DOS Attack Via US Postal Service 332
Phronesis writes "Bruce Schneier reports in Crypto-Gram about the slashdot-inspired Post-office DOS attack on SPAM-king Alan Ralsky. More interesting, Schneier writes, is a recent paper on Defending against an internet-based attack on the physical world, which generalizes this attack and discusses how it could be automated and how one might defend against it (you can't stop it, but you could make it harder to effect). From the abstract of the article: 'The attack is, to some degree,
a consequence of the availability of private information on the Web, and the increase in the amount of personal information that users must reveal to obtain Web services.'"
Hardly DOS is it (Score:4, Insightful)
Also this seems a little extreme 'The attack is, to some degree, a consequence of the availability of private information on the Web, and the increase in the amount of personal information that users must reveal to obtain Web services.'
Considering the webservices the article is talking about is requesting a catalog
Lack of authentication (Score:5, Insightful)
There is absolutely no way for a person to prevent against this right now.
The analog solution from the electronic world would be for the publishers send them an confirmation letter or something asking whether they really subscribed.
Re:Hardly DOS is it (Score:5, Insightful)
this works for normal spam as well... (Score:5, Insightful)
yesterday as i went through *35* pieces of junk mail from 3 days i was wondering if the USPS had an opt out from certain mailers form? i doubt it because spam is how they make most of their money.
any input here?
Re:Hardly DOS is it (Score:5, Insightful)
DOS we're familiar with = so many requests for connection that real (legitimate) requests are very slow to get through, if at all.
mailDOS = so many catalogs that finding your real mail (if there is any) is an incredible waste of time, and some pieces (packets?) may be lost (dropped) in the confusion.
If this isn't the best translation of electronic DOS to physical DOS I don't know what is.
Re:death and taxes (Score:3, Insightful)
So mail spamming is bad now? (Score:5, Insightful)
Spammers have feelings! (Score:5, Insightful)
Ralsky got what he deserved, and hopefully moving 'on the quiet', if he did move, cost him alot of money. I read this article earlier today (didnt think of submitting it myself) and it made alot of sense. It IS all too easy to get yourself on these lists and your life is made difficult getting off them (digging about for phone numbers listed in a 500 page catalogue's small print...) - if you were subscribed to even 100 of these you would have a mammoth task to get rid of them all.
This style of DoS harms more than the target (Score:5, Insightful)
In the case of signing up a spammer or other unscrupulous individiual to catalogs and other physical mail, the companies that are sending these items are directly bearing the cost of your DoS. Sure, Sears can probably afford to send out one more letter, but catalogs are more expensive to print and mail. All these companies are getting screwed out of real money, not some potentially (and oft inflated) accounting of how much time/cost an ISP has for DoS countermeasures.
Sure, I think it's great to spam the spammers, but in doing so you harm legitimate companies more than in the Internet world.
Post office "DOS" Attack is gonna backfire (Score:5, Insightful)
Catalogs and Magazine subscriptions ship at cheaper rates. The rural carriers that deliver mail to people's homes aren't set up to carry mass amounts of this type of mail to people; economically, the post office is set up to run with a balance of junk and first class mail on any given route.
Overload this with a hugh amount of bulk-rate junk mail, and you're putting a burden on the capacity of the carrier routes, which in turn will force the Postal Service to modify fees and/or service.
I would be highly suprised if they pass this charge on to the business customers that generate the bulk mail; this would meet with too much resistance and put pressure on the business relationship. Instead, I wager we'll see the fees passed along to first class, consumer mail either through an increase in postage fees and/or fees for home delivery of mail.
In short - The Postal Service is not the Internet. It is one orginization that can and will respond to this type of abuse, and the end result will be less service / increased cost.
This is a serious issue (Score:5, Insightful)
Sure, the Ralsky attack is funny and ironic and all, but imagine if it happened to you. This wouldn't be a pizza delivery or Playgirl subscription every now and then, we're talking *pounds* of mail every day from many, many sources (God! your mailman would *hate* you). Easy to initiate, not easy to trace and really hard to stop.
Also, you can't write filters to automatically route or categorize snail mail. You have to go through it all to find the non-spam. If this kind of attack catches on, watch out.
I'm interested, is there anyone out there that works for the Postal Service? How can victims deal with this sort of thing?
Re:Post office "DOS" Attack is gonna backfire (Score:5, Insightful)
J.
Re:This is a serious issue (Score:3, Insightful)
I doubt I would incur the amount of motivated anger for a group of people to spend this much time doing it. I piss a lot of people off. I get people that sign me up for shit all the time. All email though, because it's hard to actually get my real address off the net without spending a few bucks.
People get pissed when you spam them, and then you get a mob, and mobs do great things to bad people (sometimes.) It's not as if Mr. Ralsky is a decent person, he is getting what he deserves. Karma does work, it's just man-made.
It's Not Ironic... (Score:5, Insightful)
"...and the punishment of vice, often in an especially appropriate or ironic manner. "
So you see, this is poetic justice, not irony. That said, I'm not mad about this happening to him, is anyone else?
Re:Hardly DOS is it (Score:2, Insightful)
Huh? (Score:3, Insightful)
Re:I say start a 2nd wave... (Score:2, Insightful)
Because fraud is fun? Or you just want to cause trouble for innocent business owners.
Re:Politics that hard way (Score:4, Insightful)
Meanwhile in the back rooms buying and selling of politicians goes on the old-fashioned way -- face to face.
Maybe somebody would realize that it is serious... (Score:3, Insightful)
At least the catalogs he's getting have a real return address. I hate spam with fake sender, and I hope someone will soon enforce that domain.com must come from a domain.com mail server (or through one with authentication) and start the snowball running. If you can't send through the domain.com mail server, why should anyone believe you have the right to send mail for user@domain.com? The default "trust anyone" is one of the big signs e-mail was designed for "serious" use by "serious" people before the general public started using and abusing it.
Kjella
no, it is not (Score:4, Insightful)
Well, if you piss off people, they may try to get back at you. The Ralsky attack is the result of Ralsky pissing off a lot of people an each person engaging in a small and individually harmless act. In comparison to the kind of disputes among neighbors and individuals that often occur in the real world, that seems both harmless and unprosecutable. Welcome to the real world.
If you piss off a lot of people for justifiable reasons (e.g., you are the author of Satanic Verses), then some concerned government may try to help you out. Otherwise, the solution is simple: don't piss off too many people.
Re:Lack of authentication (Score:5, Insightful)
However, the recipient doesn't have to pay for any of it. It's a nuisance, but nothing like paying for bandwidth consumed by a DoS.
"The analog solution from the electronic world would be for the publishers send them an confirmation letter or something asking whether they really subscribed."
It's cheaper for them to just send out the magazine in that month's shipment. Sending out "Are you really sure?" postcards would require a different class of mail ("standard" as opposed to "periodicals") sent in a separate mailing (two smaller pre-sort batches instead of one big one). And that doesn't include the cost of a Business Reply Mail account.
Re:death and taxes (Score:5, Insightful)
Rule #2: Never forget rule number 1.
Remember that the IRS is in the same department as ATF and the Secret Service.
Re:I say start a 2nd wave... (Score:1, Insightful)
Re:Post office "DOS" Attack is gonna backfire (Score:3, Insightful)
At any rate, the cost of delivering the mail is paid for by the postage (imagine that!). Even if you pre-sort the mail as finely as you can (in the order the delivery person drives past the addresses, no less) and bring it to the destination post office yourself (or through a third party), you still have to pay postage for the simple act of delivering the articles.
Please don't do that... (Score:5, Insightful)
Despite the spammers, there are a lot of legitimate businesses and non-profit organisations out there that are trying to get people to sign up so they don't waste their time and money mailing people who have no interest in what they have to send.
Just because a business or organisation asks people for contact details to send mailouts doesn't mean that they're doing it maliciously. What you'll accomplish by scripting this is to give headaches to the people doing it correctly by polluting their mailing lists with people who don't want their mail. If anything, it'll have a negative effect on their customers or members who actually want to hear from them in the process, and it'll waste the resources of an organisation that often won't have a lot to waste.
The only one who hates us more than Ralsky (Score:3, Insightful)
Is his postman. Can you imagine all the huge stacks of spam he has to haul up to the mailbox? Geeze, I bet by now he almost has a seperate bag...
At least sign the guy up to Playboy so that the postman has something interesting to "obtain" from the sack 'o' mail he must have to deliver on a regular basis.
Re:From The Spamhaus Project (Score:2, Insightful)
Alan Murray Ralsky
6747 Minnow Pond Dr
West Bloomfield, MI 48322-2663
That's on carrier route C 061, delivery point 47 in Oakland County.
Some history,,,, (Score:3, Insightful)
And a previous story [slashdot.org] on slashdot.