Slashdot Mirror
Amazon Bulk-Email Service Could Lure Spammers
snydeq writes "Amazon Simple Email Service and Amazon Web Services look to be a potent combination for businesses and developers, no matter which side of the law they're on, InfoWorld reports. The newly announced bulk email service, which will enable Amazon customers to send 100 emails for a penny, could prove enticing to those seeking a cheap way to bombard inboxes with spam, malware, and phishing lures. Amazon claims its in-house content filtering technology should assuage anyone thinking SES will be used by scammers. 'Those assurances aren't entirely heartening, though, unless Amazon is way ahead of the curve with content-filtering technology. Email services and software vendors have tried for years to keep spam and other unwanted messages from showing up in users' viewing pane, but the crud keeps slipping through.'"
suck my herbal v1agra c0ck!!!
By definition, isn't this spam? 100 emails for a penny; 10,000 emails for $1; 1 million emails for $100?
WTF do you think they will use it for except viagra, penny stock scams and nigerian 419 scams?
Or does anything decent really have to run on a server?
Build your own energy sources from scratch. http://otherpower.com/
Amazon's content filtering may be on-par with the industry. But if any customer has the temerity to forward Wikileaks docs through their bulk email service, I bet we'll find out that their "spam" filter is better than we thought.
Receiving emails, filtering out the spam, malware and other objectionable content, and storing them until the recepients pick them up is expensive.
I've often wondered whether a penny tax on public emails could be used as an elegant solution to spam. Go ahead and spam away, but Uncle Sam will come around to collect.
spam filters don't work?? that's news to me because i haven't seen spam on my gmail account in years, and i've posted on public forums with that thing.
If you mod me down, I will become more powerful than you can imagine....
When I read that Amazon was going to "Lure Spammers" I was hoping they meant "into pit traps, filled with tigers."
Boy, was I disappointed.
John
In their docs, they mentioned something about working with other Major ISPs. From what they indicated, other ISPs (Google, Yahoo, AOL, etc) track metrics on emails - people who click them as "spam", "objectional", etc. These ISPs forward this information back to Amazon. If they detect that someone is sending out mail which is being flagged as objectional by too many users, they can shut you down.
Making money and gaining prestige too often drive business decisions and are the enemy of "doing the right thing."
Why should businesses be interested in doing the right thing? Small businesses can develop a strong competitive advantage by deliberately focusing on ethics. They can earn repeat business and a good reputation. In addition, business ethics are important because, without them, three behaviors result:
# People follow their own preferences without concern for others.
# Individuals lose their sense of purpose and fall victim to the motives of others.
# Most importantly, people cannot set the right priorities for dealing with daily demands and stresses.
Unfortunately I don't have real data to backup my fading memory... however, IIRC from my previous job experience, spammers pay a fraction of what Amazon is charging to send spam. This isn't to say that someone isn't going to try to abuse the system.
This, however, might be a great service for quasi legal spammers -- businesses that send "newsletters" to customers who "opted in" to receive mail from the business and all of the people they sell personal information to.
.. email service provider could be abused to send spam ? You should to tell all ISPs and maybe even google ! This could be dangerous
Is there anything it can't do?
Those assurances aren't entirely heartening, though, unless Amazon is way ahead of the curve with content-filtering technology.
Amazon has the spammer's credit card details, knows where each email comes from, and can freeze or terminate accounts at the touch of a button (or via an algorithm). This gives it a considerable advantage over those that have to passively filter spam.
And in any case, spam filters are pretty damn good these days. I've had a public email address for going on 15 years, which used to get hundreds of spam emails every day. Now it's very rare for even one to slip past GMail's filter.
I haven't really bothered figuring out my bandwidth per unit currency but I would imagine that one could send 100 e-mails from their home computer for far less than a penny in bandwidth / electricity costs, especially if one were looking to send 100,000's of the things.
Why would any spammer pay that much when they can rent a botnet?
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
Spamazon.
---- Teach Peace. It's Cheaper Than War.
I think this unattractive to true spammers due to the $0.01 per hundred messages charge, and they'll just be terminated anyways. The real spammers send millions of messages a day, most of them to invalid recipients that never get anywhere.
Most spam abuse of SES is likely to come from the uninformed, or misguided newbies.
As described on amazon's site
:
The response rate for spam is very low (1 in 12.5 million according to http://www.techradar.com/news/computing/spammers-get-1-response-to-12-500-000-emails-483381?src=rss&attr=all), so a spammer would have to pay 12.5M / 1K * $0.10 = $1,250 to get a response by paying Amazon to send emails. Multiple responses will be required to make a sale. If they can't make $1,250 of profit per response, they can't make money by using Amazon to send their spam.
The company I work for used to use a company called Postini for spam filtering. They are now owned by Google. They do a really fantastic job of spam filtering. Over the past several years, with my employer and with GMail, zero spam has gotten thru and the number of false positives have been about 1 every few months (and even then it was never anything important).
50.16.0.0/14
67.202.0.0/18
72.44.32.0/19
75.101.128.0/17
174.129.0.0/16
184.72.0.0/15
204.236.128.0/17
216.182.224.0/20
Mail from these ranges should probably be refused, or, at minimum, subjected to heightened scrutiny.
POPFile classifies email. Not just spam and not-spam, either, but into any number of categories you choose (personal, business, etc.). The more email you feed it, the better it gets at automatically classifying it.
First and foremost, why should I sign up for this "service"? Last time I checked I can send out mail quite fine, without paying anyone for it. Now, I rarely send out millions of mails, but a few thousands (for a opt-in newsletter, in case you're concerned) work just fine in a matter of seconds.
And second, why should I assume that any of these mails will actually reach their targets? Any mail admin worth his salt (and every filter provider) will have the relevant addresses SO fast on his block list that you can't even use it the second day of its existence sensibly anymore.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Good,spam from amazon should be easy to block since they wont be using a botnet to send it. I hope lol. Which raises another question how will amazon guarantee there spam will land in mail box's?
Jack of all trades,master of none
Up is spelled U then P.
More coming up at 6...
-One of the major features is an api to call for email. This will allow your app to work without the need of any configuration of mail servers inside the amazon ec2 cloud.
-Their mailing server tracks mail results (bounces/failures/sucess/complaints). This will remove the logic from your mailing app where you have to directly talk to a smtp server to test the users address/track response which might fail because of sever configuration/reverse dns/outside of domainkey/spf. Looking at the API you might not be able to pull out which email address fails, can anyone confirm?
-The initial account is limited to 200 messages a day in a sandbox. You have to apply (24hr turn around) to unlock the account for 1000+ messages a day. You also have to verify every from: address before it will attempt to send from the address. Also the scale slides as you cannot signup and bulk spam 100k addresses as it takes time for your service to build up. If a complaint is filed against your account they also throttle the account. After a few complaints your account is terminated.
-They run scans on outbound mail. If something is triggered the account is throttled.
All I have to say is http://www.authsmtp.com./
I have no relationship to them other than a happy customer, but it took me WEEKS of effort to find a good mail relay from the cloud that could hit the inbox of all of the major e-mail providers (Gmail, Hotmail, Yahoo, etc.) They do it every time and for very little.
Make "visited links" not blend in with the text on the page. They appear to be the same color as all other text and you can't tell they are a link.
It's unlikely spammers would want to pay a penny per 100 mails, when they can use compromised boxes to send thousands for free...
Spam has a very low hit rate, if you send out a million mails maybe a small handful of them will achieve the desired result, the rest will either be ignored, bounce, or get deleted by filters.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
From their website:
http://aws.amazon.com/ses/#functionality
"Verify Email Addresses: Before you can send email via Amazon SES, you need to verify that you own the email address from which you’ll be sending email. To verify an email address, make an API call with the email address as a parameter. This API call will trigger a verification email, which will contain a link that you can click on to complete the verification process."
So, what's all this talk about Amazon needing great content filters etc? Sounds to me if anyone is getting an email through this service, they approved it and they can unsubscribe anytime. Am I missing something?
My mail program can send to hundreds of contacts no problem (assuming I had that many in my address book). Real mailing lists will be using something like Majordomo. So who would actually want to pay for this, other than spammers?
If it is commercial, and I have not explicitly asked for it, it is spam, and illegal where I live. I bet no content filtering will be able to detect that. If I start to receive such from Amazon, all their mail will start to bounce.
Doesn't matter if my viagra emails come from a hacked chinese botnet or an amazon approved paying customer - I still don't want that garbage in my inbox.
What ever happened to being responsible for what leaves your network? Recipients, and even email operators often simply give up reporting abuse, as traditionally the success of reporting to abuse departments has been very low. And isn't this a little like closing the barn door after the cow is gone? A simple stolen credit card, and 24 hours head start, boy are we in trouble with that kind of power. And the idea of 'opt-in' or 'permission' based according to current anti spam legislation is so loose, and untraceable that it is laughable. Pity the legitimate users who wish to use EC2 for email, won't take before the only way for users to protect themselves will be to block the source. The email marketers are shooting themselves in the foot, and this sets the stage for some nice legal action. The idea of the sanctity of a users mailbox will have to prevail, and hopefully it will happen before people resort to radical solutions like 'blacklist unknown senders' or stop using email for communication. Just like you have the right to decide who can enter your home, you can decide who can send to your email box, but when it reaches abusive levels from a single source, this has always resulted in drastic measures. At least we hope they force a header 'X-EC2-BULK-EMAIL' ;)