Slashdot Log In
100 Email Bouncebacks - Welcome to Backscattering
Posted by
timothy
on Mon May 05, 2008 04:50 AM
from the annoying-as-heck-if-heck-is-like-hell dept.
from the annoying-as-heck-if-heck-is-like-hell dept.
distefano links to a story on Computerworld, excerpting: "E-mail users are receiving an increasing number of bounceback spam, known as backscatter, and security experts say this kind of spam is growing. The bounceback e-mail messages come in at a trickle, maybe one or two every hour. The subject lines are disquieting: 'Cyails, Vygara nad Levytar,' 'UNSOLICITED BULK EMAIL, apparently from you.' You eye your computer screen; you're nervous. What's going on ? Have you been hacked? Are you some kind of zombie botnet spammer? Nope, you're just getting a little backscatter — bounceback messages from legitimate e-mail servers that have been fooled by the spammers."
Related Stories
[+]
Technology: Google Mail Servers Enable Backscatter Spam 344 comments
Mike Morris writes "Google email servers are responsible for a large volume of backscatter spam. No recipient validation is being performed for the domains googlegroups.com and blogger.com — possibly for other Google domains as well, but these two have been confirmed. (You can test this by sending an email to a bogus address in either of the domains; you'll quickly get a Google-generated bounce message.) Consequently spammers are able to launch dictionary attacks against these domains using forged envelope sender addresses. The owners of these forged addresses are then inundated with the bounce messages generated by the Google mail servers. The proper behavior would be for the mail servers to reject email traffic to non-existent users during the initial SMTP transaction. Attempts at contacting them via abuse@google.com and postmaster@google.com have gone unanswered for quite some time. Only automated responses are received which say Google isn't doing anything wrong."
Submission: 100 email bouncebacks - welcome to backscattering by Anonymous Coward
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
A trickle?! (Score:4, Insightful)
Re:A trickle?! (Score:4, Informative)
Parent
Re: (Score:3, Interesting)
I could make it sound worse than it is, by making this fictional friend your significant other, and creating some kind of facetious situation in which your relationship will end if you don't respond to said message... but you get the ide
Re: (Score:3, Informative)
Re: (Score:3, Interesting)
I use Sneakemail free forwarding to sign up for automated things, so that I can revoke them if the spam gets too obnoxious. I have approximately 250 different Sneakemail addresses out there.
I have never had a spam problem with my Gmail account. When I do get spam, I know where it's coming from - and I deactivate that address and vow never to use that service again. I see Sneakemail as u
Re:A trickle?! (Score:5, Insightful)
During that time I only got one false positive, but that was a really poorly formatted message, and they weren't even replying from the same adress I specifically asked the reply from.
However, I got no false negatives in English, and it took about a week of "Report Spam" to get them up to speed on some new Hungarian torrent tracker spam. Now they're marked spam too.
All in all, Google's spam filter rocks.
Parent
Re:A trickle?! (Score:5, Insightful)
The best thing honestly would be for these servers to just clean their act up and handle things properly. Mail rejects should be done before the connection between the two servers closes. It should always be up to the SENDING mail server to generate a bounce rather than the receiving.
The odds of that happening are pretty slim though. There is a "bounce killer" feature in the new version of amavisd-new that I'm looking at that might work well. Apparently (I haven't installed the new version yet) it will store the message ID's of your outgoing messages and if a bounce comes back with an invalid message ID it deletes it.
Parent
Re:A trickle?! (Score:4, Insightful)
This guy know what he is talking about.
If everyone was publishing SPF-records and enforcing them, the problem would go away. The real problem is that most mailadministrators doesnt have a clue.
Parent
Re:A trickle?! (Score:4, Interesting)
Parent
same wine, old bottle (Score:5, Informative)
https://tech.slashdot.org/article.pl?sid=08/04/08/2258246 [slashdot.org]
I had a bunch of these back then, now they are happening again. Here is some information about the subject.
http://spamlinks.net/prevent-secure-backscatter.htm [spamlinks.net]
You should only get NDRs from your own ISP, as I undestand it. The other mail admins are being fooled by your spoofed return address, and should know better.
Re:same wine, old bottle (Score:5, Funny)
Parent
Where's the news? (Score:5, Informative)
Re: (Score:3, Interesting)
I now have four filter mechanisms at work:
1) All my contacts get a unique email address. Something along the lines of your-name@my-server.com
2) Spamassasin on the server.
3) Thunderbird's standard junk mail filter on the client.
4) Whitelist addresses of known contacts to my "whitelist" folder.
I see maybe 10-20 spam messages a day in my inbo
Please Try Again Spammer Dickwads (Score:5, Interesting)
Nope, I'm not getting anything - procmail [procmail.org] on my honeytrap spam email account sees it and stops it with a few simple filters
So please try harder, spammers, or go and get extensions to your obviously miniscule penises so you no longer need to take you inadequacies out on the rest of the world.
Extension? (Score:5, Funny)
I think one of their products can help them with that.
Parent
Re:Please Try Again Spammer Dickwads (Score:4, Insightful)
Parent
Easy filtering solution (Score:5, Interesting)
There's an easy way to filter out backscatter while preserving bounce messages that you care about (ie. ones about email that you actually sent):
1. Add your own custom header to all your outgoing emails. Doesn't matter what it is, but it should be unique, eg. 'X-Really-From-Richard-Jones: xsomesecretx'
2. MTAs include the original headers in bounce messages, so discard bounce messages which don't contain your custom header.
You can even be smart and sign the header based on the content of the email using a private key, which would make it unforgeable, but at the moment you don't need to do that.
Rich.
Re: (Score:3)
It may be slightly redundant though, all those emails bounced back at me are ones that are obviously spam - otherwise the recipient's spam filter wouldn't be bouncing them to me, and so you'd expect my spam filters to detect and delete them without any intervention on my part.
Re:Easy filtering solution (Score:5, Informative)
Parent
Re:Easy filtering solution (Score:5, Informative)
Alter the setting
mail.identity.default.headers
to include the string header1
note header1 is just a label
then add a new string called
mail.identity.id1.header.header1
Set the value of that to your X-line
From now on all mail sent from Identity 1 will have that header on it.
To create a filter based on that. Obtain an email with that header. Find a clickable link in the header and right click and select create filter from message.
At first from the drop down box you can't select that X-line so you need to go to the bottom and click customise. You can put that header in there. Now you can create a filter from it.
Parent
Re:Easy filtering solution (Score:5, Informative)
Get your free personal certificate and if 2 people have certificates, e-mail gets encrypted between you! There are a number of providers that give them.
Parent
Re: (Score:3, Informative)
Re: (Score:3, Informative)
Re: (Score:3, Informative)
Unless you like playing around with your user's machines a lot, you should better implement that at the MTA level and configure your mail server(s) so that they include the header.
Sure ...
Or you could just use SPF, which basically does the same thing, only more elegantly.
SPF doesn't do the same thing at all. It relies on the receiver MTA to do something about the non-matching SPF records, which evidently many don't (or at least, I've got proper SPF records, but still get huge amounts of backscatt
Why is this only getting noticed now? (Score:5, Informative)
I can remember years back when some spammer decided to use my domain name in their spam run. Hundreds of bounced emails every day and I cursed everyone of the dumb mail servers that mailed them; complete with original html email, images and any other crappy attachment. ("Hundreds" may be small potatoes these days, but they were a big deal at the time.) Just the very idea that spammers would supply a genuine reply address seemed so incredibly stupid, yet there they were; dozens of carefully worded variants of the same "naughty spammer, don't email me" reply. I could just see some smug sysadmin configuring their system with this badly thought-out garbage, thinking "ha! that'll show them!"
None of my mail servers since then have ever bounced spam or mis-addressed emails.
Re: (Score:3, Informative)
so as long as your MTA is not allowing emails to arrive to nonexistant users
I wholeheartedly agree, but SPF won't even allow it to get this far. Why should clueless admins expect me to pick up their slack?
Re: (Score:3, Informative)
"legitimate?" (Score:5, Informative)
Anybody who says that 'legitimate' mailservers are sending backscatter instead of 5xx-ing the message in transit is wrong. Mailservers which send backscatter are NOT legitimate, EOL.
- A pissed off mail admin.
Re: (Score:3, Informative)
I wonder if backscatter has been used as a threat for extortion sometimes. A few years back, I was seeing spammers E-mail people who owned domains threat
Re:"legitimate?" (Score:4, Informative)
The 5xx range of status codes exists for this (and other) reasons, there's no reason NOT to use them (by performing content verification inline and either 2xx-ing or 5xx-ing the message between "." and "QUIT".)
Parent
SPF + !SRS! (Score:4, Interesting)
It seems like the solution to "backscatter" has been around for quite a few years (SRS [openspf.org]). I'm surprised how few of the commercially available anti-spam solutions use or interpret it.
At my company, we just looked at Barracuda (PoS), Pineapp, St. Bernards ePrism, MX Force, Postini, and some other things. None of them understand SRS and only a few of the tech contacts had even heard of it. Sad Sad. But they all seem to have hand-rolled "backscatter" protection that partially works.
It seems like everyone has an SPF record these days. But it feels like relatively few actually check them and almost nobody goes the full distance and uses SRS.
Re:SPF + !SRS! (Score:4, Insightful)
Here's the solution to backscatter:
Parent
Postfix has a solution to this (Score:4, Informative)
The trick is to use the "header_checks" and "body_checks" to look for signs of the email having being sent out from your email server in the first place.
I've been getting "backscatter" for years... (Score:4, Insightful)
Then again, I have never regarded email as a reliable method of communication. Everything truly important goes with a read receipt request and if I don't receive one then I phone or send snail mail. I continue to be amazed by the number of screwups I continue to hear about where someone says "I never got [such and such] email."
Re: (Score:3, Interesting)
Then again, I have never regarded email as a reliable method of communication. Everything truly important goes with a read receipt request and if I don't receive one then I phone or send snail mail. I continue to be amazed by the number of screwups I continue to hear about where someone says "I never got [such and such] email."
As an admin, let me assure you that no (competent) email administrator has email randomly disappearing into the Magical Land of the Email Fairies.
I have had more people than I care to remember come to me complaining that "X says they sent me an email and I never received it, can you look into it?". Every single time I have been able to tell them exactly what happened. 8 times out of 10 the email's sat in their Inbox and they just have such a cluttered inbox that they can never find anything. (The other
Re:I've been getting "backscatter" for years... (Score:4, Insightful)
I personally am one of those who would like to see a new email protocol built from scratch with the spam problem as foremost consideration in the design process. I have a dislike for anything in IT that only "works most of the time", and that's where email has been for quite a while now.
My 2 cents. Another 2 cents that is.
Parent
Re:I've been getting "backscatter" for years... (Score:4, Interesting)
Parent
Not "legitimate" mailservers (Score:3, Insightful)
Any MTA I get backscatter from goes right into my local incompetent.dnsbl zone.
Why do people send spam to me? (seriously) (Score:3, Insightful)
There are 7633 messages in my gmail spam folder. Now let's suppose I'm new to the internet, and I read spam message #1. Do I want Viagra? No thanks. Message #2, still don't want Viagra. #3 no thanks, I'm fine.
Well, I didn't buy that stuff the first 7633 times you asked me THIS MONTH, but maybe if you ask me REALLY nicely with a few misspellings just once more, then I'll cave into my male inadequacies and buy prescription medicine from a sketchy online source.
Now I'm going to pretend I'm a spammer. I want lots of money. What benefit is there to me to send a single address more than say... 5 messages? (not per month. EVER) If it didn't make it through the filters the first time, it won't the 800th time, and the more messages I send, the more likely my recipients will learn to evade them. More importantly, a jaded audience won't be receptive to buy.
I can imagine that the newer scams could be useful. Like the ones pretending to be your bank. I've only received a few of those, and it took some thinking to realize that the facts didn't add up. But the normal viagra spam should only be useful in the very limited cases where a brand new user (8 years old?) who hasn't been exposed to it ever before reads one of the first messages and decided that it's a worthwhile endeavour.
My hypothesis are:
1) Spam is not used in the effort of making money, but as a way of crippling the internet for sport.
OR
2) The majority of spam is sent by poor, hungry and stupid script kiddies who are as of now still poor, hungry and stupid.
Re:Why do people send spam to me? (seriously) (Score:4, Informative)
Parent
Re:De-standardize, and make it worthwhile. (Score:5, Interesting)
Parent
Re:De-standardize, and make it worthwhile. (Score:5, Insightful)
Helluvua lot of mail servers out there not configured "properly." I can't block some mail even from "legitimate" mail servers because they are not configured well enough some of my spam rules don't pick them up, so how would a "list" fix that?
As it is, the lists from the anti spam houses work very little. There are so many zombie mail servers out there, I guess, no one can really effectively police these things except through spam filters. And Google are the only folks who can afford a full time staff writing spam filter rules.
Any more properly used to mean not an open relay; now it can can mean not in the same network segment that does have spamming email servers. Lists just add to the insanity and often punish legitimate mail servers.
Parent
Re:De-standardize, and make it worthwhile. (Score:4, Funny)
Think Machiavelli.
Parent
Re:De-standardize, and make it worthwhile. (Score:5, Interesting)
One of the main reasons forums don't get hit by spammers is because the admin staff knows what they're doing. They lock down threads, respond quickly, and keep the software up to date. Temporary bans, and permanent bans... You also need a working e-mail address in order to register, which blocks an awful lot of spam. Finally, there's over 150 domains on the banlist for my forums... some of the most popularly used (by spammers) freebie e-mail accounts, like mail.ru.
Oh... and it helps to have a robots.txt file. Mine looks like this:
The forums are served up from a subdomain... the actual site shows up in search engines, but having the separate domain with robots.txt helps keep the forums off the search engines. If they don't know you're there, then they can't spam you.
Parent
Re:De-standardize, and make it worthwhile. (Score:4, Interesting)
Parent
Re:De-standardize, and make it worthwhile. (Score:5, Interesting)
1. No servers flooding the net with messages.
2. Easily identifiable spam sources, making bot-nets less useful.
3. Reduced bandwidth as the system replaces the old one.
4. Allow email clients and webmail services to be configured retrieve every message for the few numb nuts that don't/won't get it.
5. Profit (via reduced long term cost).
Just spitballing...
Parent
Re:De-standardize, and make it worthwhile. (Score:4, Interesting)
1. Only works for obvious spam. For non-obvious spam it means the user has to download it - which notifies the spammer of a known-good address. That means more spam. (Right now images do this, but images can be disabled while preserving the text.)
2. They'll just advertise in the subject line. Perhaps easier to filter, but seems like a losing battle to me.
3. How do you authenticate?
4. Allows people to associate an email address with an IP even if that IP/address never sends them email.
5. Completely fails to account for offline/IMAP use.
Some of this can be mitigated by having the receiving server fetch the mail when the client requests it, but that adds more problems.
1. I'm pretty much whitelisting by hand now, If I don't know you, I don't care what you put in the subject line, your stuff is gone.
2. Set a size limit on all the headers, no hex or encoding, plain text and straight IP addresses for the server holding the mail.
3. Their server sends me a key to pick up the message (a header I forgot), if a server sees the same key a thousand times in a minute or two... hmmmm...
4. Works both ways: Gmail Warning, The message you are about to retrieve is located on a server KNOWN to send spam... Continue?
5. If your offline you are pretty much working with the mail you already downloaded, right?
I'm not saying I have a perfect answer, but there are plenty of people that can figure it out, just like other ideas have been brought to fruition on the web, by cooperation of parties that have a mutual interest... and on this topic, it a BIG group and they have the brain power and bucks to make it work without rattling to many cages.
The point is to reverse it so that the abusers are left holding the bag, botted machines are quickly identified (and hopefully cleaned), and the free ride stops with the death of standard SMTP servers.
All I can offer is my idea of a starting point...
Parent
well if your feeling like having fun.. (Score:4, Interesting)
wait for infinite loop to finish..
repeat as needed.
Storm
Parent
Re: (Score:3, Insightful)
"Anyone who sends spam is a terrorist!"
Add random bogus reason, like "spam finances terrorism" and tag a "think of the children" on at the end.
Sooner or later, someone in power is bound to fall for it.
Re: (Score:3, Interesting)
Sure, I once got angry at people who sent me spam and bounced it back to the sender with a nastygram. But that was 1995. There wasn't SPF, and there weren't content filters. And most installations were open relays on Sendmail. Administering e-mail was simply giving someone a home directory and pine.
Nowadays, the e-mail administrators are the biggest enablers. If they just checked SPF records and stopped automated bounces after a content filter determines it's spam.... It's also up to the