Slashdot Mirror
Could Fake Phishing Emails Help Fight Spam?
Glyn Moody writes "Apparently, the US Department of Justice has been sending out hoax emails to test the security awareness of its staff. How about applying a similar strategy to tackling spam among ordinary users? If fake spam messages offering all the usual benefits, and employing all the usual tricks, were sent out by national security agencies around the world, it would select precisely the people who tend to respond to spam. The agencies could then contact them from a suitably important-looking government address, warning about what could have happened. Some might become more cautious as a result, others will not. But again, it is precisely the latter who are more likely to respond to further fake spam messages in the future, allowing the process to be repeated as often as necessary. The system would be cheap to run — spam is very efficient — and could use the latest spam as templates."
The spam problem will not be solved with laws or pretty tricks like this.
It is a technological problem, and as such will be solved by technological changes: the SMTP protocol is outdated and totally unadapted to the modern uses to which we put it. Let's replace it with something that authentifies sender and receiver properly, and that allows for efficient transmission of binary data.
If he explores all forms and substances Straight homeward to their symbol-essences; He shall not die.
In my experience, many of the people clueless enough to respond to some spam email are also the ones who wouldn't understand the reply that came back to warn them of their behavior.
(Heck, you wouldn't believe how many people I've had to help out, because a free version of their Windows anti-virus software expired, and they couldn't figure out what to do with the windows popping up to tell them they needed to download the newer version. They thought that stuff meant their anti-virus "broke" because they got a virus!)
And it's called more exactly honey-pots.
And the government spam could bilk the gullible out of money just like real spam. They could lower regular taxes by creating this stupidity tax. Also the DOD could spread viruses on this government spam that take over machines to use in web war. And no need to keep it local, it could be worldwide.
my school district did the same thing, and it works great.
It's the best form of targeted training. Only those who fall for shit like this get a lesson, and follow-up fake scams had a MUCH lower success rate.
THL phish sticks
Sending more spam in the name of eliminating spam is not eliminating spam. It's still creating a mess on people's email servers and personal computers, and storage for much of it adds up, especially at the server level. How about we simply improve our educational system and teach marketing majors a bit more about business ethics and ethical advertising?
This idea is awful for the same reasons that I don't want the local police department entering my home to show me how easy it is to pick my locks.
The idea smells of John Ashcroft appointees.
I did that back in 2001 to the sales force at Comcast. we in the IT department formed and sent a email with a exe file payload. when ran it reported back to us who opened it and pooped up a message on their screen that said, "IF I WAS A REAL VIRUS ALL YOUR FILES WOULD BE DELETED"
we sent it from outside the company with a yahoo.com address
85% opened and ran the attachment. we used this as a part of our It education to our users. after the classes that month we repeated it 45 days later.
we had a 90% opening rate this time. you really can not teach the users. Most people who are not IT professionals dont care. If they hose their own computer they dont have to fix it, you do.
The only effective thing would be to actually delete all the users files and never give them back. Humans only really learn from cause and effect. Simulations rarely teach them.
Do not look at laser with remaining good eye.
Your post advocates a
(x) technical ( ) legislative ( ) market-based ( ) vigilante
approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)
( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
(x) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
( ) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business
Specifically, your plan fails to account for
( ) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
(x) Asshats
(x) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
( ) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
( ) Extreme profitability of spam
( ) Joe jobs and/or identity theft
(x) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
( ) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook
and the following philosophical objections may also apply:
(x) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
( ) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
(x) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough
Furthermore, this is what I think about you:
(x) Sorry dude, but I don't think it would work.
( ) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your
house down!
Fighting ignorance with ignorance.
Perhaps they could hire some kind of outside contractor - with an extensive botnet and lots of spam-sending experience - at some ridiculous fee! I'm sure with significant compensation, these professionals could be convinced to spam the DoJ.
In all seriousness, all this will do is make a certain few people very very sad inside when they see just how easy it is to fool the common deskmonkey, and just how much info you can get. At best, some of those certain few people will become motivated to make it their profession...
"Strangers have the best candy" -Me
From my garbage Gmail account with swearing and flame. Yes, I do have some free time to waste, as obvious.
I guess it's better to receive one spam than the other? Like it's better to have political advertisement than laundry detergent advertisement?
Spam = spam
If you start fighting spam with spam, you become part of the problem.
Even fake spam will circulate and congest the tubes, not? It's like punishing someone for being naive. Rather educate than catch, it goes a lot further.
Let me get this straight -- we should suggest to people who are highly credulous that there is the possibility that they might receive legitimate email from "suitably important-looking government address"?
That will never cause bigger, more successful phishing scams.
Then, how about a government funded antivirus, to be distributed and replicated as a virus? Everybody will then be protected.
It's relatively cheap to do and will save millions in loss due to malicious viruses.
Talking about fighting fire with fire.
No.
Spam persists because a tiny (absolutely, infinitesimally small) proportion of the recipients actually respond to it. Whether that's due to stupidity, greed (oooh - I might get something for nothing), boredom, accident or simply curiosity (hmm, I've never replied to SPAM before, I wonder what happens).
The costs of sending it are so low, that it is still worthwhile, providing there's one idiot in a million who takes the bait.
How do you cure this people problem? I don't know. Even if you spend you whole life telling children not to put dirt in their mouths, some still will. You'll never get rid of spam until all the dirt-eaters and spam-responders get a dose of common sense, and that'll never happen.
politicians are like babies' nappies: they should both be changed regularly and for the same reasons
The last damn thing I want is to click a link out of curiosity and within five minutes be standing there having to listen to the IT guy say "here's your sign" or end up in the HR office explaining my seeming poor hand-eye coordination because I accidentally clicked on a link in an email from the fscking HR department. Don't these people have enough work to do?
Support NYCountryLawyer RIAA vs People
My guess is that it'll be pulled faster than the pay-rise of the person who made him/her look an idiot by instigating it, in the first place.
politicians are like babies' nappies: they should both be changed regularly and for the same reasons
I would say that a more harsh approach is needed. I like the idea but I say a 2 or three strikes and your out method would be more effective. In other words, if thery respond to one fake spam ... one strike...another...two strikes and if they respond to a third...SEND THEM PACKING!!
Cool - that could mean that spammers would start writing botnets that would also block government spam from landing on the computer, in case the user gets educated and figures out how to secure their computer. I can imagine a new spam race where the government has to write ever more clever spam to get round the malware's rulebase!
Since I never open spam, I don't know how many messages connect to sites that really sell the advertised products, and how many only seem to sell as ruse to get people's credit card numbers. I would presume the latter far outnumber the former. Given that the only way to tell phishing from spam according to your definition is to try to buy something, it seems to me you're making the distinction overly fine.
[Sir Garlon] is the marvellest knight that is now living, for he destroyeth many good knights, for he goeth invisible.
The "good" spam is sort of like a public education campaign about STDs. It's part of a well rounded solution in raising public awareness. Your's may not need raising but you will benefit if the awareness of others' is raised so put up with it.
Now then there's the post infection detection problem. We could take a simmilar approach of turning a bad thing to our advantage. Presumably these Zombie bots try to hit a series of predefined URLS to announce their availability. Once some of those are known, when not sieze them and use them to get infected computers to self-identify then notify the owners or if unresponsive their ISPs?
That would not cure all infection. But there is a well known principal in medial virus infection called the R-factor and that is the minimum number of infections needed in a population before the disease becomes self sustaining or growing in infections. We don't have to eliminate all zombies before we reach a point where the infection rate is highly damped.
Some drink at the fountain of knowledge. Others just gargle.
And a lot of times children eat dirt because they're mineral deficient, not because they're stupid.
My blog. Good stuff (when I remember to update it). Read it.
Ick. What a stupid idea.
The reply rate to spam, if I remember recent numbers recently, is something like one reply in ten million messages sent. To have even a marginal effect on the spam, you'd have to reach at least a million users. So, that means they're proposing that the government send out ten billion spam messages.
Dumb.
Much better is to follow the money trail-- the spammers have to have a way to make money. Follow that trail.
http://www.geoffreylandis.com
Couldn't they do better security through porn? That would be more fun.
1. Government sends out fake spam with links to lure people who fall for phishing
2. Phishing link clickers visit government site, and fill out form
3. Government sends link clicker an email saying "Don't do that"
4. Phishers send out fake government spam with links to lure people who fall for phishing
5. Phishing link clickers visit fake government phishing site and fill out form, now asking for credit card/bank information in order to "better protect you"
6. Phishers happily collect information via another official looking form
To really be effective the spam should update any system and antivirus software. If no antivirus software is found then it should install clamwin. After the updates it runs a full virus scan in the background. The more someone falls for it the more their machine gets needed maintenance.
MTV ran a broader campaign in the same vein. It consisted of fake adverts and two gotcha web sites: http://www.hospitality-job.com/ http://www.go-with-english.com/
If this thing worked, than it would already be working. There are plenty of people out there attempting to "teach someone a lesson" by scamming them out of their money. Sometimes the lesson takes, and sometimes it doesn't. The thing is, actually scamming someone out of their money is a stronger lesson than pretending to, and in the millenia that this has been happening, it hasn't significantly lowered the number of gullible people on this planet.
Brilliant idea! They could send those out daily, so that the rest of us could receive even more spam. "More spam!" you say, but you're forgetting it'll be FAKE spam. Big difference!
Why bother trying to protect those that Darwin should be claiming? Even if we somehow warn them suitably, they'll just be taken in by the next scam.
Let them deal with their own problems.
If anyone really, the media (TV, print ect.) should step in and educate. I bet if Regis did a bit on some common sense ways to spot and avoid spam and phishing, that I am sure would go a long way to educate the average joe/mom about the dangers. Or a 60 minutes on Spam. A bit on MSNBC. I column in a monthly rag. In my experience people are very curious and/or afraid of getting infected or spammed and enjoy any helpful information that they can put to use right away to protect themselfs.
Comment removed based on user account deletion
People need practice spotting real, highly crafted spear phishing attacks. These emails are MUCH more specialized then spam. The DOJ isn't the first to use this education technique and they won't be the last. Organizations pay for this training. Just look at www.phishme.com.
Spam is like XML, if it doesn't solve the problem, use more.
Mr. Period: Nine is the one that's right by ten!
Nine: One day I will kill him. Then, I will be Ten.
How about we use the government resources directly against the spammers?
1. Set up false fronts to buy the products.
2. Trace the transactions.
3. Establish a swift death penalty for whoever receives the funds.
Yes, this would need safeguards - for instance when spammers start threatening to send out spam for products from businesses other than their own, to blackmail those businesses with threat of government response. But for instance when the payment can be traced directly to a Canadian "pharmacy," simply extradite and execute the pharmacists - or jail for life if the extradition treaty doesn't allow for execution.
Who would miss these people? Who would be sorry this had been done?
"with their freedom lost all virtue lose" - Milton
the LAST thing any of us want is for the
bureaucracies to be responsible for what e-mail we receive and what e-mail we do not. If people cannot be trouble to acquire or hire the expertise necessary to reduce spam, then let them eat spam. People have the right to pursue happiness, bear arms, to assemble and to worship. They also have the right to be cold, hungry, homeless sick and dead.
And to have their inboxes stuffed with spam.
We are at the border of the abyss, but we will take a step forward. Adding spam to the system will do in the short term more harm than good, and in the long term? People that follow the spam links probably have not enough discern to learn the lesson, or even worse, the spam will start coming with a "this time we are serious" warning to take distance from that experiment.
Could be of consideration taking control of domains/URLs very refered by spam, and instead of taking them down (by the hosting ISPs or whatever) redirect them to a central warning "dont follow this or you will be sorry" site, you will not add more spam to the system, and still will warn people that follow the links.
I once wanted to do such a thing for my employer: sending out fake "Enter your login credentials here to win xxx" emails to our staff and invite those that responded with submitting their true credentials to security awareness trainings. However, it turned out that this would have been a violation of privacy rights here in Austria, Europe.
The employer could have been able to discriminate people for falling for the scam and thus it is illegal for my company to do such a thing.
The ideal IPbl scenario is: the collateral damage "innocents hit" force their ISP to block/evict the bad guy, everything goes back to normal after a short while. The ISP takes the hit (in financial$$ form) for the blocked time, evicts spammers faster next time around.
It's better to be the foot on the boot than the face on the pavement. ~~ tkx Kadin2048
to go right with your metaphor, the "condom police" picks up a girl/guy in a bar, takes s/he to a hotel room, asks if they can go bareback, s/he says yes, receives a fine and a slap on the wrist (possible mandatory safe sex lessons) and goes home. Seems sensible to me.
It's better to be the foot on the boot than the face on the pavement. ~~ tkx Kadin2048
Rather than adding to the existing SPAM traffic, the govt. just needs to make people aware of online frauds using print and television adverts. More effective and a green solution too.
This is really easy, and it even works in Darwinism.
What if instead of continually repeating the exercise, the recipients of the fake spam get gently berated if they take the bait the first time. Then, if they fall for it again, a couple of guys in black suits and sunglasses show up at midnight to offer the option of "the pill" or a "bullet".
I think that would cut down on a lot of spam response.
Alternately, if someone falls for the v14gra spam more than once, send cyanide pills instead of viagra.
Disclaimer: The opinions and actions of the US Gov't are in no way representative of those held by this author or its ci
Please spend government money (my tax dollars) on filling my inbox with even more inane crap. We could even make it part of the "stimulus package".
Why not spend that money getting some of the real spam-killing ideas implemented?
A year or two ago, I was doing helpdesk stuff when a user called in regarding a phishing e-mail they'd received regarding some transaction in Africa. They wanted to know if it was legitimate, because it sounded (to him) like the business opportunity of a lifetime. I told him that it was a scam, and explained how the scam worked. He thought for a moment, and said "Yeah, maybe, but he's promising millions!" (uh oh)
I directed him to read up on some of the 419 anti-scam sites. We read the literature together, and discussed why these operations work, and why it's dangerous to respond to them, etc.
At the end of the call, despite having spent more than 45 minutes trying to dissuade him, and having read multiple stories that all had the same general flow, he remained skeptical of MY explanation that it was a scam. He wanted to believe it was legitimate, and so he believed it was legitimate.
I haven't spoken to him since, but some of my colleagues have. We came to the general consensus that he probably sent several thousand dollars to them before realizing it was fake. :/
present day... present time... hahahaha...
NOT. :-)
We are having mandatory safe sex THEORETICAL lessons.
Maybe if s/he answered "no way", s/he could win the prize of a good (SAFE) lay
It's better to be the foot on the boot than the face on the pavement. ~~ tkx Kadin2048
This is my idea - woops,it's not *my* idea, this is not new and it's not my original work.
1. Mail servers must subscribe to a 'reputational' authentication system. The authing system is pretty straightforward, but along with identification and and passcode, the system considers the server's 'reputation'.
2. Reputation is derived by any of serveral means. the most important, for spam prevention, is that reports from other servers of spam activity result in a diminished reputation, and eventually lead to inability to authenticate.
3. I choose to enroll my server in this system. If I don't many other servers will stop listening to me. If I do, I abide by the rules, mostly to minimize spam. If my users send too much spam, I am warned and eventually my server cannot authenticate, so cannot send mail to other enrolled servers. I stop sending spam on behalf of my users to these other servers.
4. A server can achieve a good reputation by sending acceptable mail to other members of this system. Some servers, probably the 'big' ones (Google, Yahoo!, MSN, etc) will accept mail from these 'beginners', and vet them so to speak. They can also tolerate spam more readily, would serve as early warning, and the gateway into the greater system.
5. Botted boxes would never get much of a reputation, as they would be sending much too high a percentage of spam. If they were using SMTP, they would find participating server would refuse their connection. We could consider dropping the mail on receipt, to both deny delivery and tie up the bot box, but that also ties up the servers. We want well-behaved servers to get through, and their recipients to be able to drop connections as soon as possible to avoid even processing incoming spam.
There are probahly issues with this - the most notable being how to deal with servers that work to gain good reputation just to spew spam in short-lived bursts. And how to deal with spoofs and hijacks, and the likely false-positives.
Certificates don't work, as all I have to do is accept one well-crafted phishing message and my cert is out there for abuse. Whitelisting fails. Blacklisting is failing. I don't see a good alternative short of going to only 'approved' servers, where the approval is based on arbitrary decisions on who will provide mail service, and that fails when some otherwise trusted entity gets subverted or paid off to allows the spammers. Try blocking .ru or .ro for a week in that scenario and see nasty it gets.
This is not much different than fax spam or good old-fashioned direct mail through the Postal Service, except there is even less cost to use as leverage, and the legal alternatives such as do-not-call and catalog blacklists are even more unenforceable.
'My' idea may not work either. DNSSEC may offer some help in being able to spot spoofs and inappropriate servers. If I could spot botted machines by knowing they were in known dynamic ranges within residential ISP pools, I'd be happier, but most of the bot spam I get I think is coming from corporate machines compromised by the same botnets, and labelling those IP addresses is very much harder and less precise. Many will show their gateway address as the same as their Exchange server, for instance, and blacklisting those is a lot of trouble.
We may have to filter, or face the choice of losing the 'free' e-mail system.
?
deleting the extra space after periods so i can stay relevant, yeah.
This strategy builds a statistical analysis of what gets people to click or not. If spammers get a hold of this data it will lead to better phishing. Even if this data was not public domain I am sure spammers would pay good money and they will find someone that will give it to them.
Catch-and-Release
Set your phasers on "funky"!
Punish the idiots that respond to spam. They are way easier to find and need to be culled from the heard anyway. I am going to get Soooo nailed for being right on this one.
Why is it so hard to only have politicians for a few years, then have them go away?
"Congratulations! By responding to this test email, you've received an IRS coupon for a FREE TAX AUDIT. Enjoy!"
...it is precisely the latter who are more likely to respond to further fake spam messages in the future, allowing the process to be repeated as often as necessary
I know you're being funny, but a stick approach might in this case be more efficacious than the carrot. The submission naively suggests that
...when experience shows us that greed will often override common-sense. An example uppermost in my mind is where people repeatedly sink money into Nigerian scams AFTER they were already aware that the thing was likely to be a con.
I often think this kind of thing is a good argument for chlorinating the gene pool, or at least retrospective abortion...
to fight spam...I like it! That's the government for ya, always doings things it prohibits others from doing. For our own good, of course..
What?
Can I opt out of this right now?
The last thing I want is fake spam. Just more junk email I have to download to get the messages I need.
*DrugCheese rants*
How dare you use my spam as templates for your own. I will see that my intellectual property will be protected. See you in court!
"Give a man a phish, and he'll eat for a day. TEACH a man to phish and he'll eat for a lifetime."
Sorry, terrible pun I know, but it is true; the only way to fight this sort of thing is to make people more aware of it in the first place, knowledge is power. Personally, I think they're at least trying the right thing. My concern is the automatic filtering of "spam" messages done by some ISP's and mail services (especially gMail), and how it will interfere with the success of something like this.
I know they already do something similar. When the draconian restrictions on pseudoephedrine were being debated, as a severe allergy sufferer, I did some research on the actual effect of the legislation so I could write an intelligent letter to my representatives. Part of that was knowing how much pseudoephedrine it takes to make a batch of meth , so I could know if the restrictions would do any good in combating meth production or just inconvenience a lot of law abiding allergy sufferers for no reason.
It may be obvious to you, but in my naivete, I googled meth recipes, and came up with nothing except links to rehab facilities and dire warnings that my IP address was logged for the DEA.
I never got a follow up from that experience (that I know of---maybe I'm considered one of the successes on a report in a classified vault somewhere), but I'd be interested to know how effective it was for its intended purpose. Might be an idea to build on for spam or really any sort of social engineering.
This space intentionally left blank.
...get together with a few banks and credit card companies and set up some dummy accounts. Then, have law enforcement personnel reply to some actual phishing e-mail with the faux accounts. These would be set up such that anyone ordering merchandise with said account would meet the local SWAT team jumping out of the FedEx truck when it pulls up.
Publicize a few of these raids heavily ('Cops' comes to mind) and that might cut down on some of these scams.
Have gnu, will travel.
Your post advocates a
( ) technical ( ) legislative ( ) market-based (X) vigilante
Sending out spam to counter spam is bringing justice by breaking a law.
approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)
( ) Spammers can easily use it to harvest email addresses
(X) Mailing lists and other legitimate email uses would be affected
These mailing lists as well as end users would have to deal with additional volume of spam.
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
(x) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
( ) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business
Specifically, your plan fails to account for
(X) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
(x) Asshats
(x) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
( ) Armies of worm riddled broadband-connected Windows boxes
(X) Eternal arms race involved in all filtering approaches (you need to compete with spam filters)
(X) Extreme profitability of spam
( ) Joe jobs and/or identity theft
(x) Technically illiterate politicians
(X) Extreme stupidity on the part of people who do business with spammers (they never learn)
( ) Dishonesty on the part of spammers themselves
(X) Bandwidth costs that are unaffected by client filtering (you're adding to the volume of spam bandwidth)
( ) Outlook
and the following philosophical objections may also apply:
(x) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
(X) Countermeasures should not involve wire fraud or credit card fraud
(X) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
( ) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
(x) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough
Furthermore, this is what I think about you:
(x) Sorry dude, but I don't think it would work.
( ) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your
house down!
I once had a signature.
I used to be the sysadmin for a high school, filled with about 150+ employees, many of whom were absolutely clueless and laughed me off the stage when I tried telling them not to share passwords.
We're talking about users who had holy screaming fits at the beginning of the school year, when the school district [my Active Directory overlords] forced password changes on all users.
What could I have done?
- Send out a phishing e-mail from an obvious spoofing of my e-mail account.
- The link is to a page on an internal Web server that simply collects usernames and passwords entered.
- E-mail the users who fell for it, explain that it was a test, and force a password change on them.
Considering that teachers took my "lock screen on idle" policy all the way to the principal, I'd no doubt get in big trouble for this.
The janitors there would open ANY door for ANYone who asked, no questions asked. After ushering a girl out of the closed library, I asked a janitor to not do it, and he yelled at me for it. I'd love to send a friend of mine in there, have a janitor open a room, have said person remove some key equipment [say, the office receptionist's workstation], then the next say, "Maybe the janitors shouldn't open anything for anyone!"
I have been sending fake spam for years. No one can tell the difference.
Sent from my ASR33 using ASCII
Sounds like a vaccine against phishing. You send a harmless version of the virus in order to teach the immune system to avoid these in the future.
The secret would be to get an email circulating saying that the government is already doing this, with the aim being to target people who respond to the emails for further surveillance, or to take control over their computers to use them for spying.
80% of the people who would fall for spam and social engineering scams would fall for this, and take steps to protect themselves from it. Especially if you use phrases like, "a secret program put in place by George Bush as part of the Patriot act", and "steal bank information to finance illegal operations overseas".
This would need to be taken one step further to be effective. If the government actually removed money from the "victim's" accounts, then the money wouldn't be available to give to scammers. Treat that money as a higher tax bracket category, and you don't need to raise taxes for others. Two birds with one stone.
Seriously, for this to have an effect, the resulting reprimand would have to come via snail-mail, registered mail, or a visit from government agents. Email is too easy to ignore (unless it's from a very sincere Nigerian prince).
. . . so under this plan, I'll get twice as much spam only half of it will be fake spam sent to me by the government?!?
spam and phishing will unfortunately never get resolved. It's not just a technical problem, it is social, legal and technological. How did we stop fax spam? mail spam? unsolicited telemarketing?
teamb@game-master.com
In Soviet Russia, spam filters YOU !
If the government could just identify all those people gullible enough for fall for spam, then just go ahead and sell them herbal v1agra and/or breast enlargement cream, then we could pay down a lot of the national debt! There is precedent; we already have a tax on stupidity called a State Lottery. Hey, somebody's going to screw these people over, so why not let it be the government?
I've abandoned my search for truth; now I'm just looking for some useful delusions.
Sending out spam to decrease spam is like having sex to increase virginity.
I've abandoned my search for truth; now I'm just looking for some useful delusions.
We already have a solution to spam. Its yahoo domain keys. Its just that we cannot get anyone to use it. If we cannot people to use this, we will never be able to update the current email protocols. We live with spam for ever and resort to these attention grabbing money wasting tricks once in a while.
"Well, Jenkins, it looks like you have done ok on your key performance objectives, however, there is a note from our IT staff regarding discount viagra and russian brides..."
Xaotik Designs
From: yourfriend@friendface.com
This is fake phishing e-mail. You can safely click on the link below, login and see how fake phishing website looks like.
---
>clicklogin
.
.
.
#@$!omgwtfpwned
I'm not insane. My mother had me tested.