Slashdot Mirror
Giving Your Greytrapping a Helping Hand
Peter N. M. Hansteen writes "Some spam houses have invested in real mail servers now, meaning that they are able to get past greylisting and even content filtering. Recently Peter Hansteen found himself resorting to active greytrapping to put some spammers in their place. The article also contains a list of spam houses' snail mail addresses in case you want to tour their sites."
It just seems like it'd be easier now to find out the spam mail servers and block everything that comes from them.
The Internet is generally stupid
Um, how much spam does the average /.er even get per day? I have gotten exactly one spam message that has made it past Gmail's spam filtering this year (2009) and it was quick and easy to delete. I don't give my e-mail address out to everyone, but I do sign up to many things with it yet still it is very rare for spam to make it to even my spam filter. So is spam really that large of problem in 2009?
Taxation is legalized theft, no more, no less.
I seem to remember reading about a convicted spammer who created Dynamic Dolphin in Broomfield, Colorado. Does anyone else remember who this asshole was? I would not be surprised if he started the whole thing.
- Zav - Imagine a Beowulf cluster of insensitive clods...
Not that there was ever really anything more than a facade of impartiality at Slashdot, but thanks a bunch for tossing even that facade in the dumpster.
This twit even writes about himself in the third person in an attempt to disguise his self-promotion; disgusting.
From TFA:
Dynamic Dolphin Privacy Protect
5023 W 120th Ave #233
Broomfield
null,80020
Hey, I used to live in null! Had to leave though, there was nothing to do.
I was not clear on the definition of grey-trapping. It is the process of providing decoy e-mail addresses that are discoverable by harvesters but not by ordinary humans. When mail arrives at the destination of a decoy, the sender IP address is then added to the spam filter of the receiver.
Basically sort of a honey pot approach.
So you might ask why can't ISPS do this at the ISP level rather than the user level? Make it opt-in, white-listable, etc..
The problem is what happens when some reputable sender get's on the list.
FOr example, Joe Spammer takes his address list and does a sing-up operation to Yahoo for all the addresses. Now the Yahoo registration server then does not automatically enroll them but still it sends an e-mail to every one of the e-mail addresses. some of which are the decoys.
so Yahoo gets grey-listed by the ISP.
I would think this attack would also foul up every grey-list in existance as well. So I don't actually understand how grey-listing works.
Some drink at the fountain of knowledge. Others just gargle.
I was using something similar. The trick is to identify the ISP mail servers. Usually by some naming convention of the ISP ... but in some cases you have to just wait for a complaint to come when they get blacklisted. I solved part of that by sending the rejection list to the recipients at times so they could check it.
Meanwhile, greylisting is completely different.
Greylisting means that any new "triplet" (recipient name + sender's name + sending IP address) is TEMPORARILY rejected for X minutes. This is because many spammers were using zombie machines that would not try to resend the message OR would keep trying with different sender's names. Legitimate senders and email servers would (MOST OF THE TIME) be able to handle the delay and the message would get through. All future messages with that "triplet" would be received without delay.
At one time I invested a few weeks time into building a heuristic antispam filter. One of the principles I used was very similar to this (there were many others).
I came to the conclusion pretty quickly that in the game of anti-spam, the larger the email pool you have, the more efficient your heuristic tools can be. Once I proved that to myself, I went looking for who was doing the best job using the techniques I decided worked best, and routed my mail through them.
Its cheap, effective, and gets the spam off my network bandwidth. Even if you do a perfect job yourself, you're still paying for the traffic. That's a waste by itself.
If you're so worried about privacy, get yourself an appliance that uses the same principles as the services (like postini, etc.). Either way, antispam is no longer a business for the individual.
The problem with quotes on the internet, is that nobody bothers to check their veracity. -- Abraham Lincoln
How does "investing in real servers" let the mail through content filtering? Last time I checked, a content filter reads the *contents* of the mail (ie not the envelope or the header, hence the name). The spammers can buy servers until they're blue in the face, that won't make a blind bit of difference to the outcome in that case.
Damn, I thought this was going to be about ways to construct a better snare for catching the aliens.
So far my pit trap has only caught a few squirrels, but I'll get one of those little alien bastards one day. And then we'll see how he likes being anally probed. SQUEAL PIGGY!! YEEHAW!!
What if Tetris was invented by Nazis?
Seconded. My email addresses tend to be old, public, and static. This means they get a ton of spam. It's not worth the time and effort of handling anti-spam in-house when Postini can do an equivalent or better job at a reasonable price.
Switching to Postini also freed up a ton of RAM and CPU on our hosted servers.
exactly combine this with DKIM and a external reputation system....
(looking at ones navel is fascinating but knowing what other people this is spam is a good idea)
regards
John Jones
www.johnjones.me.uk
I did my best to resist the impulse to stop browsing these comments at -1 because I had too often found interesting comments that had been modded down for the wrong reasons.
I guess I won't be able to do that any more, because I get too sad when I see how much energy some people expend in hatred of gays and blacks. Say, maybe we could filter comments by more than just the number? I wouldn't mind being able to see "-1 Flamebait" because often you find insightful comments that have been modded down by committed astroturfers, but "-1 Offtopic" (which my own comment here is, by the way) could get filtered out. Or how about a "-1 Racist/Sexist Asshole" moderation choice?
Where's the suggestion box here at Slashdot, anyway?
You are welcome on my lawn.
Can we "tour" those sites with molotov cocktails and pipe bombs?
You are welcome on my lawn.
You are able to do all sorts of wacky things with moderation effects. Just make all moderation other than off-topic have no effect on rating, and browse at 0. Presto chango, "-1, off-topic" goes away and everything else gets to stay.
Try not to take me more seriously than I take myself.
For every single message you are getting, google is probably filtering out at least a hundred.
My own mail servers, tiny in comparison, get about a connection every second. 98% of those connections are rejected out of hand (bad HELO, fucked reverse DNS, residential IP address, bullshit brute-forced email address, etc) and of that remaining 2%, half is legitimate email. Which means for every hundred connections, one is legitimate. So 1% of all our mail traffic as legitimate. 1%.
In other words, you have no clue at all how fucking bad spam is. It is bad. Really bad.
IMAP is flaky and slow. It is a hack to map googles lack of folders onto IMAP's idea of folders.
It is a bitch for an administrator. There is no good way for an admin to setup email forwarding accounts--yeah, the user can do it, but you have to create an account for them and they have to do it, you cannot!. Their concept of distribution lists suck. You cannot change somebodies email address without creating a new account. I could go on but I wont.
Basically, for a business, using Google apps sucks. The only thing it has for it is the webmail interface. But integrating "real" mail programs with it sucks.
Bottom line is Google apps is 100% lock-in. It does thing in its own unique way and does not integrate with anything else worth a damn.
Just switched a client to google mail for business (really, what is it called? Google Apps? Google Mail? huh) and have heard nothing but complaints. The "gmail" thing gets email that never shows up in their imap folder, their imap folder gets stuff that disappears from their gmail thing.
Attachments work funny.
If you delete message from a "thread" in gmail, it will delete every "send" and "reply" message in the whole damn thread and thus nukes all of it in Outlook. If you nuke a single message in IMAP, it fucks up how gmail handles the thread.
All kinds of things. Their thole thing is great, but the minute you want to use a "real" mail program on top of it (like most businesses I know), trouble brews and shit just doesn't work the way you'd expect. There was a reason Google took so long to add IMAP support--their whole damn system works like no other email program. I bet they had to basically hack the whole damn thing to work like a "real" mail system IMAP was designed for. Basically, using them is a horrible form of lock-in.
Now I have to move them back to a "real" mail system this coming week so their life can work as it always did.
Because it is cheaper in terms of bandwidth and CPU to first reject email based on things other than content. For example, you can quickly weed out about 85% of all spam traffic by just rejecting assholes who use mail-formed HELO's or don't have proper DNS. Filtering based on simple things like that dont eat your CPU and are very effective*. You can also weed out a bunch of trash by simply blocking residentail IP addresses using Spamhaus**. Greylisting will nuke about 10% of the rest, leaving you with 5% for content filtering.
If spammers buy "real servers" it means they aren't sending you bullshit headers with funky smelling DNS. It means they will eat into your CPU budget because you now have to fall back on content filtering. You dont want to do content filtering. You want to have spammers strike out because they aren't acting like real mail servers. 85% of spam comes from shit that acts nothing like a legit mail server.
* If you your EHLO doesn't match your reverse DNS record, say HELO to a disconnect. If AOL and Yahoo are doing it, I'll do it too. Cause if you don't have it configured the way the big-boys like it, you have worse problems then me rejecting your email...
** whose list of residential IP's are provided by the carriers themselves, not a bunch of spiteful assholes like SPEW's. And if you insist on running some SMTP server at home, you can de-block yourself automatically by visiting their website. Plus I'm pretty sure the bigboys use this list as well, so again, if I block your email, AOL and Yahoo are blocking it too.
Your points not that informative, and simply referring to mail admins who are trying to minimise spam mail to there users as assholes a dozen times won't change that.
Firstly, who says these people were talking about a corporate environment anyway? Secondly, when they blacklist emails there are other options than simply destroying all mail that reaches your domain. I have seen a number of setups which simply respond to 'spam' email with an email explaining the reason for the rejection and a phone number to contact to get your domain cleared.
Ethics aside, has anyone thought of hiring the RBN to SPAM/DDoS these people? (Just to annoy them)
Fight fire with... Vodka... In Soviet Russia, fire fights you! (Sorry, had to be said).
Founder & COO, Hayai India (hayai.in) / USA (hayaibroadband.com)
"Cause I'll just email your manager and the sales guy who didn't get my customers email and hopefully you'll be fired."
I'll be fired because I blocked email from an IP address in your range that's set up to fire spam at people?
No, I don't think so, in fact I can advise the sales guys and management that anything coming from that IP address is likely to be fraudulent anyway. Check who you rent servers to, and check their activity, or lose the ability for that IP address to mail my servers until I'm happy you've got your act together. The end.
and why is it different than greylisting? Why did these guys feel the need to make up a new name for the something they're copying from someone else?
-- Programming with boost is like building a house with lego. It's a cool but I wouldn't want to live in it
and unsustainable practice. just because jacksauce saw some AOL ips spam him with subscription notices doesnt mean the return addresses actually map to real people, or the intended effort was prankish in nature. it could simply have been designed to manually harvest emails, all part of a botnetted script.
this guys out of touch. real people, the ones you hope for revenge, dont exist anymore in the spam world. if the problem becomes pronounced enough your spam filters should be able to generate a report of the offending subnets and allow you to blacklist them. problem solved.
Good people go to bed earlier.
Most of us "assholes" use metrics to make those kinds of decisions. From there it is easy to show the dumber ups how much spam is originating from specific sources and get them to agree on the +2 to spam score. Road Runner comes to mind (99.3% Jan08-Mar09). So does fdcservers (100% Jan08-Dec08). If you find anything other than open relays, proxy sites, or malware on fdcservers your doing good.
Having to work for a living is the root of all evil.
Okay. Fair enough. There are exceptions.
I'm bitter because the now defunct SWEWs were overzealous assholes who cast a giant net. Our tiny /26 got caught when our upstreams /16 got blocked for whatever reason. We only had a couple clients get their shit rejected--and in those cases our client knew the recipients personally, I just had them call the recipient to inform them they had an idiot running their mail server.
The people using things like SPEWs to block mail traffic were not thinking like you are. They are either hoping for a quick fix or are on some kind of vigilante mission. The former can be educated by letting them know how much legit shit they've blocked. The latter are hopeless and as I said a few times, it is easier to let the higher-ups know what the deal is.
If you've got the stats to back it up, that is a whole different ball of wax. If I was in your list, I probably has doing some serious shit. I do the same thing only with comment spammers that have IPs of open proxies. As long as you have the metrics to back things up in the off-chance you do block a little legit traffic, life is cool. But you gotta have the metrics, which means you gotta thing. People who use spite-lists aren't thinking, and that is the problem.
I'm sure it is well worth a spammers time to at least try their luck spamming google. After all, the hard part isn't getting a list of addresses--you just spam a-zzzzzzzzzzz@gmail.com. The hard part is getting past their filter and if you can be the only spammer to gets it right, you win at being a spammer.
But yeah, something tells me spamming google from a real server would result in getting blocked pretty quickly.
Stupid spammers.
"Except you'd be wrong because we aren't spammers and dont have any on our network. "You" are just an overzealous sysadmin who blocked legit email that was meant for your sales staff."
Why have I blocked you in response to spam then?
What the hell are you even fucking well talking about at this point?
I propose to block a host I receive spam from until I receive some sort of assurance that it's not spamming any more. Why are you so angry about this?
I've actually proposed something very similar to this before, called a Solicited Bulk Realtime List, which would be an elaborate DNSBL-style spamtrap whose purpose is determining which lists play fair (no-unsubscribe vs opt-out vs opt-in vs confirmed-opt-in) regardless of solicitations. Such an index would enable users to safely unsubscribe, and perhaps more importantly, its widespread adoption would force all "list" emailers, be they spammers or not, to better implement subscription management.
SBRL would also enable the ability for a filter to set a threshold for new list mail. Let's say I completely block any "list" mail that the SBRL can't confirm unsusbscribe works, and then I count a day's incoming confirmed-opt-in emails plus twice the number of the remaining emails (opt-in/opt-out). Anything over my threshold gets digested just like a mailman list with the digest feature (a collection of all of them that came in over the day) rather than direct delivery.
An IT-grade implementation could have new addresses start at a high threshold (e.g. 10) and then lessen by one per business day until it hits the default threshold, e.g. 3.
Use my userscript to add story images to Slashdot. There's no going back.
How is Postini doing with false positives these days?
We had them at a medium-sized company I used to work for a few years ago, and it was a huge help, but some of the marketing people had a terrible time getting email from some sources they wanted that Postini was deciding was "blatant spam", and dropping without putting it in the quarantine.
Yeah, none of that email was anything that I would want, or probably you either, but the marketroids thought it was pretty important.
Some of the other providers have better efficacy these days. I'd name names, but plugging the company I work for now would probably be considered spamming.
"User "Ftard" in China starts spamming with a spoofed return IP, and a bogus return address which matches the mail server at the spoofed IP."
Well unless Ftard is using an open proxy, which I'm quite happy to block too (this is sadly not 1990 any more), then his TCP/IP session has to come from somewhere and that's going to be more reliable an indicator of where it came from than the return address. Never bother looking at the return address on spam.
"However, I would add that upon request, you also be willing to prove both the origin AND content of the messages to be spam."
Ch34p V1@gr4 !! Ph4rm4cy 4 U!
I think that's usually proof enough.
"In addition, think about someone running a hosting company. They might have 20 different customers all sourcing from the same IP but different domains. By blacklisting just the IP, you're actually shutting down multiple other email providers who haven't been spamming you."
Sure, but in this case it's either allowing spam to get through and try to filter it by content, or a little collateral damage.
I prefer the latter because it has consequences. spamUall.com rents space on one of these and starts to get the IP blacklisted. Other customers start having problems and contact El Cheapo ISP to do something about it. Spammer gets kicked, El Cheapo might be more careful who they rent to next time. If they aren't more careful then the other customers find another provider because El Cheapo keep getting blocked.
Postini provides 3 levels of detection:
Believed to be valid mail - This gets delivered. Of the hundreds of spams I get daily, a few fairly innocuous ones do get through. I am not diligent about forwarding these to postini to report them.
High Probability Spam - This is the nasty, obvious spam that's fairly easy to detect. Its the vast majority of spam. I've got postini set to not even both showing these to me in my daily block list.
Probably-Spam - Postini holds these, and sends me an email every day at a specified time with a list and links. I get between 10 and 20 of these in a day. The overwhelming majority are spam and can be ignore. One or two in a day are not spam, but most of these are from sites that send out bulk mail -- vendors with reciepts, social sites with notifications, stuff like that. Almost never is a personal note or one to one business email caught in that trap. With two clicks I get those delivered.
Overall, I'm extremely happy with the service.
Yes, I know it has privacy issues. I've decided that with my mail (at least these accounts) this is acceptable to me.
The problem with quotes on the internet, is that nobody bothers to check their veracity. -- Abraham Lincoln