

who would know when they got an out-of-office autoresponse I'm sorry but: HAHAHAHAHAHAHAHAHAHA

You over estimate the mental capacity of most clients my friend. You greatly over estimate it.

A trickle?!

[Zombie]

A few every hour? This weekend marks the second weekend in which I got several hundred bounces in a single night!

Re:A trickle?!

[tolomea]

My record is over 1000 in a single 8 hour crap flood.

Re:A trickle?!

[Anonymous Coward]

my top was close to 2000 of those mails in a single night...

I usually get about 50 of these mails per day.

Re:A trickle?!

[tolomea]

on the spam note, gmail has this feature where it automatically deletes stuff in the spam folder after 30 days, this means the spam folder total is effectively a 1 month rolling average of spam rates, my gmail spam folder currently has 3000 items in it

Re:A trickle?!

[Dan541]

Gmail seems to get ALLOT more spam than other service's.

Re:A trickle?!

[Anonymous Coward]

I am seeing a lot more of this junk. Most of seems to come from clueless admins of the "Barracuda Spam Firewall". Gotta love the inept PHB like mine who keep pushing these canned "appliances" and "solutions".

Re:A trickle?!

[Asztal_]

What exactly do they have to gain by sending thousands of messages to one person (and this sounds like it was from one source)? Are they just trying to evade the spam filter, or do they perhaps think that if they just send enough, finally you'll start to believe them?

Spam confuses the wossname out of me.

Re:A trickle?!

[Anonymous Coward]

I've had a GMail account since a month after launch, which I use for both automated signups and personal correspondance.

I use Sneakemail free forwarding to sign up for automated things, so that I can revoke them if the spam gets too obnoxious. I have approximately 250 different Sneakemail addresses out there.

I have never had a spam problem with my Gmail account. When I do get spam, I know where it's coming from - and I deactivate that address and vow never to use that service again. I see Sneakemail as using a condom for sites you'll probably only stick around for a single night - why worry? Bugzilla & SocialTextOpen are the only two spam-vulnerable legit sites I've encountered in the last year or two.

If I ever need to put my personal address out there subject to crawlers, things will be a bit different.

Re:A trickle?!

[LiquidCoooled]

I got over 12000 one night from a mailing send out to some "Liquid club in Santo Domingo".
They sent out a massive world wide spam inviting people to their club.

Its half way around the world from me and I got every single bounceback.

They did it again a few days later as well.
Most made it into my gmail spam folder but hundreds didnt.

Re:A trickle?!

[tolomea]

It's not targeted at me, it's the spammers using random addresses on my domain as as source addresses.

Re:A trickle?!

[Anonymous Coward]

15,420 since May 1. My hosting company actually asked me to move to google apps because my shared account couldn't handle the loads from these attacks.

Google apps ( http://www.google.com/a/help/intl/en/admins/editions_spe.html ) handles the domain mail for free, without complaint, and only about 3 messages out of the 15,420 made it through the spam filters.

Supposedly there's a mail configuration option you can set to make it possible for servers to verify mail from your domain (must originate from this ip range) but the domain hosting company I'm with doesn't expose that particular feature.

It is a pretty horrible problem, until I moved to google and their pretty remarkable spam filters boucneback was really had me at my wits end to the point where I actually considered closing my domain to mail.

Re:A trickle?!

[Asztal_]

Ah, I see. Funny, I've never had any of that, even though I have a catch-all set up.

Re:A trickle?!

[Anonymous Coward]

Parent is NSFW... I don't recommend following.

Re:A trickle?!

[CastrTroy]

I remember this being the reason I disabled my catch-all address for my domain, a couple of years ago. I was not only getting tons of bounce-backs from things that looked like they were being sent from my domain, I was also getting a lot of spam mail sent to random-non-existent-but-caught-by-the-catch-all addresses.

Re:A trickle?!

[Lumpy]

I find my catchall to be an awesome address. I use it to feed my spam filter. This way I typically never see the spam because the catch all get's all the first spam.

works great.

Re:A trickle?!

[ozmanjusri]

Funny, I've never had any of that

It's called a "Joe Job"

It's been around almost as long as spam has.

I was fairly active in chasing down a couple of Australian spammers a few years ago, and had to deal with thousands of bounced responses and constant blacklisting as a result.

Re:A trickle?!

[dekemoose]

I have a Gmail and a Yahoo account. I get no spam at my Gmail account, but it is used fairly little. I get lots of Spam at my Yahoo account, but it has been around awhile. Some time ago I signed up for a second Yahoo email address one character different from my original name. Within hours I was getting spam at that account even though I had never used it. I'm not sure what this says, perhaps there are a lot of dictionary type spamming attacks against Yahoo.

Re:A trickle?!

[Ctrl-Z]

In the past six months or so, mine has grown from 3000 to 11000. That means I have had over 11000 items added to my spam box in the past 30 days. It's madness.

Re:A trickle?!

[Lunarsight]

It's been a problem over the last few months.

I work an IT job, and we get employees bringing this up all the time with us. (I think they fear they've been hacked.)

Re:A trickle?!

[Jurily]

I've been using an "unprotected" gmail account for 2 years now. Currently I have 196 spam, all conveniently labeled as such.

During that time I only got one false positive, but that was a really poorly formatted message, and they weren't even replying from the same adress I specifically asked the reply from.

However, I got no false negatives in English, and it took about a week of "Report Spam" to get them up to speed on some new Hungarian torrent tracker spam. Now they're marked spam too.

All in all, Google's spam filter rocks.

Re:A trickle?!

[MBGMorden]

Supposedly there's a mail configuration option you can set to make it possible for servers to verify mail from your domain (must originate from this ip range) but the domain hosting company I'm with doesn't expose that particular feature. It's called SPF which is Sender Policy Framework. Problem is, it's not used often enough at current time, so very few mail servers will actually reject a message that fails an SPF check.

The best thing honestly would be for these servers to just clean their act up and handle things properly. Mail rejects should be done before the connection between the two servers closes. It should always be up to the SENDING mail server to generate a bounce rather than the receiving.

The odds of that happening are pretty slim though. There is a "bounce killer" feature in the new version of amavisd-new that I'm looking at that might work well. Apparently (I haven't installed the new version yet) it will store the message ID's of your outgoing messages and if a bounce comes back with an invalid message ID it deletes it.

Re:A trickle?!

[rolfc]

Moderators,
This guy know what he is talking about.

If everyone was publishing SPF-records and enforcing them, the problem would go away. The real problem is that most mailadministrators doesnt have a clue.

Re:A trickle?!

[KillerBob]

That works great, until one of your friends makes a typo and sends a message to lupmy@yourdomain.com instead of lumpy.... they get no confirmation that the message they sent to you didn't go through... because it *did* go through. It just went straight into your spam filter.

I could make it sound worse than it is, by making this fictional friend your significant other, and creating some kind of facetious situation in which your relationship will end if you don't respond to said message... but you get the idea.

It's your choice. But I get very few spam messages in my inbox, and I don't use a catch-all. I have SpamAssassin updating itself automatically by a cron job, and that works pretty well.

Re:A trickle?!

[SkyDude]

Gmail seems to get ALLOT more spam than other service's. I guess you've never had a Yahoo email address. The free version - and the paid version, so I hear - get pummeled with spam every day.

Gmail is almost clean in comparison.

Re:A trickle?!

[Intron]

Barracuda knows about the problem and gives out instructions on how to turn it off. They deliberately set the default to bounce spam to innocent victims because it is free advertising.

Re:A trickle?!

[WoodstockJeff]

The real problem is that most mailadministrators doesnt have a clue.

An even bigger problem is those administrators who do have a clue, but don't give a damn. Several rather large sources of email publish ambiguous SPF records, because they don't want to piss of their users if someone bounces a message, just because the wrong server handled it. So, they end their SPF records with "~all" instead of "-all", which makes any spoofed mail "legitimate".

For a while, I was planning on patching my install to treat "soft-fail" as "fail", because of this crap. Still considering it, because it's back to being a significant factor again.

Re:A trickle?!

[CastrTroy]

If your significant other is going to get angry, and create a big problem, because they mistyped your address and you didn't get their email, then I would say that your significant other needs to be let go anyway. So what, you didn't get the email. I often go days without checking my email if I happen to be busy. If my significant other wants to talk to me, she'll find some other way.

Re:A trickle?!

[caluml]

You know what I really hate?

Your message ("Buy more Viagra here") could not be delivered. We will retry every 4 hours, and let you know every time it fails, until you go mad.

Re:A trickle?!

[nine-times]

Not me. I get endless spam in Japanese-- or at least I think it's Japanese-- and spanish. Loads of it, and I keep marking it as spam, and it keeps coming straight through Gmail's filters. In the past 6 months, I've started getting spam in English too, including phishing e-mails for E-Bay and PayPal.

Now, admittedly, my e-mail address is public on Slashdot, without obfuscation, so I'm pretty much asking for it. But don't tell me that their spam filters catch everything.

Re:A trickle?!

[Mr. Slippery]

If everyone was publishing SPF-records and enforcing them, the problem would go away.

...and new problems would arise, because SPF is fundamentally flawed.

Re:A trickle?!

[awdau]

The big problem with SPF is forwarding. As soon as a server forwards on an email it uses the envelope sender which if has a SPF record fails the check. This is where SRS (or sender rewrite scheme) which rewrites the envelope sender, comes in. If everyone implemented SPF and SRS now, SPAM would almost die out.

Making sure its used on all outbound mail then makes it possible to blackhole failure messages that are sent to non-srs addresses.

However, how do you define a failure message? Currently its an email with a null envelope sender.

Due to web forms, forums, email receipt notification and the like sending out emails with a null sender, you can't just blackhole null sender emails to non-srs addresses.

Different mail servers have different subjects for stating that the email failed to get through, not to mention the different body texts.

Looking at amavisd's site its looking for Precedence: and other headers, which I'm guessing won't take long for the spammers to work out.

Re:A trickle?!

[Sancho]

Except that SPF-records somtimes impose a burden on the end-user. Anyone who runs a co-located mail server for a group of people scattered around the world knows what I'm talking about.

Users likely have multiple e-mail addresses. Many e-mail clients just have a default smtp server which must be changed on a per-message basis if you wish to use another. So if they're mailing from your colo, they have to change it if you publish SPF records.

Their ISPs may block connections to port 25 of hosts which are not the ISPs server (in an effort to combat spam.) Well, fine, you shouldn't be using port 25 anyway for submission, but I've seen places block 587, too. Now they can't send mail at all from the co-located host. Well, they could VPN in or something, but that's unlikely to actually happen.

Then there are problems with webmail services who get their captchas broken. You can't just automatically assume that SPF will solve the problem.

SPF is a neat idea, but it's just bogged down with too many problems to be really practical, even if everyone implemented it.

Re:A trickle?!

[PRC Banker]

My domain (forwarded to my GMail) was spoofed in a spam-flood (not all the same mails, an interesting variation of ow to spell Viagra mostly) and I received 300,000 auto-replies or bounce-backs within 2 hours. It is a nasty business, I imagine my domain was blacklisted by a few naive sysadmins.

As soon as open relays are auto-denied, the more I am happy. Yet I fear it is not that simple.

Re:A trickle?!

[TheRaven64]

I really don't understand why forwarding is considered a problem for forwarding. Mail forwarding should only be permitted under certain very strict conditions.

Emails ought to go from the sender machine, through zero or more relays, to a public mail server, across the Internet to a public mail server, through zero or more relays to the receiving computer. SPF should only be used on the step between the two public servers. How the mail reaches your public outgoing mail server is entirely up to you. You can filter based on IP ranges, require arbitrary authentication, or whatever, but once it's there then you use SPF to say that you vouch for its authenticity. It then goes to the receiving end defined by the recipient's MX records. They may set up forwards or whatever beyond this, but if they do then they are implicitly trusting the relay to vouch for the authenticity of the sender. If you have a mail server that relays mail from anywhere to anywhere, then it is broken and probably being used for spam.

Re:A trickle?!

[kwerle]

My address is also public - but I don't seem to have the flow you do. How odd.

I wonder if pobox.com (which just forwards to google) is killing some of the incoming spam. I don't have it configured to...

Re:A trickle?!

[dbIII]

A few weeks ago I went from none of these to a couple of hundred in ten minutes. The bad thing about checking email at 2am after a night out is that it is very easy to get paranoid when such things happen. I actually went into work and pulled the network cables from three mail servers and checked for signs they had been hacked.

Re:A trickle?!

[Anonymous Coward]

SPF is not a solution when your ISP refuses to allow you to connect to any SMTP server other than theirs. No, port mangling is not a valid workaround.

Re:A trickle?!

[nuzak]

Your message ("Buy more Viagra here") could not be delivered. We will retry every 4 hours, and let you know every time it fails, until you go mad.

I've only ever seen those by the local mailer daemon for locally queued mail. Stop sending Viagra spam then.

Re:A trickle?!

[jahudabudy]

The only time I ever type out an email address is if I need to email someone for whom I only have a business card, i.e. very rarely. Everyone else, I have their address in my contacts list and it just pops up when I start to type, or I have an email from them (or that they are copied on) I can reply to, or cut n paste, etc. So typos would only very very rarely be a problem for me. But maybe my mom was right, and I really am special...

Re:A trickle?!

[nine-times]

Meh... I wouldn't be surprised if I pissed someone off and they purposefully put me on spam lists somehow. Anyway, I'm not surprised that I'm getting flooded with spam, but I'm just saying that I know from experience that Gmail's filters don't get everything. I got about 20 spam messages that made it into my inbox just over the weekend.

Re:A trickle?!

[MBGMorden]

SPF is generally used by organizations with their own email domain and server, not individual users. If you're getting backscatter then it would need to be your ISP to implement SPF, not you yourself.

Re:A trickle?!

[Anonymous Coward]

SPF is a wonderful thing, but there's a problem: Sending e-mail. I'm using several different networks and google is the single smtp server that will accept mail outside webmail or the local subnet.

That's the real problem, not being able to relay e-mail through the correct server. Having fixed that (enforce encryption, logins on SMTP and strong passwords), SPF would actually work instead of labelling more than half of my e-mails as spam.

Re:A trickle?!

[sheddd]

SPF also breaks email forwarding; that's why I don't use it.
Reference

Re:A trickle?!

[awdau]

I agree, but there are problems with this.
Idiot admins and clients not having the ability to change certain settings.
Think small clients that have a domain and email is forwarded their IPS's email account.

SRS does solve this, however there is only a microscopic % of ppl using it even compared to SPF.

Re:A trickle?!

[Sancho]

Yes! I was trying to remember that last case, and it was just eluding me. It's the one that's most important to me, too.

Re:A trickle?!

[RiotingPacifist]

As much as google bashing is the new thing around here,
my yahoo spambox has : 1337
my personal email had: 1
Much like security, if you dont do anything with your email address you dont get any spam.
So if you use your gmail account for everything you will get a lot of spam, same goes for any email.

Re:A trickle?!

[Kamokazi]

We've had this where I work the past couple weeks. Several people get 100-200 Mail Delivery Failures and whatnot within a 24 hour period, and they call me about it panicking. Glad to know it's not just us.

Re:A trickle?!

[Sentry21]

My solutions to these problems:

1. Use a non-broken mail client (and yes, Thunderbird is horribly broken in this regard). Oddly enough, Apple Mail and Microsoft Outlook both support specifying outgoing mail servers on a per-account basis. Apple Mail does it a little better, letting you create one group of settings for an outgoing server and apply it to as many accounts as you like. Outlook requires you to re-enter the information each time.

2. I set up postfix to *also* listen on port 1024 on my server. It allows anyone to send messages to anywhere from anywhere, if and only if you have enabled TLS and then authenticated. Otherwise, it won't send any mail. Of course, any other mail port works fine, but 1024 gets around port blocking.

I see so many people fucking e-mail up so badly that I'm seriously considering starting my own e-mail hosting company. Honestly, I couldn't do it any worse than most places.

Re:A trickle?!

[mcrbids]

The best thing honestly would be for these servers to just clean their act up and handle things properly. Mail rejects should be done before the connection between the two servers closes. It should always be up to the SENDING mail server to generate a bounce rather than the receiving.

Eh, not so, unfortunately.

Sendmail has a drop-dead simple way of setting up "slave" mail servers in case the primary is down, an option that's commonly used for backup mail relaying. It's part of the official Sendmail documentation and so is very unlikely to "go away". And, when this is enabled, there is no address verification "before the connection between the two servers close[s].".

So, good luck with enforcing your ideas on how the world should work!

Re:A trickle?!

[Anonymous Coward]

Unfortunately, the bulk of the spam that actually makes it to my mail spool comes from throw away accounts at providers that use SPF (gmail and hotmail are currently trying for the #1 spot). Judicious use of greylisting, tarpitting, and temporary blacklisting of sites that email spamtrap addresses and domains. Unfortunately, the bulk of the sites that use SPF also have mail clusters which never use the same host to retry a delivery. For added insult Google has an SPF that covers a /16, a /17, a /18, 2 /19s, and two /20s. Their smallest piece is larger than the largest thoroughly compromised south american ISP I regularly see in my logs.

Re:A trickle?!

[raddan]

Thing is-- in order to solve these problems with SMTP, we simply need to break backward compatibility. It's the fact that SMTP continues to allow a lowest-common-denominator kind of communication that enables people to abuse email. The next standard should use mutual authentication to prevent spoofing (maybe ala MIT's PGP key repository), encryption to prevent hijacking (and evesdropping), and all of the other tricks employed by modern network protocols to keep them working properly. I don't think incremental improvements to SMTP will ever solve SMTP's shortcomings, as long as people need to be able to receive email from any old non-compliant sender.

Re:A trickle?!

[amuro98]

Welcome to 1998. Header forgery isn't anything new. To defeat this, and many other problems, try running some form of "email firewall" or blackhole list that matches the initial incoming IP# (that can't be forged) against a list of known repeat offenders or IP#s that have no business directly sending you email in the first place (such as 99.999% of all consumer IP# space). That ought to take a huge chunk out of your incoming bad-email problem, lessening the load on your mailserver, virus scanner, and other filter programs.

I added some filters to procmail to look for things like "postmaster", "mailer-daemon", "bounce", etc. This moreorless deals with this problem. If I do get a legit bounce, it's usually right after I sent a message, so I'll know right away.

The last time I got hit by this attack, I ended up with over 4000 messages in my inbox. I'd gotten hit over a weekend and those were the messages that didn't match my keywords - mainly due to the bounces being in foreign languages, challenge-responses, etc. Oh well. That took me 10 minutes to clean up, and I found some new words to add to the filter that should reduce the next attack to just a few hundred messages....out of an estimated 50,000.

Re:A trickle?!

[ultranova]

That works great, until one of your friends makes a typo and sends a message to lupmy@yourdomain.com instead of lumpy.... they get no confirmation that the message they sent to you didn't go through... because it *did* go through. It just went straight into your spam filter.

Which means that they don't hear back from me. Which means that I didn't get the message and they should resend.

It's the TCP/IP way of delivery confirmation: if the other end hasn't confirmed it as delivered, it's assumed to have not been delivered. And if it hasn't been confirmed as delivered in a reasonable amount of time, it has propably gotten lost somewhere and needs to be resent. Common sense, really, and also applicable to meatspace mail carriers.

Re:A trickle?!

[Chelloveck]

Use a non-broken mail client (and yes, Thunderbird is horribly broken in this regard). Oddly enough, Apple Mail and Microsoft Outlook both support specifying outgoing mail servers on a per-account basis.

In what way does Thunderbird not handle this? I have several accounts, each with its own SMTP server, and I've never seen a problem where TBird picks the wrong one.

Re:A trickle?!

[MBGMorden]

Eh, not so, unfortunately.

Sendmail has a drop-dead simple way of setting up "slave" mail servers in case the primary is down, an option that's commonly used for backup mail relaying. It's part of the official Sendmail documentation and so is very unlikely to "go away". And, when this is enabled, there is no address verification "before the connection between the two servers close[s].".

So, good luck with enforcing your ideas on how the world should work! I'll not pretend to know how sendmail works as I admin a Postfix system, but why wouldn't any and all backup servers do address verification? For my systems they all update their list of valid addresses against an LDAP server as a cron job. Doesn't matter which server takes a message in - address verification works on all of them.

It's just plain stupid for the receiving server to generate a bounce. EVER. Once that connection is closed all you have to go by to generate a bounce is who the message said it's from. That can't be trusted, and if you bounce to it you're contributing to the backscatter problem and your mail server/domain will quite likely end up on a blacklist. If you're going to configure you're mail system such that it accepts a message with no recipient verification (and I refuse to believe sendmail can't be configured to do this properly), then you shouldn't bother bouncing at all.

Re:A trickle?!

[Sosarian]

Except when you're subscribed to a Google group, and then the spammer opens a gmail account and spams the group, no filtering appears to occur.

One of the ways that I get spam these days.

Re:A trickle?!

[slaker]

I use the paid Yahoo mail service.
I get maybe 10 spam messages a week, but I also have Yahoo auto-deleting everything that goes in the "bulk" mail folder.

I get about the same amount of Spam on a Gmail account that has never been used to send E-mail, actually.

Re:A trickle?!

[Cederic]

I wrote to Barracuda asking them to fix their fucked up default configuration. No reply.

I now auto-delete anything sent from one of their firewalls, and actively discourage companies from buying their software. There are better behaved alternatives out there.

Re:A trickle?!

[ProfessionalCookie]

New Filter: Has the words is:spam
Action: Delete It

I trust Gmail enough (with false positives) to just not deal with it anymore. Plus I don't like wasting bandwidth syncing IMAP headers for spam.

Re:A trickle?!

[Jay L]

If everyone was publishing SPF-records and enforcing them, the problem would go away. The real problem is that most mailadministrators doesnt have a clue.

Actually, I just checked, and the real problem is people who think that a solution can ever be stated in the form "If everyone X, the problem would go away" for any values of "X". *

* other than "in the next 20 years would start Y". See, e.g., Unicode.

Re:A trickle?!

[Anonymous Coward]

From your site :

If you publish SPF records, you are going to be asking people to throw away genuine email which you did actually send. This is bullshit. If you publish SPF records, and use the servers indicated in the records to send email, there is no problem.

If on the other hand you want to set up some complicated forwarding system where a server lies about which IP the mail is actually from, it might fail. Frankly, if you're doing that I don't care if your mail is classified as Spam.

Re:A trickle?!

[Anonymous Coward]

Look at any mail server log, and you will see dictionary spam hell.

Re:A trickle?!

[jabuzz]

Far more productive to forward it to some email address at Barracuda.

Back when Sobig.F hit, I was on ISDN. At something like 50,000 emails I stopped even counting. However it was the 5000+ spurious bounces that was impossible to filter automatically, as every f&*$ virus scanner sent back different responses. What annoyed me most where the ones that kindly told me it was Sobig.F. So you know that it is a virus that exclusively sends out emails with forged from addresses and you choose to spam innocent victims.

Anyway I had a could of large corporations, who had sent in excess of 1000 bogus warnings each. I proceeded to bounce each and every bogus warning along with an explanation to a suitable contact email at said corporation. One responded with an apology, and said they had already turned this off. The other asked me to stop, but refused to stop sending the bogus bounces, claiming it was "corporate" policy. I told them it would stop when they stopped spaming my inbox. They got something like 2500 emails before Sobig.F was done.

Re:A trickle?!

[jabuzz]

Having been the victim of spam backscatter on several occasions in the last five years, it occurred to me some years ago, the solution to bounce issues was to insert random ID into each email as a header. Then track these against the domain they where sent to. Only bounces from matching domains, that contained the magic ID would ever get delivered.

Re:A trickle?!

[Anonymous Coward]

I never got any backscatter spam. We use Surgemail that has protected us from Backscatter over 4 years ago.

check it out and try for yourself. Beats Postini/web based filtering systems hands down. I use the IMAP system to best be efficient between multiple accounts and it removes about 99.999% of spam from my mailbox.

Re:A trickle?!

[ralphdaugherty]

What exactly do they have to gain by sending thousands of messages to one person (and this sounds like it was from one source)? Are they just trying to evade the spam filter, or do they perhaps think that if they just send enough, finally you'll start to believe them?

      As usual, the answer is follow the money. They are not sending thousands of messages to you, they are sending millions of messages to millions of email addresses. Their return address? Perhaps your address, or a made up address from a legitimate domain, but not theirs.

      They are not looking for a return email, a dialogue, a "could you send me some more info" stuff. These are professional thieves, crime gangs, mostly commies or at least third world socialists at best, out to clean the capitalist's clock and laugh at their ignorance and greed, of which we are exceedingly blessed with a bountiful harvest, or as Barnum said, one born every minute.

      By using legitimate domains as return addresses, they get through spam filters for blacklisted domains. But heck, domains? These are being sent from PC's taken over and added to zombie networks, so there is no domain. There's only some schmuck's PC sending out spam while he goes, "Geez, muy PC is slow. What's up with that dude? Hey, did you see this latest stuff I ripped off? Free downloads! kewl..."

      The emails generate business. They have links which will take over your computer while lieing to you about it. They pump up penny stocks, getting people to buy because wow man I can triple my money for a few dollars, man this is easy money, then they sell their stock they actually bought at a few pennies and you get to play musical chairs with all the other Wall Street wannabes.

      And of course getting you to click on a link that takes over your PC is just the start of many more adventures, such as logging your keystrokes and sending them to one of our good friends in Eurasia where they are analyzed for bank account logins, payPal, eBay, a login to your corporate network, logins to networks they will infiltrate to see if it's a military or financial or government network with lots of money and secrets.

      So in short, it's war, and backscatter is trivial collateral damage.

  rd

Re:A trickle?!

[Anonymous Coward]

Meh...

Nobody likes a whiner. You are now subscribed to more lists !

Re:A trickle?!

[Jurily]

Deleting false positives is not an option for me. The one in question was a reply for a job application for instance.

However, I do use "Delete all spam messages now" every couple of weeks, but only after giving it the trusty old eyeball-search.

Re:A trickle?!

[Jurily]

Seriously, what are you mods smoking? That was merely Informative at best... How exactly is detailing my own experiences Insightful?

Yes, I am complaining because I got modded up. Not because of the modding, but because of the wrong reasons for it.

Re:A trickle?!

[rolfc]

No, it is not, the page you are linking to is, tough.

Re:A trickle?!

[rolfc]

Well check again, because the worst problem is people who reject solutions on false grounds or because they dont want the problem solved.

Re:A trickle?!

[Brutog]

I work for an email security company. Let's just say SPF is great and all, but it's never going to hit the rate of acceptance needed to thwart this neverending garbage. BATV might be what you're talking about (Bounce Address Tag Violation) which is starting to see some implementation around the email scene.

Re:A trickle?!

[caluml]

Nice troll. No-one ever sent spam using your email address as the "from" address then? Lucky you.

Re:A trickle?!

[Eivind]

If your relationship to your SO is such that failure to respond to an email because the SO sent it to the WRONG adress ends your relationship, then really, that relationship was beyond hope a LONG time earlier, if indeed ever it had a chance.

Re:A trickle?!

[nuzak]

> Nice troll.

"retry" delivery failures are local.

And it was a joke anyway. Do try to keep up, old chap.

Re:A trickle?!

[kchrist]

If everyone implemented SPF and SRS now, e-mail address forgery would almost die out.

Fixed that for you. SPF is not a spam prevention measure, but rather a forgery prevention measure. It will do nothing when spammers register their own throw-away domains.

I'm already seeing mail purporting to be from sdw4e5e46thwetf.com (for example) with valid SPF records.

Re:A trickle?!

[caluml]

"retry" delivery failures are local. Well, I get enough of them from "non-local" email servers, so I'm afraid that you're wrong.
Of course, they could have well been configured with 0.0.0.0/0 as "local", which would explain all the spam seemingly being sent through them.
And the "nice troll" comment was an acknowledgment that you were trying to goad me :) Thanks, old bean!

Re:A trickle?!

[nuzak]

Brilliant! Jolly good! Cheerio!

Okay I think I need to down a case of Bud to re-americanize now...

Re:A trickle?!

[Raenex]

I wish Slashdot would just collapse the Interesting/Informative/Insightful into a single +Something, not sure what to call it. The distinction between the three are meaningless when it comes to reading, and "Insightful" is way overused.

Re:A trickle?!

[Jurily]

Let's call it "+Duh".

Re:A trickle?!

[Trogre]

Apple Mail does it a little better, letting you create one group of settings for an outgoing server and apply it to as many accounts as you like.

You mean just like Mozilla Thunderbird?

Re:A trickle?!

[Mr. Slippery]

If on the other hand you want to set up some complicated forwarding system where a server lies about which IP the mail is actually from, it might fail.

I'm sorry that you don't know how e-mail works. Forwarding is a standard part of it, and it's not "lying" in any way, shape, or form.

same wine, old bottle

[MollyB]

This story was preceded less than a month ago:
https://tech.slashdot.org/article.pl?sid=08/04/08/2258246

I had a bunch of these back then, now they are happening again. Here is some information about the subject.
http://spamlinks.net/prevent-secure-backscatter.htm

You should only get NDRs from your own ISP, as I undestand it. The other mail admins are being fooled by your spoofed return address, and should know better.

Re:same wine, old bottle

[shitzu]

You should only get NDRs from your own ISP, as I undestand it. Wrong. The mail message may pass several servers on its way to destination and you will receive NDR from the server that can not deliver to the next hop. I might in most cases be your ISP's, but that doesn't mean it is always the case.

Re:same wine, old bottle

[KinkyClown]

This story was preceded less than a month ago: https://tech.slashdot.org/article.pl?sid=08/04/08/2258246 No this message is a backscatter automated post so technically it's not a dupe.

Re:same wine, old bottle

[Anonymous Coward]

The mail message may pass several servers on its way to destination and you will receive NDR from the server that can not deliver to the next hop

Yes, the NDR will be generated locally and sent no further, or at best forwarded when the link is available. Under no circumstances is it legitimate to use the 'From:' header to send the notification backward along the forwarding chain.

Re:same wine, old bottle

[Skapare]

Any mail server receiving mail from outside of its administrative control needs to verify at that point if the email is deliverable. It needs to do the user lookup (got LDAP?) and anti-spam filtering right then. It also needs to check any quotas, then, as well (but this can be put in a database). Any server that can't do these lookups needs to either be taken offline or needs to just toss undeliverable mail into a blackhole (almost all of it will be spam because legitimate mail is very rarely sent to an undeliverable location). If it can't do quota checks, then don't have quotas (disk space is cheap, get over it).

There is very little need these days (of permanent internet access links) of having email hop from one server to another. Having a front end server to face the internet and a backend server to host the mailboxes is fine. But just make sure the front end can know what it needs to know to do its job (and not blindly forward everything). Front ends are where spam rejection should always be taking place.

In the end, there is no cause for a bounce message to go between email administrative zones (because the server that might send such a bounce cannot verify that it is complying with the SMTP requirement that such a bounce message go to the sender ... the true sender, not the forged email address).

Re:same wine, old bottle

[shitzu]

You are talking about best practices. In reality i see nonfiltering hosts generating NDR's all the time and there is nothing in the SMTP RFC prohibiting it. Yes, my servers are configured to refuse SMTP connection before queueing the DATA section if email is considered spam or the target mailbox is nonexistent or undeliverable, so there is no backscatter generated, but legitimate senders still get an NDR. Yes, in the ideal world everyone would do so. But in the real world it is not easily doable with many commercial mail servers (Exchange, Notes/Domino) - they queue the mail first and then start to generate NDR's for addresses that do not exist (which are usually either generated addresses like john@domain.com or badly harvested addresses like %3address@domain.com).

Re:same wine, old bottle

[libray]

There is at least one problem to address when sending NDR during the smtp conversation; Dictionary attacks. By verifying the user exists or not during this phase allows ratware to generate addresses and validate clean ones on the fly.

Re:same wine, old bottle

[Skapare]

Then those commercial mail servers are "broken" and must face the reality that many peer mail servers will elect to refuse email from them in the future. It's something that needs to be fixed.

Yes, this is a best practice. If it required a violation of SMTP to work, there would be big problems with it. That leaves either being exactly the same as SMTP (it isn't) or being a subset of SMTP. So the issue that it faces are people that say their mail server complies with SMTP and so they will leave it as is. My counter argument focuses on a subtle point where SMTP implies sending the NDR to the sender: they are violating SMTP if they send the NDR to the forged email address (that isn't the sender ... the spammer is the sender) ... if there is a way to avoid doing so (and there is in virtually all cases).

BTW, SPF is not the only way to determine reasonable validity of the sender email address. There is one test that for most domains will yield a true positive for legitimate email. It just needs to be understood that when it fails to yield a positive, that does not mean a negative (it means another means of validity checking is needed). That test is to see if the SMTP session peer sending the email is the MX host of the asserted sender email address (the peer IP address must match one of the A-records of one of the MX hosts). If it is, that mail server had the chance to validate and so we can assume it did. If not, then check SPF or other means to see if it is some domain using separate outbound servers or such.

Where's the news?

[dotancohen]

Where's the news here? I've been getting these for years. It's so bad that I filter bounce messages to a separate account on the server to download and review at the end of the week. I get almost as much backscatter as spam, both over 1000 messages a week.

Re:Where's the news?

[Lalo Martins]

What the man said. IIRC, I started getting "backscatter" in 1997 or 98.

Re:Where's the news?

[Anonymous Coward]

So you filter out the messages, and then spend time going over them weekly with more than 1000 messages to go over. Hmmm. Seems like a massive waste of time. You need some BATV, or someone with a lower pay-grade to go over them.

Re:Where's the news?

[Fweeky]

How much over 1000 a week? I get on the order of 1500 a *day*. Am I really getting ~10x as much spam as you, or do you just filter it more proactively with greylisting and stuff?

This needs to be a poll; quantity of received/filtered spam in an average day :)

Re:Where's the news?

[dotancohen]

Depends. I can start keeping count if you want, but anywhere from 800-5000 backscatters would not surprise me in any given week. That, plus 1200-7000 spam messages a week.

I now have four filter mechanisms at work:
1) All my contacts get a unique email address. Something along the lines of your-name@my-server.com
2) Spamassasin on the server.
3) Thunderbird's standard junk mail filter on the client.
4) Whitelist addresses of known contacts to my "whitelist" folder.

I see maybe 10-20 spam messages a day in my inbox, and the only time I get spam in my whitelist box is when a contact of mine is irresponsible with my address. I then change the address, scold the contact, and give him a new address until next time. I could not do this without the terrific Virtual Identities Thunderbird extension, which remembers which addresses I use to email each contact:
https://addons.mozilla.org/en-US/thunderbird/addon/594

The Inbox gets about 10-20 spams a day, the Tbird junk mail gets around 200 I think, and about once a week or three I grep the spamassasin folder on the server for anything interesting.

Spam costs me money, bandwidth, and time away from my studies, work, and family. Spam is the modern Chinese water tourture: one drop does nothing, but drop after drop my life is being eroded. Not just online life, mind you, but real life as the internet is no less important to everyday life than the telephone is today.
http://what-is-what.com/what_is/spam.html

Re:Where's the news?

[Sentry21]

Funny, I went from 200 spam/day to 1 spam/30 days (or less), just by implementing decent spam filtering on the mail server - and that's just the amount of mail that gets to my client. I don't have any client-side spam filtering, and I don't even use spamassassin, because frankly, we just don't need it.

I reject most messages before they ever send the payload, and I've got a few more ideas that will prevent them from getting as far as they already do (MAIL FROM/RCPT TO).

I'm cavalier with my e-mail address, giving it out pretty much anywhere, be it on forums, message boards, slashdot, 'put in your e-mail to download this software from this sketchy company', and so on. And still no spam.

I didn't really do much either, but it seems to me like it's working pretty well. Go figure.

Re:Where's the news?

[Ilgaz]

My mail provider, Fastmail.fm defends against false backscatter messages. Here is their method:
http://www.fastmail.fm/docs/faqparts/SpamSettings.htm#JunkBackscatter

Re:Where's the news?

[Skippy_kangaroo]

I'm cavalier with my e-mail address, giving it out pretty much anywhere, be it on forums, message boards, slashdot, 'put in your e-mail to download this software from this sketchy company', and so on. And still no spam.

No - lots of spam. But you filter it. That's like the little boy sticking his fingers in his ears and shouting "I can't hear you!" - the noise is still there, but less of it gets to his ears.

Try taking your fingers out of your ears/turning off your filtering and seeing the full picture.

Re:Where's the news?

[Larryish]

man, 7000 is weak i get at least 20,000 per week in my gmail box and that is without even trying you sissy

Please Try Again Spammer Dickwads

[pandrijeczko]

Nope, you're just getting a little backscatter

Nope, I'm not getting anything - procmail on my honeytrap spam email account sees it and stops it with a few simple filters

So please try harder, spammers, or go and get extensions to your obviously miniscule penises so you no longer need to take you inadequacies out on the rest of the world.

Re:Please Try Again Spammer Dickwads

[T-Bone-T]

You say you don't get any but then explain that it gets filtered, meaning you DO get some but you don't see it. Those are mutually exclusive. You can't not get it and filter it, otherwise there wouldn't be anything to filter.

Re:Please Try Again Spammer Dickwads

[pandrijeczko]

Apologies. It gets filtered.

I keep an email account for honeytrapping that I throw on every web site possible to make sure I get huge amounts of spam on it that I then test my procmail filters on.

Re:Please Try Again Spammer Dickwads

[smartfart]

You wouldn't want to share your filter rules, by any chance? Simply linking to procmail's website isn't exactly helpful.

Thanks.

Re:Please Try Again Spammer Dickwads

[rho]

Well, good for you.

Re:Please Try Again Spammer Dickwads

[pandrijeczko]

Yes, I certainly can do that but it may need to be Thursday I post it to this thread.

I'm out of the country on a short break (until Thursday) and whilst I can normally get to my home Linux server with SSH, I can't even ping it at the moment. Might be an ISP problem at home, I'll keep trying and if I can get into it, I'll grab procmailrc and post it.

Easy filtering solution

[Richard W.M. Jones]

There's an easy way to filter out backscatter while preserving bounce messages that you care about (ie. ones about email that you actually sent):

1. Add your own custom header to all your outgoing emails. Doesn't matter what it is, but it should be unique, eg. 'X-Really-From-Richard-Jones: xsomesecretx'

2. MTAs include the original headers in bounce messages, so discard bounce messages which don't contain your custom header.

You can even be smart and sign the header based on the content of the email using a private key, which would make it unforgeable, but at the moment you don't need to do that.

Rich.

Re:Easy filtering solution

[gbjbaanb]

interesting.. now, how do I do that in Thunderbird?

It may be slightly redundant though, all those emails bounced back at me are ones that are obviously spam - otherwise the recipient's spam filter wouldn't be bouncing them to me, and so you'd expect my spam filters to detect and delete them without any intervention on my part.

Re:Easy filtering solution

[Richard W.M. Jones]

interesting.. now, how do I do that in Thunderbird?

I've no idea. I used Thunderbird at work for a while, but got so sick of it that I replaced it with mutt and have been much happier (and calmer) at work ever since.

Rich.

Re:Easy filtering solution

[dotancohen]

Nice, thanks! Mods!

Re:Easy filtering solution

[djmurdoch]

how do I do that in Thunderbird? Set the custom headers preference.

Re:Easy filtering solution

[rjames13]

Go into Preferences->Advanced Tab and click Config Editor Button.

Alter the setting
mail.identity.default.headers
to include the string header1
note header1 is just a label
then add a new string called
mail.identity.id1.header.header1
Set the value of that to your X-line

From now on all mail sent from Identity 1 will have that header on it.

To create a filter based on that. Obtain an email with that header. Find a clickable link in the header and right click and select create filter from message.

At first from the drop down box you can't select that X-line so you need to go to the bottom and click customise. You can put that header in there. Now you can create a filter from it.

Re:Easy filtering solution

[guruevi]

You know, I have a digital certificate that does that for me. It automatically signs my e-mail and 'smart' filters and e-mail clients know that non-signed e-mail from me is not to be trusted as much.

Get your free personal certificate and if 2 people have certificates, e-mail gets encrypted between you! There are a number of providers that give them.

Re:Easy filtering solution

[MaufTarkie]

MTAs include the original headers in bounce messages, so discard bounce messages which don't contain your custom header.

Not all MTAs. Exchange doesn't, for example. Maybe it's been fixed in Exchange 2007, but I haven't upgraded to that yet.

Re:Easy filtering solution

[Mr. Slippery]

2. MTAs include the original headers in bounce messages, so discard bounce messages which don't contain your custom header.

Except that MTAs often don't include headers, or at least not all of them.

I filter a lot of bounceback spam by scanning for headers (I don't use an X-header, just for bogus Received: and Message-Id: lines), it definitely helps but is not foolproof.

Re:Easy filtering solution

[nuzak]

Exchange 2007 does include headers when using the SMTP transport. It's been pretty well-behaved in that area since 2005 or so.

Re:Easy filtering solution

[dangitman]

Thunderbird??? You delete that shit from your hard drive permanently. Isn't using that piece of shit worse than receiving spam?

Why is this only getting noticed now?

[gsslay]

I must have read at least 3 news stories about backscatter in the last week. Why is this only getting attention now when it's been a problem for years? Is it just because someone has coined a word for it?

I can remember years back when some spammer decided to use my domain name in their spam run. Hundreds of bounced emails every day and I cursed everyone of the dumb mail servers that mailed them; complete with original html email, images and any other crappy attachment. ("Hundreds" may be small potatoes these days, but they were a big deal at the time.) Just the very idea that spammers would supply a genuine reply address seemed so incredibly stupid, yet there they were; dozens of carefully worded variants of the same "naughty spammer, don't email me" reply. I could just see some smug sysadmin configuring their system with this badly thought-out garbage, thinking "ha! that'll show them!"

None of my mail servers since then have ever bounced spam or mis-addressed emails.

Re:Why is this only getting noticed now?

[statemachine]

I must have read at least 3 news stories about backscatter in the last week.

At least they're writing stories about it now. I'm glad they're finally publicizing this. I've published SPF records almost since SPF started, and it amazes me that people still don't set up their servers to check this before accepting a message -- which is the initial problem. The more publicity, the better.

Re:Why is this only getting noticed now?

[Tony Hoyle]

I rarely ever see it. Spammers normally use made up email addresses.. they're just using your domain name, so as long as your MTA is not allowing emails to arrive to nonexistant users you'll filter 95% of it as a part of normal operation.

Re:Why is this only getting noticed now?

[statemachine]

While it is rare considering the volume of e-mail I receive, I've noticed backscatter is gradually increasing. More and more admins are just installing anti-spam/anti-virus devices without learning which options to enable or disable.

so as long as your MTA is not allowing emails to arrive to nonexistant users
I wholeheartedly agree, but SPF won't even allow it to get this far. Why should clueless admins expect me to pick up their slack?

Re:Why is this only getting noticed now?

[Tony Hoyle]

Unfortunately so few ISPs support SPF it's not reliable. I've published SPF records for years on all my domains.. OTOH for incoming it merely gets a spam score - when SPF is used it is alas sometimes misconfigured so bouncing on it has too many false positives.

Re:Why is this only getting noticed now?

[mgh02114]

Just the very idea that spammers would supply a genuine reply address seemed so incredibly stupid

I'm not saying that this is smart, but they DO have a reason for configuring their mail servers this way: for the false positives. Those do have valid reply addreses. Ignoring the backscatter problem, I do appreciate it when Verizon tells me that it has blocked a message I sent to my mom.

Re:Why is this only getting noticed now?

[fendragon]

Why is this only getting attention now when it's been a problem for years?

As per original article, it's been getting much worse recently. On my own email, which is now pretty well spam filtered (and I kill a lot of spam because my email address has been all over the net for about 12 years) I've been getting dozens of backscatter messages a day in the last two weeks, when I used to get maybe one a month. Others (though not everybody) are seeing the same. That's newsworthy. It's helped that I found out how to get spamassassin to mark mailbounces correctly, but it doesn't spot them all and I may have to make some custom rules for some of the less usual mail agents that have different bounce message detection signatures.

Re:Why is this only getting noticed now?

[dangitman]

Why is this only getting attention now when it's been a problem for years? Is it just because someone has coined a word for it?

no, something has changed. At work, we have pretty well-maintained spam filtering, and I haven't seen a "backscatter" for years. But in the last month, they started coming in the hundreds. Maybe it has something to do with the sudden popularity of poorly-configured "anti-spam appliances" (Barracuda, etc.) mentioned elsewhere in this discussion? In other words, the popularity of anti-spam measures is increasing inadvertent spam?

Re:Why is this only getting noticed now?

[wjbaird]

Well - in my case I went from gettinng a couple of these a day to getting over 500 a week in the last month.

If my case is anywhere near typical, that could explain why it's getting a lot of attention now...

For fsck's sake

[blind biker]

Hasn't this crap been going on long enough? Aren't people tired of spam - tired, as in totally pissed! I know I am.

Something drastic should be done about it, yesterday. Doesn't matter if it fails at first, I just want to see some political will. As it is, it seems like noone who has the power, gives a sh*t.

Re:For fsck's sake

[KinkyClown]

I agree but I don't it's possible to scrap 'email' as we currently know it and replace it with 'email 2.0' that uses protection because we would have to migrate all together. Same reason we are still waiting for IPv6 (because no one wants the extra costs involved with IP4-to-IP6 gateways).

Re:For fsck's sake

[Mattsson]

Start spreading the word:
"Anyone who sends spam is a terrorist!"
Add random bogus reason, like "spam finances terrorism" and tag a "think of the children" on at the end.

Sooner or later, someone in power is bound to fall for it.

Re:For fsck's sake

[Gavagai80]

The junk in my physical mailbox is more annoying, and such junk mail has been going on for centuries without a solution. So I don't think you can expect a solution to non-physical spam either.

Re:For fsck's sake

[Zorque]

You have a point, spam helps finance the Russian mafia, and who knows who they're involved with.

Re:For fsck's sake

[phoenixwade]

The junk in my physical mailbox is more annoying, and such junk mail has been going on for centuries without a solution. So I don't think you can expect a solution to non-physical spam either. You really think junk mail is over 200 years old?

Re:For fsck's sake

[maxume]

If Ogg was good at making axes, I bet he put fractured animal skulls by other Ogg's huts.

Let Ogg hear, Ogg make Ogg axe! Ogg!

Re:For fsck's sake

[blind biker]

I dunno about your place, but here we only have to put "Ei mainoksia" ("No commercials") on the door/postbox, and voilà, no more junk mail. Besides, physical junkmail is much easier to fight because it costs SOMETHING to send. It costs NOTHING to send e-mails - hence the problem (for most of us anyway - looks like you have lucked out).

Re:For fsck's sake

[KillerBob]

There's a solution to physical spam.

http://www.reddotcampaign.ca/
And in the USA:
http://www.forestethics.org/

I don't get junk mail in my box. Haven't for a long time.

Re:For fsck's sake

[eck011219]

I don't recognize the language, but I'm guessing you live somewhere where there are only a couple of languages commonly spoken. Here (Chicago), the people who put pizza menus, roofing company fliers, lawn care fliers, and other ads on our door may speak any one of (conservatively) five or six languages. I made a "post no bills" sign in five languages (English, Spanish, Polish, French, and Russian), but my wife won't let me hang it. She thinks it will make us look unwelcoming. Indeed, to these people who barf their ads all over our front steps, it would. So we now have a separate can inside the door just to throw the advertising crap into.

And that's not even the stuff that gets sent -- that's just the stuff that people walk up and put on our doorknob or car windows.

Re:For fsck's sake

[dangitman]

But all you have to do to stop that is put a "no junk mail" sign on your mail box, and it all stops. All of it. It's too expensive for the marketing companies to risk going to court by disobeying the sign.

Re:For fsck's sake

[Mattsson]

Hmm... True. Someone is supplying Russian-made hardware to people who can't buy their weapons officially, and the Russian maffia is probably one of the suppliers.
But I'd rather say "Terrorism and spam finances the Russian maffia" than the other way around then.
I doubt that the money earned by that organization find it's way into the pockets of terrorists anywhere in the world and I doubt that the maffia would go out of business, thus lessening the amount of black-market Russian weapons a little bit, if they didn't have any spam-income.

Easy anti spam system

[Anonymous Coward]

My easy anti spam system would block this. Only works if you have your own domain, though.

I have anyemail@mydomain.com forwarded to a gmail account, which then forwards ONLY email with a certain extension (for instance, somesite.spam@mydomain.com) to my private email address. The bonus is, if you use a different email address for each site (for instance, slashdot.spam@mydomain.com), you can nail down the sites that spam like crazy (not that slahdot would do such things :-)!

Re:Easy anti spam system

[bhtooefr]

There's a modification of that system that works for most stuff, even if you don't own your own domain, although a few providers (*cough*hotmail*cough*) treat it as invalid.

The downside is that the real address can rather easily be backed out of the address.

For the address user@example.com, one could provide Slashdot with user+slashdot@example.com.

Of course, a spambot could just delete everything from the plus to before the at sign, and still get you. But, it still gives better sorting if you don't make the address public.

Re:Easy anti spam system

[Anonymous Coward]

This also makes the origin of automatic summaries clearer, so that it becomes trivial to write scripts to sort summary messages into a specified folder or handle in some other way. It also means you can tell where your email address got scraped from, so you can replace it with a new one, taking care to prevent it being found again.

clicking next ? youve been splogged

[Anonymous Coward]

1280px wide layout but the column with the actual content in is only 200px the other 1080px are dedicated to adverts and sponsors

i think that computerworld site is a classic example of a site that cares nothing for its readers (like spam) and is only a means to an end, when a site has more space dedicated to advertising than content you know you've hit a spam site

funny how they are telling us about spam while promoting more adverts on a single page than a spam message has

What's new about this?

[Anonymous Coward]

I lost my "email for life" account (randeg at alum.rpi.edu) nearly five years ago because of backscatter. I got a lot of it because that address appeared in-the-clear in libpng and zlib documentation. The people at RPI did not understand the backscatter phenomenon, and I assume they are still getting plenty of it.

Re:What's new about this?

[statemachine]

Eternal September.

Sure, I once got angry at people who sent me spam and bounced it back to the sender with a nastygram. But that was 1995. There wasn't SPF, and there weren't content filters. And most installations were open relays on Sendmail. Administering e-mail was simply giving someone a home directory and pine.

Nowadays, the e-mail administrators are the biggest enablers. If they just checked SPF records and stopped automated bounces after a content filter determines it's spam.... It's also up to the admin to educate their users. But, there will always be clueless new admins and new users.

Re:What's new about this?

[caseih]

Except that SPF causes at least as many problems as it solves. That's why few people are really implementing it, or at least relying on it. SPF is at best a mere suggestion as to how to deal with a message. It fails to take into account things like relaying and people who are forced to use local ISP mail servers.

Solution

[Anonymous Coward]

Cant we just bounce these messages?

"legitimate?"

[Michael Hunt]

As a 9-year veteran of the anti-spam industry (with experience within the regulator, although I've left that behind me now and work in telecoms,) it's a REAL stretch for anybody inside the IT industry to take these kinds of comments seriously.

Anybody who says that 'legitimate' mailservers are sending backscatter instead of 5xx-ing the message in transit is wrong. Mailservers which send backscatter are NOT legitimate, EOL.

- A pissed off mail admin.

Re:"legitimate?"

[Anonymous Coward]

Airport Announcer: "Mike Hunt? White Courtesy Telephone, please. Mike Hunt..."

Parents had a sense of humor?

Re:"legitimate?"

[Tony Hoyle]

For spam even a 5xx is wasted... spammers don't care. File it in a spam folder or simply drop it on the floor. I agree replying to it with a new message (which is what these misconfigured servers do) is utterly moronic. Personally I just report such servers as spammers. Automated ones, but spammers nontheless.

Re:"legitimate?"

[mlts]

Agreed. Microsoft Exchange 2007, out of the box, does not bounce messages it gets. It either gives an error code and refuses to process the message, or it accepts it. An Exchange admin can configure rules for messages to bounce (say someone is trying to carbon copy multiple internal company distribution lists), but its nowhere near the default settings.

I wonder if backscatter has been used as a threat for extortion sometimes. A few years back, I was seeing spammers E-mail people who owned domains threatening to use their email address as the From: header for subsequent spam if they didn't pay some thousands of dollars, then later on (days/weeks), backscatter would start hitting that username. One of my addresses that I used to use for years got hit by so much backscatter that I eventually just added a whitelist, added in a ruleset with password that would autoforward anything that had that word in the subject or body, and had procmail just dump everything else.

Re:"legitimate?"

[Michael Hunt]

If Aunt Tillie sends me a message (forwarded from Betty, her next door neighbour, which was in turn forwarded from her nephew Boris, who goes to school in another city) which just happens to look like spam (who knows, maybe Boris is telling an amusing anecdote about how one of his friends stumbled across some h3rb4|_ v!agr4 or something,) I'm going to look like a fair dick if the message gets dropped on the floor and Aunt Tillie doesn't at least get notified that the message got eaten.

The 5xx range of status codes exists for this (and other) reasons, there's no reason NOT to use them (by performing content verification inline and either 2xx-ing or 5xx-ing the message between "." and "QUIT".)

Re:"legitimate?"

[Palinchron]

So what is the proper response if Aunt Tillie forwarded the mail to both me and my brother (both of who have a mailbox on the same server) in the situation that I want my spam dropped whereas my brother wants his spam delivered for manual checking?

There will be a single mail with two recipients, one who doesn't want the mail and one who does. Should I 5xx the mail (even though my brother wants to receive it) or should I 2xx it and drop my copy silently? AFAIK, there's nothing in between.

Re:"legitimate?"

[oglueck]

Well... what happens if the account runs out of quota? Or any other reason that the final delivery to the mailbox fails. What do you do with the message? You can't just delete it, can you?

Re:"legitimate?"

[Anonymous Coward]

Actually much nicer than just using 5xx codes is sending Delivery Status Notifications because that provides a standard machine-usable way to determine which original mail got bounced.

Re:"legitimate?"

[C0vardeAn0nim0]

problem resides on mail relays that don't perform a directory search during the envelope phase. dan bernstein's qmail is a big ofender in this area.

in this kind of mail relay, all messages are accepted in a queue, then a separate proccess checks if the recipient is valid. if it's not, a bouce message is generated an placed in the outgoing queue.

with this behavior, the receiving server is in charge of creating and sending the bounce message, wich is a waste of time, badwidth and allows backscater to work. other MTAs (sendmail, postfix) do directory checking during the envelope, answwring with a 5xx message as soon as an invalid RCPT is issued. in this case, the bounce message is generated by the sending MTA. is much easiear to stop backscatering this way, not to mentios the savings on bandwidth and helps avoid denial of service atacks.

i've replaced qmail with postfix in an ISP i worked sometime ago for exactly those reasons. an attempt to use my server to relay backscater spam ended up DOSing the server. 'twas a PITA to clean up.

Re:"legitimate?"

[Anonymous Coward]

As a 9-year veteran of the anti-spam industry (with experience within the regulator, although I've left that behind me now and work in telecoms,)

Regulator? What regulator? There are a few RFCs that define SMTP, but that's it.

There is no email regulator.

it's a REAL stretch for anybody inside the IT industry to take these kinds of comments seriously.

It's also hard to take seriously someone who claims that there is an email regulator.

Anybody who says that 'legitimate' mailservers are sending backscatter instead of 5xx-ing the message in transit is wrong. Mailservers which send backscatter are NOT legitimate, EOL.

There are many cases where a mail server is unable to reject immediately and has to issue a delayed bounce. The main one is outsourced backup MXes.

Re:"legitimate?"

[tompaulco]

Mailservers which send backscatter are NOT legitimate, EOL.
Why blame the mailservers? The real culprit is the spammers. If they didn't illegally fake their return address then there would be no need to configure the mail server to recognize fakes and reject them.
I figure that what the spammers doing amounts to identity theft, and they should be forced to pay $1 million restitution per occurrence to the account owner and if there is no such account, then the domain owner.
I've had days where I've gotten over 1,000 backspatters, and sometimes angry threatening personal e-mails directed at me regarding the "spam you sent me".

Re:"legitimate?"

[CRiMSON]

Then you didn't have qmail setup properly. Adding to the issue. Thank you for moving to postfix.

Re:"legitimate?"

[RaymondRuptime]

And to extend the "Aunt Tilly" thread... for those of us who mail admin a business, if a customer mistypes an address and gets no 5xx, bounce, or any other sort of response, they will presume that their msg has been received, and get p!ssed off when no action or response is forthcoming. Not to mention the backscatter from the fan down to IT if Tilly happens to be the aunt of the CEO. Dropping them might be reasonable for your personal mail server, but for a business it is a career limiting choice.

Re:"legitimate?"

[Xenna]

I had the same problems. The server was bombarded with spam and couldn't process its normal mail. I fixed it by installing qpsmtpd http://smtpd.develooper.com/ , a fully programmable Perl smtp daemon that can function as a front end for qmail or postfix.

I needed some fancy logic, because I use mailing lists with dynamic addresses that have to be refused /accepted intelligently. Qpsmtp does that well.

Re:"legitimate?"

[RealUlli]

Actually much nicer than just using 5xx codes is sending Delivery Status Notifications because that provides a standard machine-usable way to determine which original mail got bounced. That's what's called backscatter. Use 5xx codes and let the sending eMail server worry about generating a DSN - that's what the 5xx codes are for.

Rgds, Ulli

Re:"legitimate?"

[Anonymous Coward]

Aunt Tillie? You've been reading too much ESR, no?

Re:"legitimate?"

[miles zarathustra]

Here's a simple way to eliminate 80% of backscatter:

Ban qmail from the internet!!

The stock version doesn't check for validity until after the connection with the SMTP server has broken. Then it obediently sends the bounce to the reply-to address. Yuck!

Re:"legitimate?"

[Michael Hunt]

It's also hard to take seriously someone who claims that there is an email regulator. Let me clarify.

There's various regulators around the world that police various Anti-Spam laws.

If you _REALLY_ care, a quick check of my posting history would probably tell you which one.

PS: You're a fucking idiot.

Re:"legitimate?"

[Michael Hunt]

From bitter experience, a good 50% (at least) of the badly configured qmail installs i've come across have been installed as part of Plesk (http://www.swsoft.com), which is one of those hosting control-panel things that 2-bit hosting companies who have no business selling mail hosting use to sell their service to equally 2-bit idiots who have no business reading email.

djb has a lot to answer for. It'd be OK if he'd accept that he was wrong once in a while.

Re:"legitimate?"

[tokul]

You missed all other local delivery agents that don't provide mta information about user accounts.

Re:"legitimate?"

[kchrist]

It's my understanding that this is Qmail's default behavior. If this is correct, than it's not that it was not set up correctly, but that the default configuration is broken. Thus, the responsibility lies with the Qmail developers.

Re:"legitimate?"

[kchrist]

I'd say you should accept the mail at the MTA level, and then process it according to your server's spam policies for messages that could be legitimate. Assuming you don't reject everything that looks like spam, you probably have some sort of scoring system (be it SpamAssassin or whatever). Score the message and deliver it to its recipients. If your spam threshold is lower than your brother's, your copy can be deleted, while his can be delivered, either into his mailbox or a spam folder, as appropriate based on the score.

Re:"legitimate?"

[Slashdot Parent]

It's my understanding that this is Qmail's default behavior. Not only is it qmail's default behavior, it is qmail's ONLY behavior unless you patch it. GP was is just misinformed, an asshole, or both.

I have just reread GP's post, and have concluded that GP is both misinformed and an asshole.

Re:"legitimate?"

[Slashdot Parent]

djb has a lot to answer for. It'd be OK if he'd accept that he was wrong once in a while. He's dead wrong on this one.

He defines "secure out of the box" as "no remote root holes". That's a pretty stupid definition, IMHO.

Attention DJB: if your software can be turned into a spam relay out of the box (via backscatter), it is NOT secure.

Re:"legitimate?"

[Palinchron]

So my copy of the mail still gets silently dropped, which is a bad thing according to GP.

A Death from Shame

[Anonymous Coward]

Old chinese proverb:

"Fool me once
Shame on you
Fool me twice
Shame on me."

FTFA:

At its worst the phenomenon can even wipe Internet servers off the map.

While one might say that some servers should die of shame apparently they truely can.

Last month, Stephen Gielda, president of Packetderm, upset a fraudster who was trying to use his anonymous Internet service. Soon his servers were inundated with a tidal wave of backscatter messages. At one point, he was being hit by 10,000 bounceback messages per second, enough to throttle the server's Internet connection.

SPF + !SRS!

[spottedkangaroo]

It seems like the solution to "backscatter" has been around for quite a few years (SRS). I'm surprised how few of the commercially available anti-spam solutions use or interpret it.

At my company, we just looked at Barracuda (PoS), Pineapp, St. Bernards ePrism, MX Force, Postini, and some other things. None of them understand SRS and only a few of the tech contacts had even heard of it. Sad Sad. But they all seem to have hand-rolled "backscatter" protection that partially works.

It seems like everyone has an SPF record these days. But it feels like relatively few actually check them and almost nobody goes the full distance and uses SRS.

Re:SPF + !SRS!

[Anonymous Coward]

Interesting list, especially considering that Barracuda (PoS) and Postini are exactly the entities responsible for the biggest identifiable source of my backscatter traffic.

But seriously, why is this news? Backscatter has been a problem for ages now. Did some reporter finally get the brunt of it?

Re:SPF + !SRS!

[spydir31]

Here's the solution to backscatter:

1. only relay authorized messages
2. reject as soon as possible. no bounces.
3. do not send out virus warnings, spam warnings, challenge-response requests

Re:SPF + !SRS!

[Fjan11]

Dropping incorrect addresses is technical "solution", but not a user friendly way to deal with the problem. It's bad engineering.

Just enforcing SPF by itself would already go a long way to fixing this, and cure a lot of other spam in the process.

Re:SPF + !SRS!

[Tony Hoyle]

There's a reason - such a scheme breaks many anti-spam measures and is a particularly poor way to do it.

I've seen such crap in my logs and didn't realize what it was.. it fails sender verification and gets dropped as spam anyway. Lying about who you are to a mailserver is not the way to solve spam.

Re:SPF + !SRS!

[Anonymous Coward]

It's true, more people have implemented SPF records in DNS, but still are waiting for the mail servers to catch up. It's easy to understand why... zone records are easy to create, and there are pleenty of SPF generators out there. But patching/upgrading your mail server to check SPF requires time, and time is money.
MailEnable is one packaged server that has SPF builtin... too bad it only runs on Windows,

Re:SPF + !SRS!

[spottedkangaroo]

I don't think it lies about who you are. It certainly shouldn't break any anti-spam measures.

It makes the return path verifiable to the sender and if you decode it the original return path is there (with exactly the same reliability as before: 0).

So I guess I don't understand your argument at all.

Re:SPF + !SRS!

[spottedkangaroo]

SRS isn't about dropping incorrect addresses. It's about droping fake bounce messages (DSN) that aren't signed/generated by the server that's supposed to accept them.

Re:SPF + !SRS!

[Anonymous Coward]

Because its hard to get the SPF checking right. And if it isn't right you can have a high number of discarded messages (false positives).

I've just re-read the FAQ at the openspf site last week and decided again this year against trying to get it right.

Re:SPF + !SRS!

[spottedkangaroo]

I don't think they'd be false positives. If the SPF record is wrong, they're just regular old delivery errors.

Re:SPF + !SRS!

[spottedkangaroo]

See, I thought this was incoming bounces, not outgoing ones. Not sending bounces won't stop incoming ones, which is why I suggested SRS. That way you can definitely tell which ones are fake.

Re:SPF + !SRS!

[Anonymous Coward]

Here's the solution to backscatter: Why not propose a "solution" like taking down email entirely ?

Although your "solution" will in fact kill backscatter, it will most likely kill a lot of other messages too, making email in its whole undependable (at a time where some courts-of-law regard a send email as good as a hand-delivered snail-mail)

Re:SPF + !SRS!

[ralphdaugherty]

      I have Postini on my email account and it blocks almost all spam, and about 80% of this non-deliverable stuff.

      The first time you get it is very shocking, hundreds of emails coming in at once, but I just highlight the first header in my Inbox, hold my finger down on the arrow, and highlight whatever gets through Postini, then hit Delete. Pretty easy to see legitimate mail from these undeliverable messages.

      So very easily taken care of, easier than blocking the forum spammers who apparently use email addresses from a site server where they are not able to get through to spam the forum.

      If you don't have a spam blocker and are set up for your PC to talk to you everytime an email arrives, then one of these attacks would be the start of a long relationship.

  rd

Implement at MTA, not MUA

[Doctor O]

Unless you like playing around with your user's machines a lot, you should better implement that at the MTA level and configure your mail server(s) so that they include the header.

Or you could just use SPF, which basically does the same thing, only more elegantly.

Re:Implement at MTA, not MUA

[Richard W.M. Jones]

Unless you like playing around with your user's machines a lot, you should better implement that at the MTA level and configure your mail server(s) so that they include the header.

Sure ...

Or you could just use SPF, which basically does the same thing, only more elegantly.

SPF doesn't do the same thing at all. It relies on the receiver MTA to do something about the non-matching SPF records, which evidently many don't (or at least, I've got proper SPF records, but still get huge amounts of backscatter spam).

Rich.

Re:Implement at MTA, not MUA

[nuzak]

SPF purports to be an anti-forgery tool, and doesn't do anything about backscatter. The server generating the backscatter is not forged, it's simply acting as an open relay. Perfectly legitimate in the eyes of SPF.

BATV is the anti-backscatter technology here. You can think of it as acting like TCP sequence numbers: it gives each message a secure sequence number in the headers according to some simple algorithm (it doesn't have to be really strong crypto). A bounce is like a NAK, and you discard any such message that doesn't contain a matching sequence number generated from within your sending window (typically a few days). There may be some backscattering servers that will mangle the headers on a "legitimate" bounce and lose the sequence number, and they're considered a casualty -- the alternative would have been to blanket-block them anyway.

Re:Implement at MTA, not MUA

[Doctor O]

SPF doesn't do the same thing at all. It relies on the receiver MTA to do something about the non-matching SPF records I'm not talking about a remote receiver, I'm talking about bounces. SPF, at least the way it's implemented here, includes a custom header in outbound messages which our mail scanner recognizes when bounces arrive. Frankly I thought that was the standard way of implementing it, but considering your and especially nuzak's posting, I stand corrected.

That said, after being sick and tired with the subject and the rising amount of work involved, I bought the "ESG service" (E-Mail Scanning Gateway) from our ISP for a few bucks a month and be done with it. With it comes antivirus (infected mail never hits my mail server because it's filtered at the gateway), SPF, and a chain of several different anti-spam tools. I've never looked back.

None here.

[Rakeris]

I have never gotten any "backscatter". At least to my knowledge. Hopefully it stays this way!

Extension?

[dreamchaser]

"go and get extensions to your obviously miniscule penises "

I think one of their products can help them with that.

Where

[Wowsers]

I don't have any of these "bounce" messages. I don't know it it means I have no nerdy friends, or I have very good rules for dealing with spam.

Backscatter: Say goodbye to your catch-all account

[SoupIsGoodFood_42]

Every so often, I'll get backscattered for a few days with the catch-all e-mail account I've setup for my domain. Since I'm lazy, I usually just log-in to my ISP and set up an alias to redirect to another mailbox I have set up for this crap. If it gets any worse, then I'll have to look at a real solution, or even drop my catch-all account, which would be a real pain.

Postfix has a solution to this

[AftanGustur]

See here http://www.postfix.org/BACKSCATTER_README.html

The trick is to use the "header_checks" and "body_checks" to look for signs of the email having being sent out from your email server in the first place.

No backscatter here.

[cryptodan]

I have hardly received any back scatter on any of my email addresses with Comcast, Yahoo, and my very own personal one. I guess im one of the fortunate ones. Could you all post the headers of these so called messages, so I can be on the look out for them.

Re:No backscatter here.

[ralphdaugherty]

      The only ones that I know about and make sense to me are undeliverable messages from email servers that got email from a spammer using some bogus from address with your domain. If you don't have a domain and mail server, I'm not sure how often they'd use something like a legitimate personal email address, if ever. Unless they happened to use your personal address as a bogus from address for spamming, you'd never see undelierables backscatter.

  rd

Re:No backscatter here.

[cryptodan]

I have my own domain and email server and I do not see anything like this.

Re:No backscatter here.

[ralphdaugherty]

I have my own domain and email server and I do not see anything like this.

      Right, I rarely see it. Just so happens I was on the receiving end the last two days, over with now. (One came in even as I typed that. :)

      By no means do I have a high traffic site. However it does have a high ranking in Google search results and well known software to spammers (phpBB), so I am visited around the clock by attempted spammers and occasionally my domain is used as a bogus from address for spamming, but they switch around quite a bit because once you're used your domain makes blacklists (as many of the spam refused message in the bounceback indicates).

      If spammers for the most part are able to register on your site they will register and leave the malware links every so often. If they get blocked you end up being used as a from domain for a huge spam attack, I am quite sure partly to mostly out of revenge, as if, maybe next time you'll know better than to block us.

  rd

AOL

[eulernet]

I'm a victim of this sort of spam since several years, and it may happen to anybody that has an email address since a long time.

A few years ago, AOL always blocked my legitimate emails to AOL users, due to the fact that my email address was blacklisted due to this spam infection.

SPF Record

[Anonymous Coward]

If you own the domain you can make it more difficult for spammers to spoof your email with an SPF record

http://en.wikipedia.org/wiki/Sender_Policy_Framework
http://www.openspf.org/

I've been getting "backscatter" for years...

[Panaqqa]

It used to really bug me, that someone was sending out spam and using my legitimate email address in the From, Return-path and Envelope-from headers. I began filtering out the "Spam received from YOU" type headers years ago. But what still bugs me about this is those people who set their systems up to add me to some domain based rather than IP address based block list based on these faked headers. For more than a year I have been unable to successfully send email to my insurance company due directly to this issue.

Then again, I have never regarded email as a reliable method of communication. Everything truly important goes with a read receipt request and if I don't receive one then I phone or send snail mail. I continue to be amazed by the number of screwups I continue to hear about where someone says "I never got [such and such] email."

Re:I've been getting "backscatter" for years...

[jimicus]

Then again, I have never regarded email as a reliable method of communication. Everything truly important goes with a read receipt request and if I don't receive one then I phone or send snail mail. I continue to be amazed by the number of screwups I continue to hear about where someone says "I never got [such and such] email." As an admin, let me assure you that no (competent) email administrator has email randomly disappearing into the Magical Land of the Email Fairies.

I have had more people than I care to remember come to me complaining that "X says they sent me an email and I never received it, can you look into it?". Every single time I have been able to tell them exactly what happened. 8 times out of 10 the email's sat in their Inbox and they just have such a cluttered inbox that they can never find anything. (The other 2 times it's an internal mail that the sender sent to a number of people, but the complaining recipient isn't one of them).

Re:I've been getting "backscatter" for years...

[Panaqqa]

I did not mean to suggest that a competent admin would ever lose legitimate email. The problem comes in many forms, but the biggest culprit is anti-spam filters. These days it seems that everybody and their cousin wants to spam filter your email. ISPs arbitrarily apply such filters to their users accounts, often without any notification. Hosting providers and domain registrars often do the same. System admins, under pressure from management, put in place imperfect solutions and compound the issue by misconfiguration. I employ some network admins myself to help clients with server problems. The number of times I have seen a program such as "Spam Assassin" set to an incredibly aggressive setting AND to delete flagged mail without it ever hitting an inbox is surprising. I have one client right now that has not been able to email their parent company for over 6 weeks. Their messages blackhole. And it is not as if the parent is unsophisticated: they are in the financial sector and employ 17,000 people. And of course nobody in their IT department will admit that any email is being blackholed.

I personally am one of those who would like to see a new email protocol built from scratch with the spam problem as foremost consideration in the design process. I have a dislike for anything in IT that only "works most of the time", and that's where email has been for quite a while now.

My 2 cents. Another 2 cents that is.

Re:I've been getting "backscatter" for years...

[mr100percent]

I wonder if you can sue them for infringing on your copywritten email address...

Re:I've been getting "backscatter" for years...

[Anonymous Coward]

No screws ups are caused by people that take phone calls, because they can't ever say they "never got [such and such]" voice message.

Re:I've been getting "backscatter" for years...

[jimicus]

Every single one of the problems you discuss can be boiled down to incompetent systems administration.

In my experience, incompetent systems administration can make anything work only "most of the time", regardless of how reliable it was designed to be.

Re:I've been getting "backscatter" for years...

[Anonymous Coward]

People who run hobby/toy systems have no idea what it takes to run even a mid-size corporate system.

At large businesses email gets deleted automatically all the time. Some of my users get 2000 spam per day and they do not want to see it. Other times it's porn and we'd get sued for having a sexually hostile workplace we delivered it to the desktop.

So yes email does get deleted.

Re:I've been getting "backscatter" for years...

[hacker]

"Everything truly important goes with a read receipt request and if I don't receive one then I phone or send snail mail."

You must call and snail mail a lot, because "Read Receipt" is only applicable when you're on a local LAN, and if you're sending mail within your local LAN and people don't receive it, it's an issue for your IT group or Help Desk Mail Administrator.

This "Read Receipt" thing you speak of, does not transcend Internet-bound email. Where would it get sent back from? The first machine that received your email? The first hop? What if there were 20 hops? What then?

At best, the Read Receipt gives you an indication that the email you sent, was received by at least the first hop in your destination. It doesn't in any way, indicate that a person at the final destination opened and read that email. Check the RFC.

Re:I've been getting "backscatter" for years...

[nine-times]

In my experience, incompetent systems administration can make anything work only "most of the time", regardless of how reliable it was designed to be.

In my experience, a lot of problems are caused by incompetent systems administration, but even more are caused by stupid defaults on software. Because often the "incompetent systems admins" will set up software and leave it in the default configuration.

So you're right that no system, however reliable, will stop stupid/malicious people from messing things up. However, a good system can prevent careless people from causing problems under normal circumstances.

The reason I'm pointing this out is everyone is so quick to blame problems on incompetent admins, saying, "Well of course they should have set up there server with [insert spam solution here]!" And then of course people are afraid to even ask how to implement said spam solution because you've just been told their incompetent morons for failing to already have it set up. After a little bit of searching the internet, they'll see other posts where people are saying, "I don't want to use [insert spam solution here] because it causes [insert problem here] and doesn't really work anyway!"

However, if e-mail software just came pre-installed with "proper settings" (whatever those proper settings are) or at least clear instructions on best practices, some of those "incompetent admins" would do a better job.

Just my 2 cents (as an incompetent admin).

Re:I've been getting "backscatter" for years...

[chromatic]

Shouldn't a copywriter get a lot of advertising messages?

Re:I've been getting "backscatter" for years...

[jimicus]

Unfortunately, you've basically got two options with anti-spam solutions:

1. DIY using tools like MailScanner (which, to be fair, is a framework rather than a spam filter), SpamAssassin

Pros: You control everything and can react pretty quickly to changes in the type of spam you're seeing.
Cons: You cannot hope to administer it reliably without spending a long time learning it properly.

2. Appliances - either in the form of "Insert CD, click next next next and bingo! you've got an anti-spam filter" or in the form of "we'll ship you a 1U device which does everything", cf. Barracuda.

Pros: Quicker and less expertise required to get up and running....
Cons: .... so you wind up with it being administered by someone who doesn't really understand it and so can't deal with cockups.

Though even as a competent admin, the supposedly leading mail servers still have a few "issues" which make preventing backscatter very difficult - eg. you can set up a relay with postfix and have it contact the final destination mailserver to authenticate the address for every incoming email. Which is great - it means you can reject email with no valid recipient at an SMTP level rather than generating a bounce.

Except if your internal mail server crashes - then Postfix will reject any email addressed to an address it hasn't already cached. AFAICT, the official Postfix recommendation is "Well, you'd better hope nothing ever goes wrong with your internal mail server then".

Re:I've been getting "backscatter" for years...

[Wilden2003]

You can't copyright a fact or an idea, just as you can't copyright a single word. You can only copyright the creative expression of facts or ideas. Note the creative part, it's important.

You would have to trademark your email address. And then sue *everyone* that used it. Got money?

Re:I've been getting "backscatter" for years...

[ratboy666]

After trying out "anti-SPAM" solutions, I have reverted to no such protection on my domains. I do not allow
relaying, but I also do not filter ANY messages.

If a user gets thousands of SPAM... well, its the nature of the beast.

After all, why would I compound theft of bandwidth with theft of compute resources to even LOOK at it? If the SPAM producers kill email, well, they kill the golden goose. After all, if no one reads it, it WILL go the way of USENET.

RIP SMTP, your time is near. Either that, or the spammers will reign in.

Since my domains do not produce SPAM; not even the tiniest morsel, I do not feel it is my problem (and if any of my users produces SPAM, I will immediately cut them off -- even as it is being produced). As it is, all outbound mail is relayed by my ISP, and they only allow 10 username/domains that are NOT theirs (new policy).

Frankly, I have given up giving a shit about SPAM, or anything having to do with it. If too much bandwidth is consumed, I will simply stop using email.

RIP SMTP

Re:I've been getting "backscatter" for years...

[Stormie]

I continue to be amazed by the number of screwups I continue to hear about where someone says "I never got [such and such] email."

I think you'll find that that's not so much due to email being unreliable, but rather due to email providing such an excellent opportunity to cover up a screwup by saying "I never got [such and such] email."

Re:I've been getting "backscatter" for years...

[dbIII]

I continue to hear about where someone says "I never got [such and such] email."

Almost daily I have a request to check the spam trap and often the real reason is the user hasn't heard from her boyfriend since morning or salesfolk promised they would send something in an email immediately.

Change the RFC for bounce messages

[WGR]

Bounce messages should go to the postmaster of the domain that sent the message (the last Received: line before your MTA), rather than the "sender" in the From: header. That way, the actual forwarding server will be notified that it is being used to send spam and should be able to prevent further misuse. That also means the true sender gets the problem, not innocent bystanders.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Not "legitimate" mailservers

[geminidomino]

If an MTA is sending backscatter, it is not legitimate, it is broken. The MTA should NOT be looking at the FROM header to determine where the error goes. Report 5xx during the transaction, sending MTA is responsible for routing it to the associated address.

Any MTA I get backscatter from goes right into my local incompetent.dnsbl zone.

Re:Not "legitimate" mailservers

[tokul]

If an MTA is sending backscatter, it is not legitimate, it is broken.

No it is not. It is following email protocol.

RFC 821

If a server-SMTP has accepted the task of relaying the mail and later finds that the forward-path is incorrect or that the mail cannot be delivered for whatever reason, then it must construct an "undeliverable mail" notification message and send it to the originator of the undeliverable mail (as indicated by the reverse-path).

Not sure if it happened to me.

[nickull]

I had originally contemplated that this was the case however figured that due to my self declared war on spammers, they decided to spoof my email as the send bit. I am 100% sure I have not been hacked or any system compromised but it was really a crappy experience nonetheless. http://technoracle.blogspot.com/2008/04/spam-war-deepens-am-i-winning.html

Re:Not sure if it happened to me.

[Henry V .009]

Sorry, but you're not actually special. They do that to everyone.

I actually don't get any spam.. at all

[Anonymous Coward]

I've figured out how to stop all spam, and it's very simple: I block all incoming email.

I know what you're thinking... what about the false positives? Yes, there are some, but here's the great part of the system... the more spam I receive, the lower my false positive rate. I don't need to worry about backscatter, phishing, viruses, or anything, and the CPU usage for this is incredibly minimal.

Postfix Bug

[Henry V .009]

Last year we had an issue with spammers targeting our postfix server to do this. They would insert an extra Delivered-To line, which postfix would happily bounce back to wherever the spammer wished. I wound up writing a header_check for this. Last I heard there were no plans to change postfix's default behavior.

Same old, same old

[Grand Facade]

Computer World trying to get street cred by re-hashing old and moldy.

Nothing new here, move along.

Fighting backscatter using procmail

[spinash]

Try my recept, feedback welcome !
http://www.bueche.ch/wp/2008/05/05/fighting-backscatter-using-procmail/

Just wait for email 2

[kiddygrinder]

In the mean time, here's some music...

Not the spammers' bots

[reiisi]

Yeah, the spammers' bots ignore the robots.txt and the indexing control headers. But the spammers don't have near the capacity of Google. It's easier for the spammers to search the forums through google, and more productive of e-mail addresses that can be sold.

Spoofed backscatter?

[reiisi]

I've gotten apparent backscatter containing malware since more than five years back. Some of those might be actual backscatter from mail servers that bounce full messages+attachments.

But many of those have claimed to come from my provider. I know the peculiarities of my provider's headers. Those are definitely spoofed.

I have been seeing more of these apparent spoofs of backscatters from other ISPs (check them headers!) lately.

don't publish your address!

[Anonymous Coward]

Ok, I know some people *have* to, for business reasons and so on.

But for most individual email addresses, you can just give it to your friends. I have not gotten a single spam in probably over 8 years, and I don't run any filters locally, and I have my ISP's filters disabled on my account, so I would know.

There is no need for spam to be much of a problem, if people would just be a little careful. I don't understand why so many people are willing to receive spam. It pissed me off so bad when I started getting them in the 90's that I took steps to make sure I wouldn't get any more (secret email addy, given to friends only, and if I order things online I do so with a temporary drop box that's later deleted), and since then I've been spam free. Really, it isn't that hard (again obviously except for certain kinds of addresses for business reasons that you might have to publish, but most people's addresses aren't like that). There's absolutely no reason for 90% of us to ever get a single spam.

Glad to know what this problem is

[wreave]

Count me among those who were worried. I have been getting, say about a hundred a week for the last few weeks. At first I thought my mail provider had been hijacked, then I realized that the spammers were just using my return address. It is really, really frustrating. At least now I know that I'm not the only one suffering... small consolation, but perhaps this will mean that some attention gets focused to it and a resolution will be coming.

The solution is called Watermarking

[hipsterdufus]

MailScanner, which ships with Fedora, includes a feature called watermarking. Like those that have already posted, it works by creating a custom header with a secret key that is used to add a quick little seemingly random text and puts it in the header. If mail is coming from a bounceback, MailScanner checks the message for a match on the header. If it doesn't see one, then you can have it act based on that scenario. After turning this on, I get zero bounceback/scatterback emails into my Inbox. A perfectly elegant solution that works well and is easy to implement.

GMAIL

[jupiterssj4]

I've used Gmail for years and had maybe 1 spam the whole time, now every few hours I have 2 or 3 in my SPAM folder. Don't like it at all.

Why do people send spam to me? (seriously)

[Cedric Tsui]

I've asked this question in Slashdot before, but I've never gotten a satisfactory answer.

There are 7633 messages in my gmail spam folder. Now let's suppose I'm new to the internet, and I read spam message #1. Do I want Viagra? No thanks. Message #2, still don't want Viagra. #3 no thanks, I'm fine.

Well, I didn't buy that stuff the first 7633 times you asked me THIS MONTH, but maybe if you ask me REALLY nicely with a few misspellings just once more, then I'll cave into my male inadequacies and buy prescription medicine from a sketchy online source.

Now I'm going to pretend I'm a spammer. I want lots of money. What benefit is there to me to send a single address more than say... 5 messages? (not per month. EVER) If it didn't make it through the filters the first time, it won't the 800th time, and the more messages I send, the more likely my recipients will learn to evade them. More importantly, a jaded audience won't be receptive to buy.

I can imagine that the newer scams could be useful. Like the ones pretending to be your bank. I've only received a few of those, and it took some thinking to realize that the facts didn't add up. But the normal viagra spam should only be useful in the very limited cases where a brand new user (8 years old?) who hasn't been exposed to it ever before reads one of the first messages and decided that it's a worthwhile endeavour.

My hypothesis are:
1) Spam is not used in the effort of making money, but as a way of crippling the internet for sport.
OR
2) The majority of spam is sent by poor, hungry and stupid script kiddies who are as of now still poor, hungry and stupid.

Re:Why do people send spam to me? (seriously)

[WGR]

Now I'm going to pretend I'm a spammer. I want lots of money. What benefit is there to me to send a single address more than say... 5 messages? (not per month. EVER) If it didn't make it through the filters the first time, it won't the 800th time, and the more messages I send, the more likely my recipients will learn to evade them. More importantly, a jaded audience won't be receptive to buy. Because spammers get paid by number of messages sent, not return on messages.

Re:Why do people send spam to me? (seriously)

[Cedric Tsui]

That doesn't make any difference. Someone has to be paying them and getting a return. And so the same argument applies.

If I wanted advertisement, and you offered to post one trillion of them for me neatly on the inside of a sewer pipe for one hundredth of a cent per add. Guess how many I'd have you post.

Re:Why do people send spam to me? (seriously)

[chromatic]

Someone has to be paying them and getting a return.

Someone has to be paying them anticipating getting a return.

Re:Why do people send spam to me? (seriously)

[Cedric Tsui]

Well, if they don't get a return, then you need a constant stream of idiots who have access to Viagra at below market costs.

No. I think someone has to be making money from the mass spam for it to exist. I just don't see how.

Re:Why do people send spam to me? (seriously)

[chromatic]

Well, if they don't get a return, then you need a constant stream of idiots who have access to Viagra at below market costs.

Multi-level marketing schemes are alive and well. I figure they've made it to the Internet.

Re:Why do people send spam to me? (seriously)

[dreamchaser]

Because it's cheaper to just saturate everyone with spam than to winnow out the ones who are never interested?

Re:Why do people send spam to me? (seriously)

[ralphdaugherty]

My hypothesis are:
1) Spam is not used in the effort of making money, but as a way of crippling the internet for sport.
OR
2) The majority of spam is sent by poor, hungry and stupid script kiddies who are as of now still poor, hungry and stupid.

      Wrong on both counts. It's free to send spam, heck, more free than free, zombie PC's are sending them out. It requires effort and coordination to keep track of what spam you got, and these crime gangs aren't going to go to any effort to do that.

      No one cares. It's a numbers game. The more, the better. And it's free. For them.

      For us, some occasional schmuck does something that lets them take their money, way more than they ever imagined. What, you think this is Wal-Mart versus KMart on prices and service?

    No, these are criminals out to separate you from your money.

  rd

Re:Why do people send spam to me? (seriously)

[notes rules]

I don't know why they send spam either. But, as a joke, I wrote "Sympathy for the Spammer" as a spoof of Sympathy for the Devil (Rolling Stones song). Some people thought I really had sympathy. Just the opposite, as I believe the Rolling Stones intended, too: Here are a few lines (remember, it was inteded to be funny):

Sympathy for the Spammer
Please allow me to introduce myself
I'm a man of wealth and taste
I've been around for a long, long year
Stole many a man's identity by theft

And I was around when William Gates
Said he'd stop all spam by o-six
Made damn sure that SPF
Would not be open so not so great

(refrain)
Pleased to meet you
Hope you guess my name
But what's puzzling you
Is the nature of my game

I rode to the bank
On my ill got gains
Selling mortgages
porn, watches and drugs

I shouted out,
Who killed Sender IP?
When after all
It was you and me
(and our bot nets)

http://blog.maysoft.org/blog.nsf/d6plinks/FPAO-7CNUH9/

Re:Why do people send spam to me? (seriously)

[Cedric Tsui]

Good point. I guess it's cheaper to broadcast spam than it is to direct it.
And I guess all they have to do is send you a bottle with some Tylenol in it and you won't even be able to get the credit card to reverse the payment.

Re:Why do people send spam to me? (seriously)

[Anonymous Coward]

My hypothesis are: 1) Spam is not used in the effort of making money, but as a way of crippling the internet for sport.
OR
2) The majority of spam is sent by poor, hungry and stupid script kiddies who are as of now still poor, hungry and stupid.

You missed number 3: That most internet users are idiots, and of these, some small percentage will be real, grade-AAA, gold-certified, drooling, morons.

The key to understanding spam is that if you actually know what spam is, then you are not the target audience. If you have the intelligence to put your trousers on the right way round, you are not the target audience.

Spam would not be sent if it was not profitable. People don't do this stuff for a laugh, they do it because it makes stacks of cash. As such it must be true that some small percentage of internet users who receive spam actually buy the advertised product. Yes, this is difficult for you and I to believe, as we think "how can anyone be that stupid?". Remember that we know which way round our trousers are supposed to go. Given point 3) above, it only takes a small fraction of these idiots who are so stupid/gullible/inexperienced that they will spend money on the spammed products. Given that spam is insanely cheap to send, it only needs a tiny, tiny return rate to see a profit. Thus, spam is profitable which provides the incentive for more spam.

Well, I didn't buy that stuff the first 7633 times you asked me THIS MONTH, but maybe if you ask me REALLY nicely with a few misspellings just once more, then I'll cave into my male inadequacies and buy prescription medicine from a sketchy online source.

Remember that you are not the target audience. Even if you think "what a bunch of idiots, sending me the same message again", and even if 999,998 other people who receive the message think the same, the spammer doesn't care. The one person who does buy the product makes the entire exercise worthwhile.

When everyone on the internet has the brains/experience to not buy products that are the subject of spam, then spam will cease. Also on that day we will see levitating porcus, DNF being released and MS releasing windows under v3 of the GPL.

How should I tag these messages?

[ccharles]

OK, so how do I handle these messages?

I am responsible for periodically updating our spam filter (at work) by flagging individual messages as either spam or ham--the usual Bayesian method, I think.

Should I be tagging these backscattered messages as spam, ham, or just leaving them untagged? Ideally I'd like to filter most of them out, but I don't want to start getting false positives on legitimate bouncebacks.

We have been seeing this problem ALOT lately.

[ubercaff]

We have noticed a DRAMATIC increase in backscatter over the last month or so. It has forced us to configure our E-mail systems to automatically flag NDR's as SPAM and quarantine them. I cant wait until the next new method of spam shows up.

Barracuda attack

[DuctTape]

Gee, that's where a lot of the stuff we get comes from... Barracuda appliances.

If their default is to terrorize bounce victims, no sale.

DT

Extreme Backscatter

[neorush]

A few weeks ago we were getting 100,000 - 200,000 backscatter emails a day. Some one was using our domain to send massive amounts of spam. Not from our servers of course, but it didn't matter. I think at its peak we were doing around 60 emails per second. Ended up installing a barracuda and that was barely able to handle the load. Then mysteriously after about 3 weeks, it just stopped.

Re:Extreme Backscatter

[nuzak]

> Ended up installing a barracuda

You better have changed the default settings, or you just added to the backscatter problem.

Re:Extreme Backscatter

[neorush]

We tweaked the crap out of that thing, disabling bounce backs was actually one of the fastest ways to improve the performance.

well if your feeling like having fun..

[tempest69]

The return mail for spammers is an auto-reply. so feed it another spammers return mail..

wait for infinite loop to finish..

repeat as needed.

Storm

Just drop late (async) SMTP replies.

[GeekDork]

SMTP is completely broken. It has no accountability beyond the end of the connection. Hence, I don't see a reason to set up my server to be "RFC-Compliant", but just drop that crap right away. If you want to send me something important, use phone, fax, IM, or carrier pigeon. I'm sure we can find a suitable mode of communication that won't get you re-routed to the deep dark places where the IMAP folders don't reach.

Don't Call It A Bounceback!

[Anonymous Coward]

It's been here for years!
Spoofing my peers
and holding admins in fear!

Sucker born every minute?

[Anonymous Coward]

Well, if they don't get a return, then you need a constant stream of idiots who have access to Viagra at below market costs. The spammer doesn't need to have access to it at below market costs. They only need *other* idiots to *believe* the spammer does. Those idiots will keep the spammer in business, as the cost of spamming is amazingly low.

There is but one inexhaustible resource on the planet earth, and that resource is the constant stream of idiots. Let's face it, we're a planet of electric monks!

one or two every hour???

[nurb432]

Not me, i'm averaging about 4000 a day ( to my domain ).

Im expecting to get blacklisted any day by idiot sysadmins that don't understand how things work..

if everyone was doing it?

[F�an�ro]

there are probably hundreds of ways to solve spam "if everyone was doing it"

There is just no way a significant enough fraction of the billions of domains, most of them simply registered and parked or forgotten, will publish SPF records

Re:if everyone was doing it?

[rolfc]

If every domain that was used by persons published SPF, that would not be a problem. See solutions instead of problems. ;)

Price per email

[pclaphamnz]

If there was an alternate email system which each email had a price USD$0.20c, it would cost too much to spam out. Internal email would be free, but as soon as it leaves your organisation you would get a bill. Or, just scrap the worldwide email system and build another from the ground up, with billing and some sort of banning / server authentication.

Reject *during* SMTP dialog

[macdaddy]

This is exactly why you use spam filters like MIMEDefang (or his commercial big brother CanIt). They actually do all of the spam filtering *during* the actual SMTP dialog. Ie, DSNs are not sent to forged senders. The server sending the spam does not have the opportunity to get rid of its message before the message is identified as spam. RFC 2821 permits the issuing of 4xx or 5xx error codes right up until the final 221 QUIT message. A rejection before the QUIT forces the sending MTA to handle the bounce to the envelope from.

Re:Reject *during* SMTP dialog

[notes rules]

I agree that this is a great way to stop spam. We do that in the SpamSentinel filter for Lotus Notes and Domino. There is a blog about it here: http://blog.maysoft.org/blog.nsf/d6plinks/NMCN-7DKNQ7/

Re:"legitimate?" Yeah, like Yahoo?

[SpammersAreScum]

I suppose this qualifies as a mis-directed 5xx rather than backscatter, but... Exactly a year ago, coincidentally, I received "failure delivery" bounces from a Yahoo.com server, for email I never sent, apparently because the actual sender put my corporate email address in the Return-Path! You'd think Yahoo'd know better.

Serious legal action vs spammers

[RecycledElectrons]

If a spammer claims to be sending SPAM from your domain, that is at the very least slander, and if you have a trade mark, it's trade mark infringement.

The only other case I can think of where an ad email is that illegal is when it's sexual harassment - a sexually suggestive spam sent to a coprorate email address.

Andy Out!

gmail aliasii for spam detection

[QuestionsNotAnswers]

Gmail makes it easy to create multiple aliasii (and to send from those aliasii I think).

Append a plus followed by a word, and it resolves to the name before the plus. e.g. happypenguin+amazon@gmail.com goes to happypenguin@gmail.com account. Or use dots in your email address and the gmail address resolves to your account without dots e.g. ha.ppy.pen.guin@gmail.com goes to happypenguin@gmail.com account

You can then easily create a spam filter if an address is snarfed by a spammer.

This article says it better: http://somegirlwitha.com/2008/04/17/the-dot-plus-and-googlemail-gmail-hacks/

You may not care but it is still done

[dbIII]

I have to do that because some idiots maintain blacklists of dynamic IP addresses which have actually been static for several years. It's a long process of getting the address removed, then somebody looking up an old list of dynamic addresses adding it back in, me getting it removed, repeat every few months for several lists. In the meantime until this behaviour stops one of the mail servers has to pretend it is another for outgoing mail.

There are other situations where SPF does not work which a little bit of googling will reveal.

Re:

[clint999]

I think you are misunderstanding the poster. The point is

Backscatter indeed

[Veritas1980]

I work for a company that owns several dialup ISP's and I hear about this all the time. Our customers believe someone has hijacked their PC or their email account when it is just someone spoofing their address. Usually the only thing to be done about it is a message rule to filter them out, unfortunately.

its the odds, stupid.

[alanshot]

They generally dont get paid per message sent. they get paid per message REPLIED TO (by acting on the offer).

Its all about odds. It costs you virtually nothing to send an email. Yes, you have to pay for the list of emails you bought but by using open relays, etc. your cost is minimal.

Assume you make $10 per rube that actually takes your offer.
Assume that your rate of response is 2%.

so for every 100 messages you send, 2 people acutally fall for it and give you money.

With that being said, do you want to make $20 (100 emails), or $20,000 (a million emails)? Its all in the amount of email you send.

THAT my friend is why you get so much. The more they send, the more $$ they are likely to make. Anytime you can increase your income without increasing expenses its a good thing and you are going to do it.

So its not the number of emails, its the number of customers those messages entice.

Something of a Relief

[mother board]

I am so clueless that I thought I'd done just what the piece suggested; as grotesque and box-clogging as this is at least it isn't something going to people who know me. Bummer though.