Slashdot Log In
My Short Life As An Unintentional Porn Spammer
Posted by
timothy
on Wed Feb 12, 2003 01:34 PM
from the you've-got-spam dept.
from the you've-got-spam dept.
Freerange writes "Mike Masnick wrote up his experience getting slammed by a somewhat new kind of spam attack that doesn't get much hype (yet?). A spammer spoofed his personal email address as the 'reply-to' for a batch of spam, with interesting results for Mike: "I can
now answer the questions 'who replies to spam?' and (should anyone ever
wonder) 'what are the hundreds of variations on bounced messages?'" From Politech."
This discussion has been archived.
No new comments can be posted.
My Short Life As An Unintentional Porn Spammer
|
Log In/Create an Account
| Top
| 570 comments
(Spill at 50!) | Index Only
| Search Discussion
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
(1)
|
2
(1)
|
2
Reverse spam really isn't that new... (Score:5, Insightful)
Re:Reverse spam really isn't that new... (Score:5, Interesting)
Re: Reverse spam really isn't that new... (Score:5, Funny)
> The new one i've run into recently is they use some kinda script so that the reply-to address in my address....which makes fintering really easy becuase how often do I send mail from my account TO the same account. However I could see some stuipd user getting very confused.
Re: Reverse spam really isn't that new... (Score:5, Funny)
(http://www.seizurerobots.com/)
It's "How do you keep an idiot busy for hours?" for the new millenium!
Re:Reverse spam really isn't that new... (Score:5, Funny)
(http://hewgill.com/)
IQ Test (Score:4, Funny)
(http://slashdot.org/)
Re:IQ Test (Score:5, Funny)
(http://beamon.ca/ | Last Journal: Wednesday December 15 2004, @09:55AM)
LOCK WORKSTATION, logout, shutDown, _Change Password, TaSK L1st, or Cncel?
I MUST KNWO! Give me answer! Pleez! NOW! Right NOW! PLEAEEHZ! PLEEZ!
Re:IQ Test (Score:5, Funny)
The *real* IQ test button is hidden on the back of your computer near the power cord.
Re:IQ Test (Score:5, Funny)
(http://slashdot.org/)
Reminds me of my days as a BBS sysop..
My board forced registration before you could post anything - in the registration sign-up (before it asked for any information) I had it say "Press any key to begin. If you don't know which key is the 'any key, it's the large one on the front of your computer labeled 'reset'
Over the course of the 3 years I had it running, the logs showed two people drop carrier immediately after reading that.
Re:IQ Test (Score:5, Insightful)
(http://www.gidds.me.uk/)
I've never understood why people don't put "Press a key" instead. The intelligence-challenged can search out the `a' key, which will work, and the rest of us will know that all the others'll work too. Plus it's two characters shorter -- benefits all round!
Re:Reverse spam really isn't that new... (Score:4, Funny)
(http://slashdot.org/...rinfo&nick=jovlinger)
The chat logs as people came in fuming and it slowly dawned on people that they had been had were priceless
Re:Reverse spam really isn't that new... (Score:5, Funny)
(http://dgould.org/david)
That reminds me of when it was cool to tell lusers that there was this huge ftp site at 127.0.0.1, just log in with your existing account...
No, it's "Dude, I hate to be the bearer of bad news, but I'm afraid you've been hacked -- the FTP server at 127.0.0.1 has all your personal files. See for yourself; just log in with your normal id..."
Thing is, it only worked when a sufficiently naive person would still be likely to be using a Unix system and be familiar with FTP, whereas now, even having heard of those things is something like a guarantee of knowing too much to fall for it.
Speaking of falling for it, though -- didn't I read here a while back that this particular troll had been used on the Scientologists, with spectacular success? Like, they were in court taking a deposition and their lawyer was shouting at the guy "Tell us who runs the FTP server at 127.0.0.1!"
Re:Reverse spam really isn't that new... (Score:5, Interesting)
(http://home.primus.ca/~ronsharp/tororg.html)
Re:Reverse spam really isn't that new... (Score:4, Interesting)
(Last Journal: Tuesday September 06 2005, @12:39PM)
The easiest way of me getting data (Word docs, code, etc) to and from a place of business where I'm freelancing and my home is by emailing the files from one web-based email address to that same email address.
Because the data is being sent from and to the same server, there's no chance that the email won't be delivered. So, you know that (barring a major server or internet breakdown) your data will be there waiting for you at the other end - no need to carry around any media at all.
It can even be made practically secure - just zip up your files and attach a password to the transmitted zip file.
Also, should you get side-tracked and not make it home (eg, if you get lucky and score, despite being a geek) then you don't have to worry about carting around a floppy disk or CD-R all day, or worry about losing it (leaving it at her place).
Temporary online storage like this works wonders.
Re:Reverse spam really isn't that new... (Score:5, Funny)
(Last Journal: Thursday November 29, @09:35PM)
What kind of a geek ARE you??? Not only do you talk about zip rather than gzip/bzip, then call zip passwording "secure", but you also talk about getting sidetracked by scoring, rather than some more sci-fi reason, like being shot at by storm troopers, attacked by some creature from LOTR, etc. Come on, get it together man! This IS slashdot afterall.
Re:Reverse spam really isn't that new... (Score:5, Interesting)
(http://dotfuturemanifesto.blogspot.com/)
More often than you might think. This is how a lot of mail systems support people like me who like to keep a copy of everything they have sent.
I do wish that more of the spam filtering people would take notice of these tactics however. Quite a few of the more clueless ones have all sorts of hack-back features that can end up slamming innocent people.
The only unusual thing in this case is that it was porn. The porn senders tend to be rather more discrete than most since they know that if there is an FBI type investigation they are sure to make examples of porno senders first. This tactic tends to be more common amongst the con-artists that the FBI are completely uninterested in prosecuting.
One of the big problems is that there is no agency that has an analogous operation to the mail-inspectors role in the post office. In theory this is wire fraud but the wire fraud investigators tend to be busy dealing with cases with a few really big transactions. They are much less interested in a case where the amounts are $30 or so, even though the totals might be millions.
Re:Reverse spam really isn't that new... (Score:4, Insightful)
This sounds to me sort of like referring to someone who discovers an unpublished URL by trial and error as a "hacker". Of course, I didn't RTFA, but I will once it is un-slashdotted.
er, get a better email client (Score:4, Informative)
(http://www.milksucks.com/ | Last Journal: Monday September 15 2003, @12:30PM)
Re:Most users too clueless... (Score:4, Interesting)
(http://www.aranach.com/ | Last Journal: Thursday August 02, @10:04AM)
I figure it isn't my space so I'll let Earthlink deal with it. They're probably the ones who sold me out in the first place.
Re:Reverse spam really isn't that new... (Score:5, Interesting)
(http://www.aranach.com/ | Last Journal: Thursday August 02, @10:04AM)
But that isn't the most disgusting part about it. All the bounced addresses were coming from one particular domain, which happens to be the domain my parents are on so I really don't want my email address blacklisted from their servers. Nor do I want my account closed by Yahoo, as I've had the account for a long time. Since I don't want this, and I hate spam as much as the next guy, I decided that I should send that domain owner's operators, which happen to be an ISP, an email message explaining what was going on and that if they could retrieve the headers from my message they'd have another relay they should add to their list to block.
On to the disgusting part. I get a message back telling me that I have a virus. A virus of all things, sending spam, to alphabetical lists of people on a single domain. Right. I try again, explaining the situation in detail so they can see what's going on. I include the bounce message, etc. They tell me they'll take care of it in that sort of message you know means they'll delete any correspondence we've had to this point and ignore it. Luckily enough I haven't gotten any more such signs that my email address is being forged, but I'm still put out that the people who should care, because it's their bandwidth and customers, first insulted me and then told me in so many words to bugger off.
What the Internet needs: (Score:5, Funny)
Re:What the Internet needs: (Score:4, Interesting)
(Last Journal: Tuesday September 28 2004, @01:45PM)
I agree with you, and these morons are missing the point. The email protocol is fucked, millions could be saved if we moved to something new. And it is no secret that MS and a few other major companies could have the power to do it.
Anyways, I gave you a few extra points. The question should be how. And, how on earth can we enforce the destruction of today's email protocol while introducing another? How can we even stop spam with a new one?
New Mail RFC (Score:5, Informative)
(http://youtube.com/watch?v=FCDJ0jhWKno | Last Journal: Tuesday November 14 2006, @01:31PM)
RFC 2487 [nyc.ny.us]: SMTP Service Extension for Secure SMTP over TLS.
SMTP [RFC-821] servers and clients normally communicate in the clear over the Internet.... Further, there is often a desire for two SMTP agents to be able to authenticate each others' identities. For example, a secure SMTP server might only allow communications from other SMTP agents it knows, or it might act differently for messages received from an agent it knows than from one it doesn't know.
Not New @ All (Score:5, Interesting)
(http://slashdot.org/ | Last Journal: Monday December 08 2003, @12:29AM)
Sucks when it happens, but isn't new.
Probably the same idiot in Minnesota:(
Re:Not New @ All (Score:5, Funny)
(http://jo-ham.com/)
If the FBI won't take it further, you could always beat seven shades of shit out of him, then when the police arrest you, assume his identity.
since they have a threshold (Score:5, Funny)
(http://shockandblog.com/blog)
Skynet (Score:5, Funny)
and the conformforting thought:
when spamfilters come alive... their prime directive will be "eliminate anything that is worthless"
Yeah, us too (Score:3, Interesting)
(http://www.erikd.org)
You Don't Like The Mail Admin, Do You? (Score:5, Funny)
(http://blockwars.com/)
Given that you just entered the domain name not once, but twice, and your post is likely to be seen my thousands, spidered, and google-cached, I take it that you don't like your mail admin very much, do you?
Why? (Score:5, Interesting)
Why not just put some bogus made-up address there?
Are the spammers just trying to cause as much chaos and unpleasantness for as many peoples as is humanly possible?
Re:Why? (Score:4, Informative)
(Last Journal: Sunday November 11, @09:31AM)
Perhaps some, but it's also a way to get past some spam filtering app, or to make you think its a legit e-mail. I remember there was a big whoopty-doo a year or so ago about spammers using someone@linux.org as the reply to.
Which goes into the trashbin first, hotsex69@sexparty.ru or ltrovalds@linux.org?
Re:Why? (Score:5, Informative)
(http://www.20bvert.com/)
Re:Why? (Score:5, Informative)
(http://www-jcsu.jesus.cam.ac.uk/~mjg59)
MAIL FROM:
section of the SMTP exchange doesn't include a domain that exists. Some will go further and do some checks to see if the localpart exists, too. If the spammers want to get to as many addresses as possible, they have to use a real address rather than a made up one. In some cases, they'll pick the address of someone who's irritated them (anti-spammers, for instance).
Re:Why? (Score:5, Interesting)
(http://slashdot.org/)
Revenge.
I've had several spammers disconnected by reporting them to their ISP. One of the ISPs I reported to was stupid enough to send the report (along with my email address) to the spammer (before they disconnected them.)
Next thing I know, I'm getting tons of bounce messages for spam I didn't send.
It stopped after a week or so.
It's nothing new (Score:5, Informative)
an article about it [techtv.com]
Everyone call your State Rep! (Score:5, Insightful)
It's easy to get things in motion, everyone is too lazy to try though.
No way to contact spammer (Score:5, Funny)
(http://slashdot.org/~$$$$$exyGal/journal/#naked | Last Journal: Tuesday January 04 2005, @04:23AM)
--sex [slashdot.org]
Re:No way to contact spammer (Score:5, Funny)
(http://go.away/)
Re:No way to contact spammer (Score:4, Interesting)
(http://www.youtube.com/watch?v=bA-DReZYftg | Last Journal: Sunday November 12 2006, @01:05AM)
I don't know if this actually works for anybody trying the spam technique, as I'd hope most people getting these messages would either be too smart to fall for it or too afraid of the stock market to set up and manage their own account.
Re:No way to contact spammer (Score:4, Informative)
(http://www.macrocosmictech.com/blog)
And since everyone loves to see spammers get theirs, go visit Behind Enemy Lines [freewebsites.com]. Be sure to visit the Lets Get Brutal [freewebsites.com] section to see what spammers look like in various states of undress!
Re:No way to contact spammer (Score:5, Informative)
Re:No way to contact spammer (Score:4, Insightful)
(http://slashdot.org/)
Re:No way to contact spammer (Score:5, Informative)
(http://www.macrocosmictech.com/blog)
Re:No way to contact spammer (Score:4, Informative)
(http://www.lbcpc.com/ | Last Journal: Wednesday November 12 2003, @05:30PM)
As far as I know, there is no way built into Outlook to do this.
I spent some time searching on how to do this a while ago, and the only way I know of is to use a COM add in. It doesn't work through the rules wizard, you have to go into your advanced email settings and register the DLL before it will work. Search Google, and you'll find the answer. A word of warning though... The one I found a while ago made Outlook painfully slow, so I ended up uninstalling it.
It is a huge pain the way Outlook has it set up. You can't set up a rule that strips the HTML, you can't set your email to automatically convert HTML mail to plain text, and you can't even use the VBA scripting language built in to automatically strip the HTML. What a pain...
Depends on Which Version of Outlook (Score:5, Informative)
(http://www.25hoursaday.com/weblog | Last Journal: Saturday May 11 2002, @11:36PM)
Re:No way to contact spammer (Score:4, Funny)
(http://www.coldforged.org/)
"We apologize for the previously displayed shenanigans. Those responsible for that ordered list have been sacked."
Not happy... (Score:5, Funny)
Way to go!
Happened to Me, Too (Score:5, Interesting)
Fix it with PGP. (Score:5, Interesting)
(http://www.jukie.net/~bart/ | Last Journal: Wednesday July 24 2002, @08:29AM)
Re:Fix it with PGP. (Score:5, Informative)
(Last Journal: Monday August 20 2001, @10:08AM)
PGP/GPG only ensures that you did send it, not that you did not. Since you can send e-mails without being signed, unsigned e-mails don't prove a thing.
Those that know you (or have your key) would know
enough about you that any non-PGP e-mails would be
suspect, but that's what,
Spam needs a technical solution. (Score:5, Insightful)
(http://www.youtube.com/watch?v=bA-DReZYftg | Last Journal: Sunday November 12 2006, @01:05AM)
Obviously, legislation isn't catching up and as evidenced by the junk fax law is useless when it does. Technical minds built the Internet, and I have little doubt that a solution could be found once we quit looking for the quick fix.
Re:Spam needs a technical solution. (Score:5, Interesting)
(http://plan99.net/~mike/)
It was kind of a cross between usenet and standard email. When you "sent" an email, it was in reality uploaded to your message store (the idea of the inbox was removed). Then notifications were sent to each person that a message was in the To field. That meant that for instance you could edit messages after they were sent, you could bring people in on threaded conversations half way through preserving the threading and so on. It also meant the attachment limit was decided by the senders account, not the receivers. Want to send a 200mb video to your hotmail using friend? No problem.
One of the features of this system was that key signing was built in from the start. That meant, you could opt to trust certain "roots", probably international ISPs. If you wanted to setup a newMail server, you'd have to get your hosting ISP to sign it for you, probably requiring a contract to be signed saying you'd shut down any abusive accounts etc.
Mailing lists were dealt with specially, I've never been happy with the way they currently work.
Combined with send limits (how often do you email >100 people?), that meant that spam could be cut down quite significantly. In particular, because it could be shut off at the source, if a spammer did somehow manage to spam lots of people at once, all it'd take is one report and the email would magically disappear from peoples message stores, before they'd even seen it in some cases. If the spammers were running their own servers, revoking their certs would do a similar trick.
It wouldn't eliminate spam of course, that's not possible. Smart enough people will figure out ways around it. However, having accountability built in from the start would help curb the situation a lot.
Originally I was going to write the client as a commercial app, but make the protocols open (with a non-commercial free license available). However, I ended up working on autopackage instead, so I never got around to it. If somebody thinks it'd be cool, contact me and I'll fill you in.
incase of slashdotting (Score:3, Informative)
My Short Life As An Unintentional Spammer
by Mike Masnick
Ever wonder what sorts of emails end up in a spammer's email database? Want to know who actually responds to spam and what they say? Want to know the myriads of formats (and languages) a bounced email message can take? I can now tell you all of this. Without my knowledge, I recently became an accidental porn spammer.
When I got home one evening a few weeks ago, I noticed that I had more than the expected amount of email waiting for me. A quick glance through the inbox showed about fifty "bounced" emails - saying that email addresses of people I had emailed did not exist. The problem with this, of course, was that I hadn't actually emailed anyone.
It did not take long to figure out what happened. While some bounces simply told me that the recipient didn't exist, others included the original text of the email I had supposedly sent. It claimed to be from someone named "Chris" or "Ali" and was a reply to an alleged message from an online dating site. Chris and Ali apologized for taking so long to reply, and nervously suggested that the recipient find out more information about them by going to a website. Clearly, this was porn spam. Out of principal I won't visit the websites that were in the spam messages.
The problem was, I hadn't sent these messages at all. I'm not Chris or Ali. I don't use dating sites. I don't have a porn website. I don't send spam.
One of the popular "tricks" among spammers nowadays is to set the "reply-to" address as the same as the recipient's email address. That cuts out on the problems of bounce mails, and also has a psychological effect on recipients who are curious what email they've sent themselves. Most spam filters have figured out ways to still capture these spam messages (though, I'm now hearing stories of legitimate emails that people send to themselves being classified as spam). I've received plenty of these types of spam, and most are filtered away, never to be bothered with.
It seems that this particular spammer took things one step further, and made the "reply-to" address for all of his spam message set to my personal email address. If anyone looked at the headers, it was clear that I had nothing to do with the email whatsoever. However, most mail servers aren't so smart.
With any spam list, there's a certain percentage of "bad" or outdated email addresses. Generally speaking, a server that receives an email for someone they don't have an account for will "bounce" the message. Those bounces go to the person who sent the message - normally found in the "reply-to" line. Since my email address was in the reply-to line, all those bounces started coming my way, regrettably informing me that my pornographic spam emails had not found their intended recipient.
After dealing with the rapidly growing desire to reach through the internet and strangle whatever lower-than-life scum did this to my email address, I resigned myself to looking at this from an anthropological perspective. Suddenly, I was in a position to offer information on things that few others would (hopefully) ever willingly have access to.
Should anyone want it for research purposes, I now have a fairly large collection of bounce messages. It appears there is no standard format for a bounce message (which, by the way, makes them painfully difficult to filter). They have infinitely different subject lines. They say different things in the body of the message, sometimes nicely, sometimes rudely. They show up in different languages with different explanations. Some admit that the account has been closed due to too much spam. Others simply don't exist any more (if they ever did at all). Some bounces quote the original message; some don't. Some include full headers; some don't. Who knew there was such variety in how mail servers bounce their email?
Beyond the bounce messages were all sorts of auto-responders. It seems that some of the email addresses in the spammer's database were emails people used to send responses to those who "request more info". Suddenly I was receiving huge files of information that I really had no use for whatsoever. I also found out about a number of people who were on vacation that week, or who had recently switched jobs. One even had an auto-responder saying "this is closed...I am tired of the internet... all internet access for me is closing". Some of the addresses were to subscribe to various mailing lists. Many bounced back confirmation emails, asking to prove that I really wanted to subscribe, while others just subscribed me automatically (which will now force me to manually unsubscribe).
While most of the "information" was fairly useless, I suddenly had the opportunity to peek into the lives of people I had no association with whatsoever - connected only by spammer. I felt like reaching out and commiserating with those who were sick of the spam and wondered if I should congratulate those with new jobs. However, there was no time for that, I had more erroneous spam fallout to deal with.
Next, came the responses. I, like many people, often wonder what sorts of people actually respond to spam emails. For years, it has been beaten into my head that you never, under any circumstance, respond to a spam email. It just shows that you're a live human being, making your email address more valuable. I'm still shocked when I come across people who haven't heard this. However, they are out there, and they come in all different shapes and sizes. I have their emails to prove it.
There are the confused, but polite people. One woman wrote me a nice message saying that a "horrible" mistake had been made, and that she had not replied to my online dating ad. She did warn me, however, that there are "plenty of strange people out there" and that I should be careful. How nice. Another woman couldn't remember what she had said in her reply to my non-existent online dating profile and wanted to be reminded. A few others just asked who I was.
Then there are the unsubscribers, who are under the unfortunate delusion that asking spammers to take them off their list will help. They send simple messages saying simply "unsubscribe" or "unsubscribe, please", as if that will ever get to the actual spammer, or that they would actually pay any attention to it.
Lastly, are the angry, but clueless. I feel their pain, but they need to find a better outlet. I received emails telling me things I never knew (and find unlikely) about my lineage and suggesting I go places I have no interest in going, using all sorts of language you wouldn't use in polite company. I also received a threatening letter saying that I would be hearing from some company's corporate lawyer.
None of these people stopped to think that it was odd that my email address includes, pretty clearly, my name - which is neither Chris nor Ali. With the number of spam messages that go out every day, I wonder if these people reply to them all. I guess, for some people with anger management problems, this is a kind of outlet. All day, every day, respond angrily to spam messages, and maybe it will have a calming effect on your life.
What's scary is that, for the most, part, I only saw the bounced messages. They continued for approximately 36 hours, and then stopped abruptly. In the end, about 500 email messages bounced back to me, so I can only guess at how many thousands of poor, unsuspecting email boxes are currently dealing with spam sent with my email address as the reply-to. I apologize to all of you, even if I had nothing to do with it. I don't want to date you, and please, feel no compulsion to look at the web page in the email.
Most people agree that spam is evil. It's a waste of time and a general nuisance. I can argue against spam from a variety of levels. It's bad for the internet. It's bad for users. It's bad for business. It's just bad. Luckily, there's a rapidly growing industry of companies (and simply concerned individuals) creating software solutions to help stop the spam menace. While there are debates over how well any of these systems work, it is possible to at least reduce your spam intake. Personally, I use a spam filter that is pretty effective in reducing my spam load to a mostly manageable level.
However, with something like this, there simply is no effective preventative measure in place. The spammers spoof the reply-to, making it whatever they want - so it never even touches my mail server at all. My inbox gets bombarded because there's no simple way to filter out the bounced messages since they are all so different. It's difficult to track down a spammer normally - and more so when the spam isn't even sent to you. Despite the fact that my address was the reply-to, it seems the spammer never sent me the message directly. I found a bounce message that showed the full headers and tracked it back. The email came from a mail server in the Philippines, and pointed to a website hosted in China, owned by a company in London. Tracking down the actual spammer would likely be close to impossible. Assuming they could be found, suing them would be nearly impossible as well, not to mention costly.
One potential solution to this would be to require every outgoing email to have a verified identifier of some sort, so that any email can automatically be traced back to the original sender. This (as does every solution) brings up other problems. There are benefits to anonymous email, and we wouldn't want to take that away (though, perhaps you could limit the number of emails that could be sent anonymously to prevent bulkmailers from abusing the system).
In the end, though, this sort of stunt has killed off the tiniest amount of support I had for spammers. These spammers stand behind their First Amendment rights to speak their minds (which is an argument that can be shot full of holes in a second). In this case, though, the spammer made no use of any First Amendment rights. What they did was just mean and nasty and a complete waste of my time.
Who replies to spam (Score:5, Funny)
(Last Journal: Tuesday September 06 2005, @12:39PM)
- Penis emlargements;
- Viagra;
- Boob jobs;
- Sex;
- Porn;
- Rebuilt credit;
- Credit cards;
- Cheap mortgages;
- Cheap health insurance;
- Cheap dental insurance;
- An easy way to make millions from home with little effort!;
- University Diplomas;
- Free anything; and, of course
- Spam lists.
Spammers try to sell (gullible) people what they might buy, never what they won't. I've yet to see a spammer selling flights to Mars - although I do predict it will be a growth area for spammers in 20 years time.Am I missing something? (Score:3, Interesting)
(http://userfriendly.org | Last Journal: Tuesday January 24 2006, @12:30PM)
Why wouldn't that work to vastly reduce the amount of SPAM?
Re:Am I missing something? (Score:4, Informative)
(http://www.gamesurge.net/)
DNS is not a terribly useful authentication mechanism for this kind of thing. Much more useful is origin-authenticated SMTP: the originator (either user or mail server) calculates a signed hash of the message, and attaches that when sending it. The receiver can verify that the signature is valid for the person (or mail server) that claimed to originate the message.
Obviously things lose in the transition period before every sender does that. You also get a huge fight over which algorithms to use, how to distribute and verify the public keys, and so forth. Welcome to Internet politics.
This is old news for me (Score:4, Interesting)
(http://www.faughnan.com/)
Curiously, I almost never get anyone writing to me complaining about the spam. That used to happen, but I think most folks have figured out not to reply. I also don't seem to have been blacklisted anywhere (faughnan.com); the blacklist maintainers are apparently smart enough not to be fooled by spoofed fields.
Why did they pick me? I think they like to take addresses that are present in the registrar databases. Or maybe they picked me because I complained about spam and write about ways to stop it (not that hard really, we just need to authenticate the sending service [faughnan.com] rather than the harder task of authenticating the sender).
In any event, sadly this is old news. Good to know it's starting to make its way into the public consciousness though.
Internet growth halted protocol refinement? (Score:4, Interesting)
(http://www.mwatt.com/index.html | Last Journal: Friday February 11 2005, @02:43PM)
IPv6, which includes security, ummm, mechanisms that could be utilized to curtail spoofing, some forms of DDOS and net abuses in general, but rolling it out seems too be gracial.
New RFC's could be authored that extend, modify or replace those upon which our present mail server's are based, but would... could anyone get them pushed through? Or is the Internet infrastructure so massive that any major advances in concept run smack into the issue of interoperability?
and in other news (Score:4, Insightful)
spam spam spam. if spam should be illegal, so should any form of unsolicited communication. that includes conversing to persons without their permission at the local pub.
i'm personally in favor of a more liberated
government system, but if we want our legislatures to make rules, let's make it a level playing field , not just fix the annoying problem we have of spam (that is created because of a technical deficiency in the overall system of itself).
Re:and in other news (Score:5, Insightful)
(http://www-jcsu.jesus.cam.ac.uk/~mjg59)
Spam is grossly different to most other forms of unsolicited communication in one simple respect - the total cost to the recipiants is hugely larger than the total cost to the sender. This isn't true of (say) unsolicited email from an individual directly to you, unsolicted junk mail, unsolicited telephone calls or unsolicited personal conversation.
Mirror. (Score:3)
(http://www.vidarholen.net/)
Coming next... (Score:3, Funny)
(Last Journal: Sunday July 13 2003, @10:38AM)
"So I got this story posted on slashdot after that time gigabytes of bandwidth got used up by that fake porn spam address, and so the site got slashdotted and that used up even more bandwidth until my ISP decided to limit my access, so I got another story posted under 'YRO' on slashdot about that and...."
It happened to my wife! (Score:5, Interesting)
(http://slashdot.org/ | Last Journal: Wednesday September 24 2003, @10:01AM)
Holy crap the email she got! Emails came from people all over the world. An incredibly rare number of them included clothing and were simply introductions. Most of them included an attached nude picture of (I assume) themself (either that or there is a cast of nude pictures of incredibly ugly people floating around somewhere). Some of them demonstrated their sexual experiences with animals. But every single one of them seriously pursuing some sort of sexual relationship with someone that
This whole experience turned my wife off of the internet for a long time.
I was able to track down the original post to alt.bestiality.whatever it was, and tracked it to a posting through deja news. (This was about 5 years ago). But ironically, there was nothing in that post that included "go to this website" or anything like that. The only contact information in it was my wife's email address. At the time, I assumed that the person who did this wanted us to change email addresses so he/she could have the one that we had (which was simply my wife's first name@iname.com).
After tracking it down I sent deja the information and asked them to pursue it. And I changed my wife's email address. We have our own domain now. BUT I still, occasionally login to the iname.com account and empty it. I want that account to stay active forever so that whoever tried this doesn't win.
What would you do if this happened to you? What are the defenses for this kind of thing? The email that came in wasn't spam. It was real email from real people who had real mailboxes. How do you prevent this kind of thing? So most of the antispam techniques that I know of wouldn't have worked. Additionally, we occasionally get emails w/attachments from friends who want to show us pictures of their kids. So blocking all attachments won't work. What should be done?
Do Spammers use bounces to prune their databases? (Score:3, Insightful)
(http://www.cruftbox.com/ | Last Journal: Wednesday December 18 2002, @01:56AM)
Replying can help stop spam... (Score:5, Interesting)
This is a letter I sent off to a company who offered me ways to enlarge my breasts. Being male and having no desire for hooters I felt obliged to reply.
----------
Do you people simply not bother to see to whom this message is going to? Do you not bother to do market research to see if I'm even going to be able to use the product? I am a man. I have a penis and not breasts. I am a guy, a bloke packing a "willie", a "johnson", "meat and two veg", a "one-eyed trouser snake", a "little fellow", a thingie, the "outy" parts to match up with the "inny" bits of the people to whom you should be sending this spam to and not me and my "Collection of dangly bits".
To put it simply people..."A DICK"
I have no interest in your product for the enlargement of breasts and request that you remove me from your list.
Thank You,
[name removed]
BTW: I'm also happy with the size of my naughty bits and request that you not send me information on that product should you offer that as well.
----------
To which I actually got this as a response:
----------
ROFL
Sir we are deeply sorry that you have recieved this advertisment and we are taking you off our contact list. We thank you for your polite and amusing letter.
Again sorry for the inconvience
----------
That was in August and to this day I have not seen any messages offering to give me "Huge...tracts of Land" since that date.
Sometimes it pays to answer a spam
Phoenix
Re:Replying can help stop spam... (Score:4, Funny)
(http://www.slashdot.org/~isorox | Last Journal: Saturday April 01 2006, @07:50AM)
To put it simply people..."A DICK"
You've got balls man...
Happened to my wife (Score:4, Interesting)
If it had been porn I would have looked into the possiblity of filing a defamation of character lawsuit. It was in your case and if it was written in the first person singular ( "come see me nekkid...") and had *you* as the reply-to I'd imagine you'd have an excellent chance of winning such a case - it would certainly be worth talking to a lawyer about.
Swift and effective retribution... (Score:5, Interesting)
(http://slashdot.org/)
Spam Addresses (Score:4, Funny)
(http://bloomd.home.mchsi.com/)
It's called a "Joe Job" (Score:5, Interesting)
The term Joe-Job got it's name originally from Joes.com when a spammer decided to get revenge in this fashion. Information can be found here:
Spam Attack! [joes.com]
I can say from having had this done to me, it absolutely sucks. It creates a huge mess that takes weeks to clean up, plus the joy of dealing with people who decide to attack you for something you didn't/would never do. If I were to ever get my hands on those responsible....
Unfortunately, the problem with tracking down those responsible for this dispicable act is the same one with tracking spammers down in general. It is time consuming, costly and may not yield a desireable result.
If you want to see more on this, just Google Search for "Joe-Job" [google.com]
It is good to bust/report spammers, but when you do, look at the spam and the site being spamvertized. You might have received a joe-job email and by reporting them, you're playing into the spammer's hands.
If you ever get joe-jobbed, I would say one defense on the web is to change your page to one similar to the "Spam Attack" page I reference above.
Better than Disneyland? (Score:5, Funny)
(http://www.tzs.net/)
A: I'm going to slashdot my web server!
Killed or Hurt Spammers (Score:3, Funny)
(http://www.data2design.com/)
3 little words (Score:4, Informative)
BEFORE
SEND
Seriously, if your mail server has that, turn it on. It means no one can relay mail through your server, unless their IP has made a successful mail-check. Some mail servers let you "authenticate" by checking to see that the reply-to address is valid on the local server, that, as you can see, does nothing and can be spoofed easily. Pop-before-send is quite a bit stronger and doesnt really require the clients to do anything. No, its not perfect, Im not saying it is, but it will help 99% of the time.
Re:3 little words (Score:5, Insightful)
(http://daniele.livejournal.com/)
HELO
and
MAIL FROM:
Many SMTP servers will do some sort of verification on the HELO line, but very little can be done about the FROM line. You can't easily kill addresses that don't match the HELO domain because legitimate mail relays would be unable to forward your mail on then.
I can send you a piece of mail that will display bob.hope@whitehouse.gov as the from address. If Bob had that address, and people replied to the forged address, he'd be getting the blame for my spam.
It sucks.
Re:3 little words (Score:5, Informative)
(http://www-jcsu.jesus.cam.ac.uk/~mjg59)
This happened to me... Here's what I did... (Score:4, Interesting)
(http://www.fastbugtrack.com/?source=sd)
I tried to find where they were coming from, some of the bounces were more informative than others... The originating IP ended up being someone(intentionally or unintentionally) running an SMTP proxy server... And the IP was out in the middle of nowhere... (Came back to a B-class set of addresses... Not much help in tracking down a network admin...)
Some of the bounces had the actual message... Which were linking people to a site which in turn asked them to buy something (saying that their order page was secure when it wasn't)... I tracked down who had registered the domain (the admin and billing contacts...) addresses ended up being in China (domain was cnmailads.com)... Sent email, no response... I set up procmail to redirect the hundreds of bounces to them, plus I had some simple spam filters, and redirected all of my spam to them as well...
The order page contained a form that had an email address for where the orders were really going... I made my own personal copy of the form, and began sending megs of data through... Entering bogus info to corrupt any real entries (who would order this crap over the Net from a website in China??? Who knows...) Email address was a yahoo account, which it didn't take long for me to fill it up... All added the yahoo address to my procmail redirector as well...
I went to a couple of spammy sites (cooldeals.com or something like that)... Signed them up to receive all sorts of valuable emails... Signed them up for some mailing lists too... Easy to sign up, and pain to get off of...
It had been going on for about a week before I started this, and stopped after about 2 days... Checked back to the link that was sent and the site was gone... Probably moving on to the next sucker email address and site...
One result: more SPAM. (Can you say "DOS"?) (Score:3, Informative)
For those who cannt access the site (Score:5, Informative)
This is a result of broken mail servers (Score:3, Informative)
(http://www.progrowthmd.org/ | Last Journal: Thursday October 14 2004, @10:46AM)
More and more of this stuff: (Score:3, Informative)
Feb 12 13:39:27 warthog sendmail[21909]: h1CIdQK21909: <dclark@mydomain.com>... User unknown
Feb 12 13:39:27 warthog sendmail[21909]: h1CIdQK21909: <paladin@mydomain.com>... User unknown
Feb 12 13:39:27 warthog sendmail[21909]: h1CIdQK21909: <mbrown@mydomain.com>... User unknown
Feb 12 13:39:27 warthog sendmail[21909]: h1CIdQK21909: <viper@mydomain.com>... User unknown
Feb 12 13:39:27 warthog sendmail[21909]: h1CIdQK21909: <kelley@mydomain.com>... User unknown
Feb 12 13:39:27 warthog sendmail[21909]: h1CIdQK21909: <rbrown@mydomain.com>... User unknown
Feb 12 13:39:28 warthog sendmail[21909]: h1CIdQK21909: from=<joe@nowhere.com>, size=0, class=0, nrcpts=0, proto=SMTP, daemon=MTA, relay=[200.162.240.168]
I tried to post all 65 attempts in this batch but the damn lameness filter said:
"Your comment violated the "postercomment" compression filter. Try less whitespace and/or less repetition. Comment aborted"
Nonetheless you get the picture.
New Mail System (Score:3, Informative)
There are 2 cases where I have replied to spam (Score:5, Funny)
(http://www.spamblogging.com/ | Last Journal: Monday April 19 2004, @04:55PM)
The ones that tended to be exactly what I wanted were the Nigerian scam ones. I tried to always reply to them, and if I noticed that they were in the same area as another, I would try to set them up with eachother or recommend that they talk to each other (sometimes one wanted to "give" me money, other times they wanted to "borrow" money - I had a laugh in recommending them to each other).
I think I only once had a conversation with them where they replied once.
2) I am now cocky about spam with spamassassin doing so well - so occassionally if I'm feeling up to it, I just go through my spam and reply to a bunch of it or try to unsubscribe by the method that they suggest.
I do it purposely in hopes of getting more spam to see how spamassassin holds up to it.
Yet Another Forged Email (not SPAM!) Solution (Score:5, Interesting)
First, inplement some SSL or other public/private key crypto into the server software.
When sending server A contacts server B, authenication is attempted. If B as yet does not trust server A (no public key yet on file), then the message is simply marked as questionable (or, say on the SpamAssassin point scale , give it 5 points). A failed authenication attempt should be marked a bit more. A successful authenication would not be marked. Otherwise, the message continues through with the usual routing.
Then you need to set up a way to give public keys between mail servers. I'd start with having the major ISPs talk to either such that MSN has AOL's key, AOL has MSN's key, etc. Basically anyone that acts as a major pipeline provider with mail servers needs to be involved in this step.
Then you get those ISPs and net providers to work at their customers; second tier network providers need to let their ISPs know of their server public keys, and same with business and residental customers with their ISPs. At this point there would need to be some careful authenication checks by the ISPs to watch for spoofers, as this is part of the Web of Trust.
Now, the idea is that if you want to make sure that your message from your email server reaches the reciever without being flagged, you just have to make sure the email goes along the path that you know is Trusted. So your email goes from your server to your ISP, where your ISP should now trust your server; from your ISP to the receiver's ISP, again with Trust, then from reciever ISP's server to the reciever's personal server, again with Trust. Everything authenticated, so the reciever should be able to trust everything in the headers.
Now say you haven't yet gotten the Trust of your ISP's server; then when you send, there's a mark on it from the lack of trust of your email server to the ISP server. The rest of the transport changes nothing, but the reciever will be able to notice the mark and can assume that there's some question to it. Or say that you send from your email server directly to the reciever ISP's server (removing your ISP's server); again there's no trust between you and the reciever ISP's server, so your message gets another mark. (That's how one can deal with 'rogue' email clients).
Another possiblity is that mail servers can apply different scores if the sending server is already on a blacklist, is otherwise unknown, or on the whitelist of public keys. This would make mail from blacklisted servers get huge marks against it.
Over time, an ISP or other organization can tally the Trust levels from various ISPs and see if a lot of untrustful message fall through. If that happens, they can simply remove/disable the public key of the ISP that is sending them. This won't stop the mail from going through, but it will start flagging everything as being untrustful. Presumably there would be some way to the ISP at fault to know that this happened, and can take steps; maybe they can look at their logs and see that a mail server upstream of them is sending too many untrusted messages, and then they can disable that public key, and letting the original ISP know that they've dealt with the issue such that the original disabling is removed. This is how one can deal with ISPs that are "spam havens".
At some point with the Web of Trust fully in place, email servers can then start blocking messages that lack sufficient trust, or basically scored too high already. While this point can be a problematic step in the question of free speech and false negatives (blocked legit messages), if the Web of Trust is given fully enough time to develop before this blocking begins, I'm pretty sure that you'd find no false negatives from this method.
Since someone with forged headers are most likely going to be either using their own email server, and/or using open relays on the net, it would be expected that these servers would never be trusted by the ISP that hosts them (much less other ISPs), the server operator would never try to establish any trust with an ISP, or that no ISP would ever want to trust these email servers, thus leading to effectly 'ignoring' of these servers.
Key here is that besides putting such software in place, it's a system that can be used to gracefully implement the Web of Trust instead of a cold-turkey approach (that is, maybe initially untrusted messages get only low points against them, but once the web's in place, that point value goes up). It's adaptable when new "spam havens" are found, or ex-"spam havens" take steps to reduce their problems. And it would seem to me (though I do not consider myself a guru on network problems or the email protocol) a simple thing to modify the existing email clients to handle this new function cleanly. Most importantly, it would be necessary to get word of these Web of Trust servers into the sysadmin world such that it can be implemented in a rather short period of time as to get the fully functioning Web in place.
My Long Life: 500 bounces? try 200,000 and growing (Score:3, Interesting)
(http://www.its.caltech.edu/~rerutled)
The website being advertised is the same (penis enlargment), and the IP remains the same (always www.fundamentalbusiness.net, served from China). At present, they're using http://www.fundamentalbusiness.net/x2/index.html [fundamentalbusiness.net] (/. away).
I have a done the following:
1) The company is a fraud (says I), geared to collect credit cards for fraudulent purposes. The name registration was done with a US company, and the contact information on the reg. is all fraudulent (bizarrely, it is only a few miles from my home). I emailed the registration company, pointing out that they probably were paid with a fraudulent credit card number, and so should "shut off" the name registration. No response. 2) The original website (since changed) had an actual address with phone numbers. Reverse lookup showed that the phone number is a land-line, and so likely leads to a real person (it could have been a cell-phone, which could be a person anywhere in the world, or to a non-existent phone). Phone calls gave a non-committal vmail service, and messages left were unanswered. 3) The website and emails are being served from a Chinese IP. Didn't even bother trying to contact.
Legal approaches: A) The original phone number/address on the website (no longer there) lead to Florida, which has no anti-spam laws. B) I live in California, which claims a $50/spam law. However, see below. C) I contacted two attorneys -- one (it turned out) who I knew personally, and found that to pursue a claim would require $15K-$20K retainer, which is substantially greater than real damages (and more cash than I have to sink into a speculative legal wrangle). The second attorney said the same, AND that even though I live in CA, the $50/spam law would only pay to an ISP (yahoo). N.B. the above was not told to me as a client, and did not constitute legal advice (i.e. could be wrong). C) Several email contacts to yahoo.com went unanswered. D) Complaint has been filed with the California Attorney General, with no response.
Solutions: A) My (apple) mail tool now has about 8 rules which sort out nearly all the bounces. Exceptions include bounces which have chinese subjects (can't translate, and the From keeps changing). B) Wait. Hope. Pray.
Why not just abandon my email address? Because it is my last name, registered at yahoo.com like 2 weeks after yahoo started in 1992 (or so). It's a damn cool address and I want to keep it!
My personal experience with the "joe job" tactic (Score:3, Insightful)
(Last Journal: Monday May 05 2003, @02:06AM)
The vast majority of the mails you get back are administrative emails saying that "the user does not exist." There is also a small amount that you get that are ill-informed, ignorant, and often very inflamed responses from people who respond.
At the peak of the attack, I got over 14,000 emails in a single day. It almost caused me to have to give up my email address, which I had held for almost seven years at the time. I didn't want to give it up so easily.
My solution was to install and use the Tagged Message Delivery Agent (http://www.tmda.net), which is a whitelisting service. It has my admiration for rejecting 100% of the unwanted emails for two reasons. First administrative accounts don't reply to their whitelisting requests, and second, ignorant angry users don't bother to reply to get whitelisted anyways.
As for the question of why someone would do this, I have thought of three reasons:
- To make their spam look more legitimate.
- Just to cause general havoc
- Because I have, in the past, not hesitated to complain to service providers about spam. This was probably retribution.
I did attempt to bring some form of legal action into the fray. I talked informally to Scott Frewing, a US attorney (one of the prime players in the Skylarov case), about the attack. He referred me to the FBI's online fraud folks, but couldn't really give me much encouragement on the chance of the success, since the spammer's website was located in the China Telecom domain, although the company it claimed to represent was in New Jersey. In fact, he told me I would probably be better off pursuing the case strictly on the basis of fraud and possible identity theft (the use of my email address) rather than as a spam case.
I stopped pursuing it after talking to Frewing.
In any event, I have won the battle in the sense that I will never see the unwanted mails. But I have lost the war in the sense that I can't really make the F*CKER stop doing it, and it does consume resources on my linux box.
Happened to my Sweetie Two Weeks Ago (Score:4, Interesting)
(http://ewhac.best.vwh.net/ | Last Journal: Saturday August 18 2001, @10:28PM)
My sweetie got Joe-Jobbed a couple of weeks ago. 20K bounces over the course of the day. Thankfully, the payload of the spam was only two lines of text, containing a URL to a (non-existent) pr0n site. So the bounce messages were comparatively short. A cursory look at the headers in the bounces suggested that the attacker -- 'spammer' is too genteel a term for this -- was using a constellation of open relays to spread the stuff.
She came into my office, saying, "Make it stop!" Sadly, there turns out to be little one can do to stop it. The emails were coming from thousands of different legitimate sites, all serving a legitimate bounce to an illegitimate spam. It was very distressing for her. Fortunately, the attack stopped, and things settled down after about 24 hours.
I wrote up the experience [kuro5hin.org] on Kuro5hin. Feel free to have a look.
Schwab
Happened to me (Score:3, Interesting)
(http://www.joncombe.org/)
Unfortunately, posting to /. can generate spam.... (Score:5, Interesting)
I submitted an article to
Less than two hours later, I started getting weird email, complete with
I haven't received any today at that address but I'm still kicking myself. Moral: spammers hoover slashdot, so don't post your email here, ever.
Story two: For almost five years I had the email bruce@altavista.net. In November, I got mail from Mail.com stating that the Altavista.net domain was being closed down and they were replacing my long-used address to something like bruce@way-cool-dude.com. Um, no thanks I said, I use this account for business and that doesn't work for me.
Ok, they said, how about we reactivate bruce@mail.com and you can have that? "Hmm, neat addy, easy to remember," so I agreed. They activated it on a Monday night.
Tuesday morning I woke up to more than 400 mails. Maybe 20% were typical Hotmail "make your penis so big you need a hose reel" spams but a full 80% were Joe jobs: spammers who had used that address as a reply-to. I knew I was going to shut it down but I watched it for three days just to see.
Total Joe job spams, almost four thousand (in three days) before I had them cut the damn thing off. Said fuck it, and bought a domain for business mail, and ended that adventure.
Someone oughta make a law.....
It's about ADVERTISING (Score:3, Interesting)
(Last Journal: Thursday April 12 2007, @04:02PM)
The message almost certainly contained some sort of serial-numbered link to the spammer's web site. That way if your serial number shows up in their web server's log, they know that you've opened their message.
Doesn't sound like a big win for them... until you know that advertising is big business. By proving that you opened the message, they can claim that their spam will make one more "impression". Initially, they'll want to do a little profiling because audiences "targeted" by interest areas can be sold for higher rates, something like [US]$10 per 1000 impressions in general and up around [US]$20 or more for 1000 targeted impressions.
Once you've opened one of those dumb spams with a mail client that will load images from HTML IMG tags, you become part of the "audience" which that spammer can sell to advertising clients.
And by the way... five hundred e-mails is nothing compared to the number of hits the spammer probably got back.
It happened to me too, but I got a little revenge. (Score:3, Funny)
(http://www.nativesmokeshop.com/ | Last Journal: Tuesday February 18 2003, @01:54AM)
This is NOT the spammer's page, just a link to a screenshot of their page with the URL included [greenwebdesign.com]
next attack (Score:3, Funny)
(http://www.michaelchaney.com/)
Mike Masnick wrote up his experience getting slammed by a somewhat new kind of spam attack that doesn't get much hype
Now he gets to write about a somewhat old type of DOS attack known as "getting slashdotted". Actually, his site seems to be holding up well.
MDC
How to easily avoid this kind of problems (Score:3, Informative)
The only effective countermeasure I found was to use SpamGourmet [spamgourmet.com]. It's a web site that allows you to define disposable addresses forwarded to your real (secret) address. The disposable addresses can be disabled. They automatically shutdown after 20 messages from unknown senders (not in your whitelist). So, a Joe Job would generate, at most, 20 replies into your forwarded mailbox. After that, you'd have to re-enable the disposable email, although you'd rather leave it disabled because it WILL be spammed again.
This happened to my girlfriend too (Score:5, Interesting)
(http://www.myspace.com/ylide)
Instead of writing a witty retort on a website though, I took care of it the way everyone else should from now on: (READ THIS) I looked up the registration info on the website that was being advertised in the spam....luckily it was a US registrant.
I then immediately called the technical contact listed for that company. After a few tries, I managed to get him to answer the phone. I told him politely but firmly that whomever he had hired to advertise his website/product was using questionably legal and certainly unethical tactics to do so and was making a lot more enemies than customers. He seemed genuinely upset that this was going on and gladly gave up the name, address, email address, and telephone number of the spam-mercenary he had hired. I called the spammer and left a voice mail telling him I hope he didn't really enjoy his email address or phone number a whole lot and proceeded to sign up for any and every mass marketing, porn, magazine subscription, and telemarketing form I could find.
Sometimes the operator of the website is the one doing the spamming, and if this were the case I would have chewed him a new one when I talked to him. Either way, you'll get a pretty good idea of where the spam is coming from if you just call the webmaster for the advertised site. I've been saying for years that this is how they need to enforce spam legislation....bring charges against the website operator rather than trying to track down the spammer. No customers to spam for, the spammers will dry up and blow away. Legally, it makes sense...if you hire someone to kill a person for you, you're legally culpable...so hiring someone to spam for you should get you into trouble as well. Make the first offense a "warning" in case they hired a marketing company and didn't know they were spammers. A slap on the wrist and warnings of heavy fines for future infractions will most certainly make them choose more wisely when picking a marketing company.
Doesn't protect the ISP or end user (Score:3, Insightful)