Paul Graham: Filters that Fight Back 328
Mortimer.CA writes "Paul Graham is back with another article about combating spam. It's entitled Filters that Fight Back: 'One intriguing idea is to literally fight back: to make filters disable spammers' servers by automatically following all the links in each incoming email. We may be driven to this in order to achieve accurate filtering anyway. Why wait?' One danger is someone doing a DDoS by sending fake spam."
And now (Score:3, Funny)
Re:And now (Score:3, Insightful)
traceroute to paulgraham.com (216.136.224.156), 30 hops max, 40 byte packets
14 vl48.bas2-m.sc5.yahoo.com (66.163.160.214) 99.528 ms 98.349 ms 99.528 ms
15 alteon4.128.sc5.yahoo.com (216.136.128.6) 98.575 ms 98.687 ms 98.377 ms
Re:And now (Score:5, Insightful)
Which illustrates the problems that you get when people who have little or no security experience try to do security.
The problem with hackback schemes of all types is that they always end up having unexpected effects. The basic problem is that when people design a hackback scheme they never consider what happens when someone sets out to abuse it. They assume that the only change to the environment is their hackback scheme.
A few months ago Paul though Bayesean filtering was the one true solution. The only problem was that people who have spent years working on the techniques he described never achieved results anywhere close to the ones he claims.
Paul Graham's scheme is not as damaging as some others because the amplifier effect is limited. The message sender only gets five or ten messages created for each spam sent. But even that could make a profitable scheme for someone trying to get their site promoted in a 'most visited list'. If they have pay per view adverts they can rake in quite a few bucks - as much as a cent for every spam sent. Far from discouraging spam this scheme would create a new incentive.
BTW the guy who said 'there is no fake spam' is right depending on the definition you use. If you use the definition 'unwanted email sent indiscriminately' then he is pretty much right. If on the other hand you define spam as 'that which our filters decide is spam'... (I kid you not, folk do try to get that type of definition accepted). The exception would be satires like 'make penis fast'.
There are similar problems with the folks running blacklists, they think that they understand everything there is about spam but don't realize that the systems they set up can be and will be gamed. Every partisan political mailing list of every stripe that has a significant number of readers gets blacklisted from time to time as people sign up for the list in order to be able to report it as spamming.
Try to explain to either group that there is a problem and they get majorly defensive. You get accused of wanting to help the spammers, etc. etc. When people start getting defensive like that in response to fair questions you are in big trouble.
The way to deal with spam is to treat it as a security problem. We deal with security problems using access control - authentication and authorization. We need to start with robust authentication mechanisms that hold ISPs responsible for the messages sent from their domain. These need to be accompanied by robust authorization mechanisms that allow recipients to judge whether the sender is honest.
Re:And now (Score:3, Insightful)
Your mileage may vary. Mine is excellent, for example. I've been using a Naive Bayesian filter, POPFile [sourceforge.net], for a while now, and I'm at 99.74 accuracy with 11564 classified messages and 29 errors. (For the record, 15 spams filtered thru and a few friends jokes, honestly looking a bit
Re:And now (Score:3, Insightful)
We would have to strip out any identifying code in the urls to prevent added spam from email validation
Re:And now (Score:5, Insightful)
Go back and read the article. It's about http requests, not sending mail.
Oh, I totally get the fact you are sending out http requests. The fact the message is HTTP rather than SMTP is not relevant as far as I am concerned. The original HTTP spec used the term messages for requests and responses. I really can't remember what we did in the RFC.
The amplifier effect is just the same, for each message in there could be five messages out. The main advantage to the spammer though is laundering the IP address so that their web site hits appear to come from 10,000 distinct views rather than the same view.
I don't know where you get this idea. I know plenty of filter hackers who get results so much better than me that I'm kind of embarrassed.
Getting that sort of result on their own mail is one thing, getting that result on a representative corpus of user emails is a very different matter.
Geek mail is much easier to spam filter than naive user's mail. They tend to be far more aggressive in the features they use. They are also the targets of the spammers, geeks being a minority. So the vocabulary chosen by spammers tends to be much closer.
My real concern is not whether a filter is 99.8 or 95% efficient at detecting spam, its the false positive rate that is the problem. 1% false positives is a big problem, even 0.5% is a serious problem. The other big problem is the sheer cost of CPU cycles. Imagine a room the size of a football field filled with 100 equipment racks. Processing the legitimate mail only requires one of those racks, the rest are for dealling with spam. Each processing step adds cost. Bayesian filtering is only one part of the solution.
I agree about going after the spammers, but litigation and law enforcement are far more likely to be effective than hackback.
What we need to do in addition is to change the mail protocols so that we can know that a message that purports to come from a particular source is authentic. At least 50% of the spam sent claims a false sender address. The tricks that spam senders use to hide from litigation are a very robust spamdicator that almost never gives a false positive.
response to the lister's comment (Score:5, Informative)
From the article notes: "[5] The best way to protect against abuse might be to have the central authority whitelist every site by default, and then, by whatever protocol, take certain sites off. Because you can look at the sites before taking them off the whitelist, there is little danger of people abusing this system to attack an innocent site."
Problems with whitelisting and strikeback (Score:2)
We've already seen viruses doing the rounds which act as open proxies for spammers and/or reverse proxies to hide the spammer's real websites. If these intermediate reverse proxies act as caching proxies, then the spammer is insulated from bandwidth costs by offloading them onto unwitting third parties. Steal enoug
SETI@HOME ? (Score:5, Interesting)
- your filter recognizes the spam and gets URLs from it;
- all such URLs are gathered in the central authority and statistically verified (how many filters have claimed the same site);
- only the most often claimed sites are left in the list, while more rarely claimed sites are considered as claimed by mistake or by the anti-filter attack;
- people willing to help to fight spam download the screensaver aka SETI@HOME, working at your CPU and net idle time;
- the screensaver downloads the fresh list of sites to be fought back along with a centrally generated schedule;
- the filter actually attacks back at the scheduled time points (if it's still the idlle time for client PC), not massively from the individual PC (so it doesn't look suspicious for the individual client *AND* it doesn't create any peak bandwidth problem for the attacker);
- the spammer's web site is
/.ed;
All problems I see resolvable:The main idea of the spam is to send email massively on a very low cost. So if the attack will be also very massive, it will increase their cost of operation and at least some of them will go out of business.
Any attmpts of spammers to go through filters will not work, as you can manually submit the spam claim to (what is its name? NOSPAM@HOME?) the central authority. If the amount of such claims will be big enough, then the claimed sites will be included.
Re:SETI@HOME ? (Score:3, Insightful)
1. There is a small company that I dislike. What prevents me from hacking their ip address and send shitload of spam in their name?
2. automatic or manual retaliation comes back to making justice yourself which is inherently illegal (at least in the us).
NOSPAM@HOME ! (Score:3, Insightful)
There is a small company that I dislike. What prevents me from hacking their ip address and send shitload of spam in their name?
In my opinion it is posible to have a statistical analasys that would be capable to distinguish it unless you organize a really big attacke. On the other hand, a central (even if it's distributed) autority may help to gather a witness evidence against your unfair anti-competitive practice, which would be rather difficult if such NOSPAM@HOME project would not exist.
Re:response to the lister's comment (Score:2)
If they send the mail, you can certainly follow each link once.
Umm, the problem is if someone else sent the mail.
Following links validates your address (Score:5, Interesting)
Re:Following links validates your address (Score:5, Interesting)
Every load of Slashdot would hit spammers' servers.
Re:Hear! hear! (Score:3, Interesting)
Re:Following links validates your address (Score:4, Interesting)
Spammers would need another mechanism to attempt to authenticate who reads their messages. I like it.
What do you think about downloading IMG tags? It would hurt the server's bandwidth, but it would hurt my mail server's bandwidth, too. Maybe use one of the many open proxies out there instead, kill their bandwidth, maybe close the open proxy... ooh, that's evil! I really like it!
If there were a sig here, would you read it?
Re:Following links validates your address (Score:3, Insightful)
I don't think so. All links in all spams wouldn't get hit.
And there are many reasons not to punish. I would, but I've got
Re:Following links validates your address (Score:5, Insightful)
Also, consider that spammers could move the identifier to the other end of the url. Just have *.spammer.com or www.*.spammer.com resolve to the same site, and start putting the identifiers in the domain. They could even use random dictionary words as the identifiers to make it more difficult to pick out. The only way to combat that would be to have a system that compares the URLs from several spams and figures out which parts of the URLs changed per user.
Re:Following links validates your address (Score:2, Insightful)
But it's not there to authenticate a user; it's just there to authenticate that the email address is actually live rather than a bogus one like nobody@example.invalid. Spammers already use this trick, including uniquely coded urls into each email to track which users actually open the mail, and autoresponding is a possible problem.
Do they really care? (Score:3, Informative)
My hotmail account gets relentlessly spammed even though I _never_ follow any links from spam or let it load any images. Even before Hotmail introduced the "don't load inline images" feature I always disabled javascript + images before opening any suspected spam.
Basically, can it get worse? They never seem to remove inactive accounts anyway.
I have a domain registered which I've owned for three years, and it's still getting spam for accounts related to the previous owner of said domain. My mailer says "n
Re:Do they really care? (Score:5, Informative)
Last month I put a real MX record in there and pointed it at box that's running a mail server. Sure enough, the spam flows continuously. It's not just the "make up random shit and put @aol.com" idiots either - the big outfits with permanent networks and domains are mailing it too.
I've taught my mail server to quarantine any host that attempts to mail my long-dead domain, so having it go to a routable address is actually useful again. Every attempt they make ruins another open proxy or relay for every other spammer that may find it later.
You might consider using those "never valid/previous owner" accounts as spam traps. Anything coming to them now is obviously worthless, so why not make them suffer for trying?
Re:Following links validates your address (Score:2, Insightful)
Wont means you're disposed, or likely, to do something. If I read your (insightful) post correctly, I take it you're hesitant to do so.
Some spammers would love this. (Score:3, Insightful)
Re:Some spammers would love this. (Score:2, Insightful)
Re:Some spammers would love this. (Score:2)
The people who PAY spammers would not (Score:5, Interesting)
Looking for a downside to this plan . . . still looking . . . Nope. I can't see one.
Re:The people who PAY spammers would not (Score:2)
Uhh, WHAT?
The spammers business model is "use email to steal as much money from everyone as possible." It has no "long term".
Spammers don't care about keeping their customers happy, so attempting to use this to destroy their business by making their customers unhappy is doomed to failure.
Looking for a downside to this plan . . . still looking . . . Nope. I can't see one.
Then you're not looking hard enough.. this will encourage sp
Re:The people who PAY spammers would not (Score:2, Insightful)
I think the post you replied to, as well as its parent, were speaking of pay-per-click schemes. The original parent meant "customer" as in the person who hires the spammer, not the person who buys the products.
A fair portion of the spam I get seems to promote pay-per-click programs, especially the porn spam. Spammer signs up as an "affiliate" of
Dangerous from a legal perspective (Score:5, Insightful)
The interesting thing is how the courts would end up viewing auto-clicks vs manual clicks. I'd bet that if a user set up a filter then it would be effectively view as the user doing the clicking...
Re:Dangerous from a legal perspective (Score:3, Insightful)
So it would be necessary to make changes in the law to forbid `auto-agreeing' techniques. And we will have one less problem.
Re:Dangerous from a legal perspective (Score:3, Interesting)
Plus you know the law would be written like "A computer user must manually actively active a link for a legal binding to have an effect; All computers must enforce digital rights management"
which not only allows for click-through-licensing but ties on a second hidden agenda (pick your topic). Everyone will think the first sentence would do what they wanted and not care about the rest. Hmm... sounds like I'm kind of bitter about the current
Re:Dangerous from a legal perspective (Score:3, Insightful)
This was anticipated in the Web Specs which since 1992 have clearly said that clicking on a GET link creates no form of binding contract.
In any case any contract formed in that manner would be a contract of adhesion and invalid.
If it were otherwise Google would be entering into all sorts of con
Re:Dangerous from a legal perspective (Score:3, Insightful)
By reading this message you agree to give me $50.
We're going mobile! (Score:5, Funny)
Note to self: Move web site off of modded GameBoy running apache.
horrid legal thought (Score:4, Interesting)
If a spammed website is brought down by a method such as this, it wouldn't altogether surprise me if they sued the maker of the software responsible. Matters would be complicated if, as they might, they deny responsibility for the original spam e-mail.
(This is the case in the UK, I'd guess the position will be similar in the US but IANAAL (I Am Not An American Lawyer))
On the other hand, the "scan the spamvertised website for its content" sounds a great technical approach.
Re:horrid legal thought (Score:5, Insightful)
Why would it be illegal? The spammer put the links in the e-mail, obviously intending people to follow them (especially if they make reference to something being available at the linked site in the rest of the text). If far too many people follow the links and the site is brought down, how is that any more unlawful than Slashdot linking to a site in a story and the sudden burst of traffic bringing that site down?
I think the idea's dangerous for another reason, though. As noted, a spammer could easily include links to sites he doesn't like and let the traffic spike take them down.
Re:horrid legal thought (Score:2)
The difference with the
Re:horrid legal thought (Score:2)
Right, except for one thing. If a couple hundred people each dial that 800 number 100,000 times each, the courts would probably find that illegal. But, if each of the 100,000,000 recipients of an advertisement called that 800 number once, you'd get the same result but the courts would almost certainly rule that there was nothing illegal going on. Whether the people were interested in buying anything or not, no one of them did anything even unreasonable. Even if they simply want to complain about the adverti
Re:horrid legal thought (Score:2)
Wrong! (Score:2, Insightful)
But you've got to watch out for unique tracking images so as not to validate your email address.
Re:horrid legal thought (Score:2)
Re:horrid legal thought (Score:2)
If somebody sends me a piece of mail, and my secretary sees something which may be of interest, she may call the sender to determine whether the piece of mail is truly of interest or not.
Whether she determines that the mail is of interest to me or not, in sending the mail the advertiser invited me or an agent working on my behalf to investigate what they have to offer.
If the secretary, assistant, or sp
Re:horrid legal thought (Score:2)
Re:horrid legal thought (Score:2)
Yet *another* upside: make sure that the auto-linker uses IE!!!
This is stupid! (Score:4, Interesting)
Re:This is stupid! (Score:3, Insightful)
Are you kidding?? (Score:3, Funny)
The point is not the user's bandwidth, this is really a DDOS, but since the spammer's asked for it (literally, not just figuratively), it's OK.
Re:Are you kidding?? (Score:2)
Automated slashdotting of spammers (Score:2, Insightful)
Autowhitelists (Score:2)
Needs Critical Mass, but how do you tame it? (Score:3, Interesting)
I am not sure that is 100% possible. In light of that reality, this might just punish any server, not necessarily attached directly to the spammer. For example, if I wanted to shutdown a site, couldn't I spam a million inboxes with that site's address?
I could see this solution, when mismanaged, merely creating lots of extra, meaningless traffic as well.
I am all for doing something to inconvenience spam, but it seems that the most effective solutions always come at a direct cost to everyone. For example, I have read about adding a small CPU penalty calculation for every email sent. This new solution isnt quite as distributed - it adds traffic to networks and places loads on servers, but its still a penalty.
I guess the real challenge is finding a way to penalize the spammers and no one else. Good thoughts, and honestly if my client supported a "punish mode," I think I would be tempted to use it with the same careless sense I apply delete.
Re:Needs Critical Mass, but how do you tame it? (Score:2)
I could see this solution, when mismanaged, merely creating lots of extra, meaningless traffic as well.
Yes, it does offer another means of initiating a DDOS attack on somebody you don't like, but it's not as though there aren't enough of those avaialble al
Comparison of Bayesian spam filters (Score:5, Informative)
Re:Comparison of Bayesian spam filters (Score:5, Insightful)
Then again, he's probably still insanely rich from the ViaWeb (a.k.a Yahoo! Store) deal, and doesn't really have to care about lost business advantage much. Becoming a millionaire to be able to concentrate on hacking seems to be a good career plan :-)
Re:Comparison of Bayesian spam filters (Score:3, Interesting)
Filter web-pages through bayesian filterss (Score:5, Interesting)
Secondly, I don't call this any kind of DDoS, even though it might seem such to spammers (is slashdotting a DDoS?). If anyone sends me a mail with an url, chances are they _want_ me to check it out. If my system fetches the pages and stores them to a cache, I'm doing exactly what the sender wants. (Mailing lists may be a problem though.)
Thirdly, does it really hurt you to let spammers know that your address is valid? Chances are the address will receive spam nevertheless..
Re:Filter web-pages through bayesian filterss (Score:2)
You mean doing exactly what is described in the article?
Dammit, people. Sure, there are stupid people out there, and many of them post at times. But if you're going to moderate, PLEASE read the article yourself!
Here's to hoping M2 does its job i
another approach (Score:3, Interesting)
There are other fringe benefits...the overhead encrypting to a large number of keys would certainly slow a spammer's throughput down. Also, this would encourage the use of widespread secure email.
Re:another approach (Score:2)
Re:another approach (Score:2)
Go ahead and try to get the court to enforce a license agreement on a PGP key. If you can afford the legal fees, it'll just reestablish my faith in America as the land where even idiots can end up with more money than they know what to do with.
I'm 1337 (Score:5, Funny)
I'm sorry but spoof's dont usually work to well on me... I'm 2 1337 to be fooled.
Seriously though, if you just take a little more time to look into the header contents of that "penis enlargement" ad, you might find a pretty new IP addy to "play with" *cough* BO2K *cough* or atleast the real route that this spam took to get to you, just follow the yellow brick road back up to Mr. 12 extra inches and... well, you decide your own punishment for 'em
Besides, it's not like you need that ad... do you?
Fake Spam?? (Score:2, Funny)
Isn't fake Spam uh...Spam?
Isn't that like saying "I want you to separate the flammable material from the inflammable."
Thoughts on active countermeasures and relays... (Score:5, Insightful)
In other systems I am aware of in which active countermeasures may appear (such as firewalls, and tcpwrappers), the adversary can be established with reasonable certainty in most cases; however, because the From and Reply-To addresses can be (and often are) forged and most owners of relaying machines are unaware they are misconfigured, it seems doubtful countermeasures would work at that step. If one uses the URLs, as suggested in the article, it is not guaranteed that the "million" emails sent out will hit the next server along their path at a particular time, so it seems doubtful you can guarantee a massive traffic burst at once. Indeed, what may be seen instead is incremental bursts of traffic at the delivery retry intervals of various mailserver software.
Other questions also arise, such as: 1) how much additional load will a mailserver experience from hitting the links; 2) what additional security issues are introduced in doing so (what if, for instance, the code to do this results in a security vulnerability); 3) how can it be done in such a way that DDOS attacks against innocent victims can be avoided; and 4) how can you get enough people to both upgrade their systems and cooperate in a useful way to do this. Issues 1 and 2 are probably obvious questions to ask-issues 3 and 4, however, I believe suffer from the same weaknesses as some of the current BL schemes. Also, some localities have legal codes which prohibit the interruption of legitimate access to a system, and the server in this case definitely has a way to track back to you at that point, which potentially make participants vulnerable to legal or civil actions.
While I admire Mr. Graham and his efforts in the spam-wars, and find it an intriguing idea, I do not think this approach will truly be successful until changes are made to the underpinning email system that may reduce some of the issues mentioned, but hopefully will themselves make an impact on the issue without being too onerous to prevent wide-spread adoption.
Re:Thoughts on active countermeasures and relays.. (Score:3, Informative)
Graham did mention users with broadband connections, implying that this would be something that the client would pull down.
Interesting side-effect (Score:3, Interesting)
DDoS with IFRAMEs (Score:5, Informative)
Such an attack on Nutters.org forced me to stop doing my own hosting on a DSL line, since it got utterly swamped and cost way too much in bandwidth. Amusingly, it has forced me into using a much cheaper and higher bandwidth service -- one where such attacks are no longer my problem. The rules of the game have changed for me, though: I no longer consider it viable to host a website on a low-bandwidth leaf node like a single DSL, even where normal usage would make it seem acceptable, since it makes you a sitting duck for this kind of attack. I still can't imagine why anyone would want to target Nutters.org; being small and unworthy of attack doesn't seem to be a good defense anymore.
Bandwidth (Score:4, Insightful)
Re:Bandwidth (Score:2)
Paul's good at this stuff, but this is no good... (Score:5, Insightful)
- Multiplies bandwidth exponentially, automatically. Big corporations, especially, would be hacked off by this, and it has the added downside of slowing whole sections of the net (imagine what happens when a college dorm gets hit and 800 little bots go check out the site 57 times...).
- Accidental DDoS on good sites - yes, Victoria, spam can be spoofed VERY convincingly.
- Accidental DDoS on good sites (2) - if you've ever maintained a mailing list of more than 20 people, you know that, eventually, some idiot complains he/she got spammed, even if they double-opted in. I've been accused of spamming when I was quoted 2/3 of the way into someone else's (double opt-in) message! I know great sites that are blacklisted, out of human stupidity, alone.
- Accidental DDoS on good hosts - imagine the impact on any shared host, or even some virtual hosts, when one bad client mails 5 million spams - before they could react, they could be taken offline!
- Bad programmers (gasp!) - yes, those exist, and some of these filters could really go haywire and start thrashing all sorts of sites.
- Lawyers - IANAL, but I shudder to think what happens the first time Microsoft or Big Blue sues some programmer, because an abused copy of their software took them down for an hour! (What is the M$ site worth, per hour? Too much, for sure.) Granted, the suit should go the other way, but that's another topic.
- Abuse of ISPs - you'd be amazed how many ISPs will pull the plug on paying accounts for even innocent behavior (like sending 1,000 messages on a DSL account in under an hour, even if it's a business and all the messages are unique). This could get a lot of folks kicked offline.
There are probably others... My thought is this - build a really good, Bayesian, SBPH filter like CRM114 [sourceforge.net], and incorporate a "grab questionable sites" option for the "spams of the future," then filter that page as though it were spam. That'll get us all up into the 99.9% range (the noise), and spammers will eventually either (a) go out of business, or (b) only be able to get their messages to the few people that think they're worthwhile, anyway.My $.02.
-Ed
Confirmed opt-in mailing lists. (Score:4, Insightful)
Has anyone considered what this will really do? It'll have next to no impact on spammers.
However, lots and lots of legitimate opt-in mailing lists are following best practices by requiring a closed-loop opt-in with a magic cookie to prevent forged signups.
How do they work? Well, usually you follow a URL containing a magic cookie in a challenge email to confirm you want to sign up for the mailing list. Oops.
(For added brokenness, combine this with the other flawed anti-spam fad-du-jour, challenge/response).
Another idea (Score:3, Interesting)
Could it work?
Re:Another idea (Score:3, Informative)
Define "work".
What you're proposing is that you send a message in response to every message you receive. Furthermore, you're suggesting that the message you send in response have an invalid (random) return address.
How is this a good idea?
Okay, say machine scott@b.com is sending to larry@a.com. Assume that all machines are running your "callback" software.
B connects to A. A holds the connection open, as you proposed, and sends a message to scott@b.com, with a forged header so that it looks
collateral damage? Not really (Score:3, Interesting)
The thing is, it's no easier to do it with this proposed system than anything that's currently available. In this case you have to download (buy?!) a copy of spamming software, get a list, and then run a DDOS that's actually traceable back to you. Good plan? Not by my thinking.
Now the nice thing about this is that it will end up costing an inordinate amount of money for the spammer, take down their servers, and really piss off their ISP. (Watch the pink contracts dissappear!) This is a fairly drastic measure that might actually get rid of many spammers for good.
Basically, it's either this or a crowbar to the head.
Do it on the server, not on the client (Score:2)
How's about as a plugin to SpamAssassin? Scan the icoming email as usual. If it's determined that it's unlikely to be legit, pass it on to the URL scanner. Auto-whitelist hotmail.com and other common URL taglines etc. Follow each of the other URLs in the message.
Optional: If, after scanning the URLs, the pages linked to are determined not to contain spam, pass the message back to SpamAssassin flagged as clean and for deliv
I dunno, I think I like the old fashioned way... (Score:2)
I am not talking tar and feathers or lynch mob scenarios (the merits of which cannot be denied though). I am in favour of the high-tech "put the spammers address and personal info on Slashdot" old fashioned way. It seems to work best as the targetted spammer was really steamed...
Sorry, bad idea (Score:5, Insightful)
When my newsletter (confirmed Opt-in for the NANAE people who may be reading) goes out every Tuesday and 8,000 people open it, how am I supposed to deal with these filters DDoSing my site? For that matter, how do I deal with these filters attacking my site when some other newsletter links to it? What do I do when I piss off Ronnie Scelson and he links to every individual page on my site and spams 100,000,000 people with them?
Links are more likely to be found in legitimate email than in spam. We're going to whitelist every single existing domain on Earth, and then remove the bad ones? Do you have any idea how large that list would be and how long it would take to download it to compare with the domains found linked in an email?
Let's say this idea becomes used widely. It will be used as a weapon by the spammers themselves.
1.) Pay-per-click links sent in mass mailings. Spammer gets paid for every link clicked. I'm sure some of the advertisers will get wise, but there will be plenty who just sign the checks without looking deeper.
2.) Ronnie Scelson or Alan Ralsky get pissed at someone who owns a web site (SPEWS perhaps), and send the address to several hundred million people.
For the ISP sysadmins reading, you think it's bad when 20,000 spams land on your mail server? How are you going to like it when each of those 20,000 spams produce 3 or 4 (or 30 or 40) HTTP requests?
Sorry, bad idea. I can't see how the idea of "attack filters" does anything but discredit the whole idea, especially after thousands of perfectly innocent web sites are knocked offline by the sort of malicious software being advocating, or when spammers inevitably abuse it.
This is spectacularly stupid. (Score:5, Insightful)
This is the sort of thing that needs human supervision because bugs, user input, and solar flares may cause the program to act differently than you think it should. Any sysadmin who's made programs that would affect thousands of users automatically knows this. There will be a percentage - no matter how small - that the program will affect negatively, and that tiny percentage will be very, very pissed off.
You should be exceptionally careful about where you point your Massive Hose of Death because after all, to err is human, but to really fuck things up requires a recursive algorithm working at 2 billion cycles per second.
It's also ocurred to me that you'd be hurting yourself just as bad bandwidth wise anyway. We all complain about how much of our mail is spam, and how much bandwidth it wastes, but to DDOS them would waste hundreds of times more, not only for you but every provider that carries the traffic.
A better idea. (Score:2)
Exim SpamAssassin at SMTP time [merlins.org]
This method don't use your bandwidth downloading urls,
and slow down the spammers connection.
I would like to see what happen when
the mayor distributions start shipping
with something like this as the default option.
How about an Open Abuse Protocol (Score:2)
Don't just do something, stand there! (Score:3, Insightful)
I suspect that a thorough analysis of the proposed scheme would conclude that it could not work if it were widely adopted. It's silly to create a system in which a relatively small, expected but undesired input triggers a relatively large burden on network resources.
Oh, wait... that's called a distributed denial of service attack. Someone already thought it up!
New Spamming Technique : Trickle Spam. (Score:5, Informative)
I'm all for the idea, and as a matter of fact, I suggested it [slashdot.org] a couple of months ago.
If individual spam victims start repetitively downloading the spammers website, this could bring the spammer to change the way he sends spam from the current big bang technique to a small continuous trickle technique. The spammer would send a single spam over several weeks, in stead of a few hours. He would parallelize the process.
I see two possible counter-attacks to this :
Feel the rage !
As tempting as it may be... (Score:3, Insightful)
This is a bad idea, IMO. Stick with blocklisting. Once things get to the point where the spammers are all on what amounts to an intranet, and they're doing nothing but spamming each other, they'll get the idea.
Easy to get around (Score:2)
Day 1: Send spam A to 1 million addresses
Day 2: Send spam B to 1 million addresses
Day 3: Send spam C to 1 million addresses
They would
Day 1: Send spam A to 333,333 addresses, send spam B to 333,333 addresses, send spam C to 333,333 addresses
Day 2: Repeat
Day 3: Repeat
Obviously, they would draw this out over more than 3 days, but you get the idea.
Avoid URL validation - lie to them (Score:2, Interesting)
So, why not follow the links, but change the parameter values? It's all something which we'd do programmatically anyway, so subtle variations in the value portion would still incur the expense of processing the input, even if it fails. Keep the path component of the URL, and the parameter names used, so it gets as far as possible before blowing chunks.
So many security holes... (Score:3, Insightful)
It's not just DDOS that is the problem (in fact DDOS is actually the main feature). A naive implementation would pass along the GET data. So you could use this method to anonymously submit form data. Want to stuff an online ballot? Send out a spam linking to http://whatever/poll.foo?bar. Depending on how poorly written the sites are, you could even use this to do more sophisticated things, like sign up for 10,000 accounts at a certain website.
Bad idea, but might be improved (Score:3, Interesting)
auto following links -> spread worms (Score:3, Insightful)
lots of vulnerabilities have been discovered (in IE, etc) in the past that run arbitrary code when you visit a web page.
so, if we have all these [identical] email clients set to automatically follow links and that there's some kind of known buffer overrun within the html parsing code (or if they use the IE rendering engine and some similar vulnerability has been discovered) then if a malicious link is sent then all of these clients will follow it and get compromised. (witness the paranoia now in most email clients which disable javascript, attachments, etc by default).
at that point, if tons of machines are compromised, they could be turned into open proxies or could turn around and forward the email to everyone in their address book, etc.
yes, this might sound like a farfetched scenario, but i think even if this case didn't happen, the obvious counter for spammers is to distribute the web load over a bunch of compromised open proxies or something or to throw up temporary web pages on random web hosts until they get shut down.
the bottom line is that in the end the pain of this countermeasure will be simply passed onto innocent third parties.
furthermore, it's unlikely that any major mail client will include this feature by default (outlook or eudora) since there's so much room for abuse, and the whole idea relies on a critical mass of users to actually have an effect.
-fren
Bayesian filters (Score:3, Informative)
I installed a free one called K9 (though I donated $20 to the author), and over my last 573 emails (392 spam) it has only made one mistake, making it over 99.8% accurate after its initial training (141 messages). I've only been using it for a few weeks. It's about a 60k download and is very flexible and well behaved. The downside is that it's closed source and built for win32. I don't know if it works under Wine.
The one spam that got through was disguised a typical personal message, except that it was offering a business relationship and contained a personalized image link to determine if I viewed the message.
I tried Mozilla's built in bayesian filter for a few months. It had about 90% accuracy, even though I corrected every single mistake it made. Something's not working there, so probably shouldn't be used to judge the accuracy bayesian filters in general.
I've tried PopFile as well. It seems to have good accuracy, but it's like swatting a fly with a sledgehammer. It's like a full fledged anti-spam server and is best installed on a dedicated server but is not well suited for multi-user environments, and it'd not easy to correct old mistakes or rebuild the word database. It does have the benefit of being cross platform though, and it supports multiple buckets, not just spam and not spam.
Fight fire... by adding fire? (Score:3, Interesting)
Send out "white hat" spam, which for all intents and purposes looks like real (ie "black hat") spam. Except clicking on the link takes you to any number of webpages that basically say "are you so f***ing stupid you actually believe pills can make your penis/breasts/whatever larger?"
Adjust content to suit type of spam. Include disgusting images if the type of spam you're emulating is adult-oriented (pr0n, enlargements, etc), something else entirely if you're "selling" mortgages or similarly benign wares (ie no goatse.cx-type images if you're "selling".
And to cap it off, if viewers are so enraged at what they see, the page will have a feedback link. The link will either be a known spammer's email so they receive their venting instead of their money, or link to yet another anti-spam site.
Geeks and filters will automatically block this stuff out, so there's no harm done to us, aside from having to filter out even more spam.
But with any luck, if enough of these anti-spam spams get sent out that people start associating spam messages with informative, insulting or disgusting websites, they'll learn to stop clicking on those damn links, stop buying their bullshit products, the spam model becomes unprofitable, and spam is reduced to a saner level or eliminated entirely.
Legal implications? No better and no worse than black hat spammers.
Comments?
Sounds a lot like an old idea... (Score:3, Interesting)
Jeremy
RE: Filters that Fight Back (Score:3, Interesting)
Automatic attacks are a bad idea (Score:3, Insightful)
Having a "filter fight back" is a polite way of saying that you have trained attack software.
Software has bugs. If you have trained attack software, it will have bugs. Which means eventually it will attack an innocent site.
Ultimately this is a bad idea for the same reasons that automated home defenses are a bad idea. It's very easy to say that the intruder has earned the automated response, but then you get the nitty gritty issue of whether your automated system can distinquish between a burglar and a fireman.
The same issues apply in identifying Spam. How will your software, which will make mistakes, distinquish between the real source of Spam and a clever header that is making it look like someone else is the source? I don't care how good your algorithm is. It's coded by humans, so it will make mistakes. Unlike a human making a mistake manually, however, it will pounce at very high speeds.
Re:No such thing (Score:2, Informative)
Not true; several times I have received spams so carefully put together that they looked like they came from one of my addresses. For example, I used to have an address like me@school.edu; it's been inactive for some time, but once in a while I'll get a message claiming to be from that address, complete with perfectly spoofed headers. Tricky, but entirely possible.
Re:No such thing (Score:2)
The biggest single spam I get, Nigerian scam, at least 3 day, out of maybe 5 spam emails.
At home, buy.com seems to be popular with spammers. Amazon, and ebay too. Ebay is bad, because of the way people track and cant filter email on ebay, dont want to loose a sale.
BTW, I cut spam down at home b
Re:And that is why we spammers... (Score:4, Insightful)
Re:What if the server is hijacked? (Score:2)
The right people would be targeted, but not ALL of the right people.
Re:What if the server is hijacked? (Score:2)
1. They are running open proxies (intentionally or not)
2. They have not patched their systems from known security holes
3. They have contracted a virus, worm, or trojan by basically being not smart
I know this is kinda like saying "It's your fault you got robbed cause you don't lock your doors," but there is s
Re:What if the server is hijacked? (Score:2)
Sometimes the public good weighs on the conveneience of others, the wheelchair ramp outside the business might be costly, but its the right thing to do.
Closing up and otherwise paying attention to the devices one sticks on the internet should be no different.
Re:Choosing A Bayesian Filter (Score:2, Informative)
Re:Fight Back by creating useless data (Score:2)
Note, that this type of activity is just as legal as the RIAA or MadonnaWhore putting out fake MP3s.
[I work with banks as clients, and they sure are dumb about technology stuff most of the time, but they figure out when something hurts them financially pretty darned quick. I'd estimate the mortgage lead business would go away in less tha