Attacking the Spammer Business Model 655
Stephen Samuel asks: "Spammers spam because it's an 'easy way to make money'. They send out millions of spams knowing that 99.995% of them will be ignored, but the other 0.005% of responses are pure gold (Andrew Leung at Telus has an excellent report on the economics of spam). Responses to mortage spams are reportedly worth $50.00 each. What would happen if, instead of technical and legal approaches, we simply started attacking their business model? If people
started responding to just 1% of the spam we received, spammers would drown in the responses, and the mortage spam responses wouldn't be worth an email, much less $50. The Nigerian Sweet Revenge is an example of this. The nice thing about this sort of statistical approach is that it would start to reward spammers for sending out -fewer- emails. (fewer emails -> fewer bogus responses). What other ways can people think of to attack the spammer business models, and what are the expected downsides of such approaches?" Of course, the one major drawback to this is the likelihood of more spam, since you'll be giving them a valid email address. However, many of you may be receiving increasing amount of spam as it is (even through your filters) so might an organized spam-the-spammers movement work?
Richest spammers could afford to handle replies (Score:5, Insightful)
Now what about sending them bogus email addresses and phony information? That would send them on a wild goose chase.
Re:Richest spammers could afford to handle replies (Score:5, Insightful)
Re:Richest spammers could afford to handle replies (Score:4, Insightful)
Re:Richest spammers could afford to handle replies (Score:3, Insightful)
Find out who owns the netblock before you go DDoS'ing everything you find objectionable. You're probably hurting someone who has nothing to do with it.
Re:Richest spammers could afford to handle replies (Score:5, Insightful)
Those reputable companies might be a bit more careful in future to ensure that they aren't selling to spammers - by doing background checks, by educating their customers (for those spammers who don't actually realise it's a bad idea) and by being very public about kicking spammers when they're caught.
Provide a strong enough financial dis-incentive to host spammers and eventually spam friendly ISPs will dry up - but while there's profit to be made hosting spamers, then of course these "reputable companies" will 'accidentally' host them.
Attacking Business Model - Posted Anonymously! (Score:5, Interesting)
Not really related to the parent; I posted it up here because I think it's a good idea. I don't want to be too associated with it, anticipating the spammers fighting back.
At the very least, I'd like to have a good Windows programmer put together something akin to this:
#!/bin/bash
COUNT=0
while [ $COUNT -lt 2000 ]; do
lynx -dump -traversal -useragent="By sending e-mail to my domain, you agreed to the published Terms of Service of my privately owned domains and servers, including the stipulation that all spam would result in your webserver log being filled with garbage. If you don't like it, don't send e-mail to my domains. I f you don't want me to visit your website, don't solicit my visit by sending me unsolicited e-mail. You do not have a First Amendment right to waste my bandwidth, electricity, CPU time or hard disk drive space with your crap, characteristically illiterate or otherwise."$1?YOU_FILL_MY_MAILBOX_WITH_UNSOLICITED _C
RAP_AND_WE_WILL_DO_THE_SAME_TO_YOUR_WEBLOGS
let COUNT=COUNT+1
echo $COUNT
done
I use this on all my spam.
Such a program would need to have a drag-and-drop interface, automatically replace the user's e-mail address (wherever it appears in HTML bugs) with uce@ftc.gov or something similar, trim serial numbers, cope with obfuscated URLs and hijacked Yahoo/Google redirectors, and eat both image tags and links.
As it is, I open each message, manually extract all the HTML tags, and plop 'em into a terminal window on one of my servers.
The only real worry is a spammer using a GeoCities or other free webpage. But if a few people hit the site with this kind of program, it would get it shut down faster than an abuse complaint.
Of course, if the spammer is being paid per hit, the advertiser is spending a lot of money to advertise to /dev/null, so it's unlikely that they'll continue the current business model.
I've also got it on the advice of a Federal Court judge (who is blind and can no longer read his e-mail in public places because he's too embarrassed by all the penis enlargement spams being read by his screen reader) that, since they've solicited my visit AND been warned on my website, there's very little the spammers can do about it. (Even so, I'd be hauled up in front of him, and I know how he feels about spam...)
Such a program could be very popular with the general public, since there's a definite feeling of satisfaction. But I think it should also be distributed anonymously. Spammers are likely to DoS any download sites and flood any mailboxes.
Sure, this is essentially a denial of service attack against the spammer. But the spam itself is a denial of service attack against MY mailbox, and nothing else seems to be able to stop it.
Any Windows programmers out there?
Re:Attacking Business Model - Posted Anonymously! (Score:3, Informative)
And for some other reason, it doesn't seem to work, but try to retrieve a help file (on my Debian version of lynx).
So you can use wget, which doesn't have any trouble with a conscience. Replace the 'lynx string with:
Cheers,
Costyn.
A slightly easier method (Score:3, Interesting)
A short C program to randomise the identification codes in a spam, a web server, and a downloader such as WebReaper.
From a spam I take the URL, e.g.
http://spammer.com/script.cgi?id=12345 and convert it to
http://spammer.com/script.cgi?id=#####
the C program loops over this N times where N depends on how hacked off with spam I'm feeling, converting the # to random digits and adding the new URL to a
Re:Richest spammers could afford to handle replies (Score:3, Insightful)
However, it is not. What is being suggested (And you might want to read the post, if not the article...) is to resond with email, not in a multiple reply per person fashion, but rather just to reply, and make the spammer go through 5000 replies per spam attack, so that it takes several hours to find the one respondant that genuinely wants a morgage. This is NOT DDOS, or even flooding the s
Re:Richest spammers could afford to handle replies (Score:3, Interesting)
Too right. While $20 shared hosting accounts are available without sufficient proof of ID and a mechanism for ensuring you pay a hell of a lot more than $20 if you abuse the TOS and spam, then spamming will continue to be a commercially viable proposition.
The easiest step in the chain for the victims of the spamming to address is those $20 shared hosting accounts. If it's not commercially viable for com
Re:Richest spammers could afford to handle replies (Score:5, Informative)
Re:Richest spammers could afford to handle replies (Score:3, Informative)
The idea isn't to attack at all, rather to reply as an interested customer.
The scenario is that you recieve a mail about getting, say pills that make your nostrils bigger. All spammers will need a way to ensure that you can make a purchase, and it's through that mechanism that you inquire for more information about nostril enhancement through magic pills.
If everyone who recieved an email did this, they would get thousands of requests.
If they only reply to a few of them
Re:Richest spammers could afford to handle replies (Score:4, Funny)
Re:Richest spammers could afford to handle replies (Score:5, Funny)
Reply with the the email addreses of other spammers :-)
Re:Richest spammers could afford to handle replies (Score:3, Interesting)
Yep. That's what I generally do... I usually 'harvest' the Email addresses of Nigerian spammers, and use those as my 'reply' email address. (Perhaps I can get them talking to each other! :-o ).
If a spam site I visit gives me a non-800 phone number, I'll often put that in my files, as well.
Re:Richest spammers could afford to handle replies (Score:5, Informative)
That would be form fucker [slashdot.org]
The plan would work if enough people did it (the single reply, not necessarily the form fucker), and it would work for the same reason that spam makes my inbox useless. A poor signal to noise ratio. Someone has to dig through all of those garbage e-mails and harvest the truly interested parties (both of them).
FormFucker good idea, but risky. (Score:3, Interesting)
If formfucker doesn't have a good time delay between signups then they could delete the records between time A and B. Finding times would would be obvious with a count(*) group by hour (or minute) type statement. Or maybe I give the spammers too much credit.
FormFucker should probably sleep a random interval between submissions.
The bigger problem which would make it easier to filter out would be IP address. Your spammer gets ten responses from the same IP address, all with different data, and they're cle
Re:Richest spammers could afford to handle replies (Score:5, Interesting)
Brings new meaning to the concept of a Spam-bot...
Anybody care to write one?
The only problem I see is that the spammers could then prosecute you for forged identity/ misuse of computer equipment...
Instead of doing a dictionary-style counter attack (which could accidentally frame someone), we would have to use the same name-mangling as the spammers use...
Example counter-spam:
Dear Sir:
Please sign me up for 9en1s 3nlar6ement!
Name: B0gus B0b
Address: 12-34 Stat St, Washington UL 12345
Email: anon_tip@fbi.gov
Hopefully, the fake @fbi.gov email will get them in even more hot water...
This is actually a GOOD thing. (Score:3, Funny)
Why? Sheesh, I don't know, but whatever story gets posted here, someone always claims it's a good thing, so I figured it might just as well be me this time.
No, This is actually a BAD thing. (Score:5, Funny)
Why? Sheesh, I don't know, but whatever story gets posted here, someone always claims it's a good thing, so I figured it might just as well be me this time.
This is a bad thing. Why? Well, I don't know either, but whatever comments get posted here, someone always claims you're wrong, so I figured it might just as well be me this time.
Bogus spams? (Score:4, Interesting)
Re:Bogus spams? (Score:5, Insightful)
Re:Bogus spams? (Score:2)
Re:Bogus spams? (Score:5, Interesting)
1) Verify that the email address is deliverable. It makes no sense to keep a bad email address in your database of spam targets.
2) Seed statistical spam filters with bogus data.
I've been really happy with bogofilter on my IMAP server. Once I got the bus worked out of my scripts, it's running about 98% accuracy with zero good emails getting filtered as spam.
Re:Bogus spams? (Score:5, Interesting)
I don't know about everyone else, but a good portion of the seemingly blank SPAM I receive are actually HTML email with no text version. I told Mozilla mail to never, ever display HTML email (and can't figure out how I did it, to replicate on my laptop!) If I look at the email in a text editor, I realize that it's full of either HTML or Base64-encoded text/html.
Mozilla Mail does properly convert normal HTML mail to text, even when a text version isn't included -- so obviously whatever tool the spammers use to compose their messages is non-compliant in some way (I haven't been bothered enough to figure out what exactly they are doing wrong).
I do quite often get other messages that appear to be just junk, or possibly Chinese/Korean characters (the majority simply look like binary data)... those I haven't figured out yet.
Re:Bogus spams? (Score:4, Informative)
In Mozilla Mail, going to View->Message Body As and select Plain Text turns off HTML for email.
Re:Bogus spams? (Score:5, Informative)
This might be the result of blocking remote images in email, to avoid spam filters, some spammers now have an email consisting of little more than a pointer to an image on their (zombie?) servers. The image has all of the text in it.
If you have images blocked, try reading the source and see if that's the case.
Ironic, don't you think? (Score:5, Insightful)
Sorting through a pile of junk to get the stuff you're looking for. Sound familiar email junkies?
Re:Ironic, don't you think? (Score:5, Interesting)
The Basics:
SD would allow users to connect to a peer to peer network which would enable thousands of users to share information about Spam they have received which warrants a response. Individual users would have the opportunity to nominate a Spam email for response. Once an email is nominated, it would be reviewed by several moderators in good standing. If those moderators certify a Spam for response, a distributed network of computers running SD would begin to flood the Spammer with bogus information either by email or by their websites.
More Ideas:
Moderators could be effectively metamoderated by comparing their votes with the votes of other moderators. A moderator's standing could be stored in a distributed fashion so when you rejoin the network, you don't have to start building your standing from scratch.
Reponses by website could be templated by the original nominator and reviewed by the moderators. Each form field could be given a type such as name, email address, phone, etc. A facility for templating a series of screens would be useful, and probably could be accomplished by having the nominator make a dry run through the website. Additional heuristics could be added that would allow the program to make guesses if the templating doesn't match. In cases when heuristics are used, moderators could be prompted to verify that the responses make sense. It's critical that the responses be difficult to weed out of actual responses from real customers in order to confound the Spammers.
Responses by email would require very careful moderating as the results, if misdirected, could be worse than the original problem (Spam). Some moderators may need to be certified as experts on email tracking. Also, some very clever test emails may need to be sent as confirmation before a response can be authorized. Responses by email should be anonymous. SD should be able to keep a healthy list of open relays by analyzing the Spam emails.
A very clever use of SD could allow for response throttling ensuring that a website remains responsive for SD. It would be a real shame to have SD hammer a website into submission only to end up with no real work being done. The cruft should be added slowly & steadily at first & possibly release the floodgates later in the process.
Finally, SD could be VERY useful for exchanging information about the Spam that is circulating and be used as raw information for filtering engines to reduce the amount of delivered Spam. If the system were to be well used, Spam might only be delivered to a smallish number of people before SD gets the email submitted, moderated, and certified as Spam. Once that's done, Spam filters worldwide could begin using that information to VERY specifically filter those Spam emails and blocking their delivery to suspecting throngs. Now wouldn't THAT be nice?
Re:Ironic, don't you think? (Score:4, Funny)
automated replies / anon remailers (Score:5, Interesting)
Re:automated replies / anon remailers (Score:2)
Even better: We write a bunch of viruses to take over underprotected computers. Then we use those computers to respond, en masse, to spammers' solicitations...
Hmmmm. I started out trying to be funny, but if we really want to turn the tables... Anyone know someone in the Russian Mob?
Re:automated replies / anon remailers (Score:5, Insightful)
Re:automated replies / anon remailers (Score:3, Informative)
For the most part, reply addresses are bogus. They usually expect you to visit a web site. It's only 419 spammers (and the like) who usually give (and read) legitimate reply addresses. I'll often use those as my 'response' address.
The Best Way to Attack Spammers (Score:3, Insightful)
What you should do if you are serious about getting on the nerves of some spammers is create an extra e-mail address for yourself that you send responses to spammers with, and get replies(maybe) in. Eventually, you could take all of those spam messages in that email box to a judge somewhere and win yourself a considerable amount at the pocket of a crass spammer somewhere.
So long as we can outthink them, we can win.
Re:The Best Way to Attack Spammers (Score:3, Interesting)
Add all the spammers to an e-mail list and automatically forward any spam I get (using an address I use only for this purpose) to everyone on that list.
Re:The Best Way to Attack Spammers (Score:5, Informative)
Add all the spammers to an e-mail list and automatically forward any spam I get (using an address I use only for this purpose) to everyone on that list.
Having recently been a victim of having my addresses spoofed by spammers, I don't think this is a good idea. Only if the SPAM actually says to reply for more information (or to make a purchase) would this work; in other words, only if you have a reason to believe that the address is in fact going to reach the spammer.
The majority of SPAM I get does not come from a valid email address, but instead includes a URL to visit or a telephone number to call. Thus, forwarding SPAM to the From/Reply address will either just bounce, or worse, go to the unsuspecting person who's address was inappropriately used.
I know that often the spammers just use a random address from their list as the From/Reply-To, but for a couple of weeks I was the proud recipient of many thousands of bounced SPAM messages, to the extent that I had to temporarily
Re:The Best Way to Attack Spammers (Score:3, Insightful)
If you go to the web site and fill in the details with bogus-but-almost accurate data, they won't be able to contact you, and you get to flood them with 'spam' referrals. If its a telephone number to call... well, make sure you get through to a person, walk them through the whole 'yes, of course I want x' routine, then hang up right at the point where they ask for completion.
Even better is to get them to send a salesman round, as you obviou
in the short run... (Score:5, Interesting)
Re:in the short run... (Score:5, Insightful)
Re:in the short run... (Score:3, Interesting)
Re:in the short run... (Score:4, Insightful)
Well, not necessarily. The trick is to craft "leads" that are obviously bogus to a human at the mortgage company, but aren't easily filtered by a machine.
What makes this especially interesting is that, in other words, it's precisely like creatng spam designed to get around spam filters.
With names that are obviously bogus to people, but mot machine, the bogus "lead" is either
- sent to the mortgage company, which realizes immediately that the "lead" leads nowhere, and pretty soon that too many of the spammer's leads are bogus;
- or, you make the spammer himself weed out the bogus "leads" so as to keep the mortgage company as a client.
The mortgage company (or the spammer, if he's weeding) will quickly realize that "Felix Thecat" and "Kiss M'Ass" are bogus. "Heywood Jablowme" might get by a weeder, but won't last too long at the mortgage ccompany. "Gloria Mundi" probably gets several calls before somebody at the mortgage company remembers high school Latin or a Roman Catholic upbringing.While a dictionary of first names will allow some machine weeding, could a 95% coverage of last names be built? What percent coverage of last names is needed to keep a mortgage spammer from being dumped by the mortgage spammer? What's the distribution of last names? Help me out, Slashdot.
Re:in the short run... (Score:3, Insightful)
Re:in the short run... (Score:3, Funny)
And, unless you're the one who is answering the phone, you're morally no different than the spammer.
Slightly more moral: give the phone number of a telephone solicitor. Then everyone is happy: the telephone solicitor gets to try to sell long distance service (or whatever) to the mortgage broker, and the mortgage broker gets to inquire whether the telephone solicitor want
Re:in the short run... (Score:2)
If you put the people that support spam out of business, they won't be hiring spammers, and people who see what's going on won't either...?
Just a thought.
Re:in the short run... (Score:2, Interesting)
You could tell the mortgage company what you are doing: "I'm wasting your time because you employ spammers to waste mine. I never had any intention of dealing with a company employing spammers."
That would have the plus of losing them m
Actually, you'd enrich spammers (Score:3, Informative)
My spam is better then your spam (Score:3, Informative)
Does this mean I now have to read all my spam to decide which I should reply to and which I should ignore???
As for giving them a valid email address..... (Score:2, Informative)
Once you're done messing with them, just kill the address. Not exactly a foolproof solution, but I don't see why it wouldn't work most of the time.
Re:As for giving them a valid email address..... (Score:2)
Filters that fight back... (Score:5, Informative)
Here's a link to the article.
http://www.paulgraham.com/ffb.html
Re:Filters that fight back... (Score:5, Funny)
Oh, the Slashdot business model!
Re:Filters that fight back... (Score:2)
I do wonder if it might be straying into legal definitions of DoS and the like?
Re:Filters that fight back... (Score:2)
Re:Filters that fight back... (Score:5, Insightful)
It doesn't distinguish between good guys and bad guys. In fact none of the "automatic" schemes mentioned do. Say the spammers decide they hate Paul, they can very easily deliver several spams pointing to his web site/email address/phone number. Remember that the cost of sending extra emails by a spammer is pretty much zero.
The spammers are already picking on the anti-spam people. [theregister.co.uk]
So how will your auto-responders etc tell the difference between bad guys and good guys?
Re:Filters that fight back... (Score:5, Informative)
All the schemes are easily overcome by a spammer. And it is still easy for them to pick on innocent bystanders. For innocent people, all they have to do is include their URLs in a spam message. Thousands of individual servers checking an innocent person's server even if they decide it is harmless will still be a DDOS against a good guy.
So here are several ways a spammer can get around everything that is proposed:
It is way easier to do this stuff playing defense. Using RBLs etc when someone tries to get access to your mail server works pretty well. Worst case you deny legitimate email, and the only one hurt is you.
When going on the offensive, you are trying to hurt others. How much collateral damage is ok? One poster in this thread posted their web site. If a spammer included that URL in several billion spams and you had hundreds of thousands of hits against you, how would you feel? How would you feel if your site was listed as a bad guy site? How would you feel if your system had done something automated as an offensive action against another site (eg trying to fill out name and address forms with bogus information) and it turned out that site was mistakenly listed as a bad guy site?
And if you think it is easy classifying sites, try these two: jennifer [jennifersblog.com] and jamie [iagreewithjamie.com] (answers at Metafilter: jennifer [metafilter.com] and jamie [metafilter.com]).
Re:Filters that fight back... (Score:4, Insightful)
Re:Filters that fight back... (Score:4, Interesting)
http://www.toad.net/~mischief/archives/00000084.s
This tool is a "honeypot." The idea is that you install this software on a Linux/Unix machine (believe there might also be an NT version available) and it pretends to be like multiple computers on the network, acting as virtual hosts. Whenever a worm comes along and probes one of those virtual hosts, La Brea hangs on to the thread and slows down the process of infection, logs all the relevant info, etc. It's actually a brilliant idea and now, thanks to some of our genius legislators, potentially illegal to possess or use.
Someone created a tar-pit for Code Red. google for la brea code red
any ideas?
or am I suggesting a DoS?
UMM Can you say distributed denial of service? (Score:3, Insightful)
Re:Filters that fight back... (Score:2)
Reply. (Score:3, Insightful)
A better idea... (Score:3, Interesting)
No good for invalid reply-to addreses (Score:3, Insightful)
Frequently, I get spam that seems to be selling NOTHING. The reply-to is invalid, and they don't bother including any kind of URL.
On the bright side, the vast majority of my spam gets caught in the filters - so I only see it if I check the spam folder. And may the spam rot there...
Spam Site? (Score:2, Interesting)
We should also spam their ISPs after a generous warning.
Spam is out of control, and I think everyone here knows that until some universal SMTP replacement or SMTP extension is implemented, spam ain't going away.
Spam their 800 numbers.. (Score:5, Insightful)
It feels good to cost the spammers some money, even if it does waste your time to do it.
Re:Spam their 800 numbers.. (Score:2, Insightful)
Best to call from the fax machine at work or some other "useless" number.
Re:Spam their 800 numbers.. (Score:3, Informative)
For spam that wants you to call a 1-800 number (Score:5, Interesting)
The only downside is I don't think many spammers use this approach, but it'd certainly be effective against those who do. I don't think it'd be illegal (as long as each person didn't call more than once) either, but IANAL.
Re:For spam that wants you to call a 1-800 number (Score:3, Funny)
Please, think evil. I know you can do better than that. At least try.
What we do is, every time we get a spam with an 800 number, we use our modems to FAX that number...
Re:For spam that wants you to call a 1-800 number (Score:3, Interesting)
How do you know that the 800 # was actually sent with spam? It could be a prankster, or someone wanting revenge for a non-spam-related reason, or it could be spammers themselves trying to discredit the anti-spam community.
Five maybe six years ago there was this one really bad spam that listed an 800 number. Got at least one a day and it was for the 800 number. It didn't take long for the message on the voicemail for this number to state that
The BIG Problem here..... (Score:4, Insightful)
The number of spam emails that get through SpamAssassin because of forged "From:" headers is ridiculous. And worse is the number of bounce messages I get because someone has used my email address as the "From:" header in a massive spam mailout.
Capital punishment... (Score:3, Funny)
Re:Capital punishment... (Score:4, Funny)
Not applicable to most spam (Score:5, Insightful)
Re:Not applicable to most spam (Score:2)
If it's clear that the spammer is doing something illegal (selling something that's illegal, hosting the website on a hacked cable modem computer, etc...), would it be legal for you to give them a fake/bad credit card number?
Blacklists (Score:3, Interesting)
From a spammer's programmer (Score:5, Interesting)
As a programmer working to keep the data flowing smoothly part of my job entails building programatic methods of detecting false data. Some of this is easy (i.e. people who put "I WANT TO RAPE YOUR DAUGHTER" in the first name field). Sometimes this is harder. IP checking helps, but distributed attacks are always a difficult thing to catch. However, all that said I don't know that this would be a significant problem.
One of our upcoming process changes will include an attempt to contact each customer via phone or email to verify their order before following through with it. Futher, automated credit-card checking will automatically drop orders with bogus data in them. CreditCard declined statistics would rise, but ultimately it wouldn't be that much hassle.
If you really want to hurt a spammer, get thousands of people to order a product, then send it back and charge-back the order on their cards. Creditcard merchant accounts have limits on the chargeback rates, and when they get too high the merchant provider will cut you off. Of course you have to front the money and the hassle, and at the end of the day there's only 1 less spammer out of a million (unless he tries to find another merchant provider and succeeds). But for some, perhaps the cost-benefit analysis would still find it worth it.
Total Due: $0.02
Re:From a spammer's programmer (Score:4, Interesting)
Give me a fscking break (Score:5, Interesting)
Let's look this post a bit and do a little translation:
Part of my companies' income is from sales of various and sundry products sold via soley online "stores." Part of that traffic is via banner ads, text links, etc, and another portion is via bulk mail (spam)
Translation: I am a spammer.
If you really want to hurt a spammer, get thousands of people to order a product, then send it back and charge-back the order on their cards.
Translation: Give me your credit card number.
Spammers are the wise guys and con men of the digital age. DO NOT TRUST THEM. I mean really - if this guy makes his living this way is he honestly going to give you a stick to beat him with???
It's more likely he'll take your credit card number, charge it to the hilt and take off to Zaire.
Give me your credit card number and I'll be hurt. Please!
Blacklisting for spammers (Score:3, Insightful)
Namely, the very methods we've come up with to avoid spam would work for the spammers.
How long do you think it would take before, in addition to lists of live email addresses, spammers also begin keeping lists of "people wasting our time"? I'd give it a week, if this really caught on suddenly.
For that matter, I believe this would leave them in a better position than now, since they'd not only have a list of people who won't buy from them (allowing them to cull their list of live email addresses a bit), but also a list of people likely to actually take steps to stop spammers.
Think about that for a minute - The few spammers we have managed to put out of business have gotten nabbed by a few small groups of dedicated, annoyed, and technologically-saavy people. Taking action along the recommended lines would give the spammers a way to identify and steer clear of similar groups of people.
While some of us may consider that a win ("they don't bother me anymore"), I think most of us realize that we need to do more to stop spam than unclog our own individual inboxes - We need to permanantly shut down all spammers in general. Or, put another way, my filters already block most of the spam I get (literally over 300/day now). That doesn't do a damn thing to help friends and relatives who don't understand how to maintain a good filter (like it or not, good spam filters require a fairly high level of understanding about the workings of email to properly tune - Not so much to simply block spam, but more importantly, to not block legit email).
I like that people keep thinking about this problem, and eventually look forward to a good solution. This does not seem like "the" solution, though.
Here's a mirror (Score:2)
The link seemed to be slow, so here's mirror: Go ahead, slashdot it to your heart's content [herrvinny.com]
Yeah, but what's the point? (Score:2)
This is a really neat idea (Score:3, Interesting)
Yes, I am very interested in your product. Please send more information to my address at fictionalPerson@non-existantDomain.net.
Now that would be funny.
Works with physical mail (Score:2, Interesting)
The problem is that with spam we often have no address to send anything to, or the address we have is one that will do any good. It is like those 'work at home' signs on the road. We may think we are attacking th
A glimmer of an idea... (Score:2)
3 Lawyers, 3 geeks (Score:5, Interesting)
A very significant percentage of spam meets two criteria: 1) it already breaks some existing state or federal law and 2) it ultimately desires someone to supply a US-based credit card (Visa or Mastercard).
The problem with all our wonderful anti-spam laws is that they are not being enforced, and probably never will be, except erratically for 1 or 2 really, really bad repeat offenders. So, instead of using laws to take bad people to court, use laws to make law-abiding people quit aiding and abetting spammers.
Thus, the weak underbelly of many spammers is that some minion of MC/VISA is letting them process cc transactions.
Solution: the FTC should allocate 3 lawyers and 3 geeks, and (the easy part) demand the cooperation of MC/VISA. The 3 geeks maintain emailboxes in all 50 states and a batch of email addresses designed to gather spam. They essentially provide the 3 lawyers with "quality" spam, that meets the 2 criteria mentioned above.
The 3 lawyers select spam that has broken a law, follow the spam-requested transaction to the point where it requires a cc transaction, and do it. At that point, there is a CC transaction involving a broken law. The lawyers provide MC/VISA with the information on what merchant processor handled the transaction and what laws were broken. MC/VISA shutdown that account, or simply dings them $20,000 for each offense.
Note that, unlike the FTC, MC/VISA can penalize any customer they choose to without due process (and they have a record of doing so). They definitely do not want to participate in illegally advertised transaction if a spotlight is shown on it.
The need to process credit cards is the weak link in much of the spam business, and it is very hard for them to work around an inability to obtain the services of a merchant credit card account. MC/VISA have tightened up the requirements for getting CC services in the past, and they can certainly do so again.
MC/VISA might even elect to make the process more automated by issuing the lawyers some "special" credit cards. When they see a transaction for any "special" number come through, they immediately shutdown that processor. (But you better make sure those special numbers aren't as easy to steal as all other credit card numbers seem to be!)
3 lawyers plus 3 geeks could make a bigger dent in spam than any collective effort to date has produced.
Brilliant (Score:4, Insightful)
Absolutely the best post in this whole thread. Bravo.
The need to process credit cards is the weak link in much of the spam business, and it is very hard for them to work around an inability to obtain the services of a merchant credit card account.
Re:3 Lawyers, 3 geeks (Score:4, Insightful)
The bread and butter of the credit companies lies in standard retail purchases.. The idea here is that by exerting pressure on the credit card companies you can cut spam off at the source (the companies who finance it in the first place), as their lifeblood is most definitely in credit card purchases. In other words, they have much more to lose than MC/Visa do. At the same time it exerts tremendous pressure on the middle men who create these accounts in the first place.. they MOST DEFINITELY need the support of the credit card companies or they don't have a livelehood.
Assuming the fundamental thesis is true (these companies are in fact breaking the law with spam), this is the most plausible plan of attack I've seen yet.
Re:3 Lawyers, 3 geeks (Score:3, Informative)
Sounds like a huge market for the enterprising lawyer, who only yesterday thought that tort reform had cut off his cash cow.
P.S. It ain't entrapment if the 'entrappee' is already committing or planning to commit a crime.
Distributed Denial Of Service & Joe Jobs (Score:3, Insightful)
causes major problems if someone forges.
Example: a disgruntled employeee forges
many emails about his company's products.
When your anti-spam army calls for info,
they overload the company's phone system.
This is called a Joe Job, and is bad and wrong.
Why? Imagine it done to a hospital phone line.
Spam is a real problem. This is not the answer.
If you want ideas, try this overview [netextend.com]
Cheers, Joel
Won't work... not that way anyways (Score:3, Insightful)
Finally, your assertion that it would incentivate less spam from individual spammers is wrong, since the ratio of fake to real responses is the same for a large mailing list as it is for a smaller one. In other words, you have "constant returns to spam." The only way it would incentivate less spam is if you managed to drive some of the spammers out of business. More likely, it would lead to more spam, as spammers scramble to find more addresses to offset their lower "spam margin."
How many spams have 800 numbers? (Score:3, Informative)
Money talks (Score:3, Funny)
Case in point: for every credit card application I get via snail mail, I seal the return envelope (empty or with trash) and mail it back at their expense. The idea is the company loses money by having to pay for the reply postage and for the labor to open my bogus reply.
But I've noticed lately that companies are designing it so you have to include the application form to mail the return envelope (the city/state are printed on the app, which is viewable through a window on the envelope). Apparently, credit card companies weren't taking enough of a hit to say "fuck it, these people don't want our mailings." Instead, they seemed to have paid some poor schmuck more money to come up with a way to outsmart the scheme many of us have been using.
Doesn't matter, though. I'll tape the city/state info to the envelope if I have to. And soak the envelope in cat piss. Take that.
White Lists! (Score:3, Interesting)
Spam holes are not the answer, but with friend list they sure look a lot saner (c'mon, everyone in
at least start to Prosecute the scammers (Score:3)
No matter if it comes to you via brazil, argentina, russia, etc, 90% of spam is US sourced.
A HUGE amount of spam is pushing products/schemes that involve fraud, fake drugs that the FDA does not allow, etc, etc.
A HUGE amount of spam is sent by stealing services from legit users (using open relays, etc). Technically bad, not illegal to have. But the spammers take advantage and steal bandwidth.
pre-sendmail 8.9 and when open relays were just becoming bad, a friend had an ISDN line kept open for several hundred dollars of connection time when he was away on vacation and his relay was found (connection would come up periodically to pull down mail). The police and FBI could not have been less interested in this event which cost real money to a real taxpayer.
Were the FBI to go after Joe Schmo Spammer who kicks off 5000 messages to my company to an alphabet list of users from over 200 different relays, and charge him with breaking into his relays' computers and fraud (sorry, Herbal Viagra or Guaranteeed Stock Schemes and Pyramid Schemes are illegal), then perhaps spammers would have a cost associated - JAIL!
Me? I have a fantasy that plays out thusly:
The Judge:
Have you responded to spam? (Score:4, Insightful)
What is the source of the info that spam works? That's right, it's the spammers. Spammers tell you that spam works. Bzzzzt! Rule #1: Spammers lie!
Who are the spammer's customers? No, not you who get the spam. The spammer's customers are those who order spam services. And there are enough idiots who buy spam services to make those 180 spammers very wealthy.
Even though the spammer's customer get burnt once and stop, well, some of them are probably stupid enough to try several times anyway, there are enough of these morons to keep it going for a very long time.
They're not making a single sale, not even 0.0001%, but that doesn't matter, because the spammer got his money, and that's why this continues.
So, if you want to end spam, forget the spammers: Go after those who purchase spam services instead.
Well, that's my theory. It may not hold up, but after all, this is /.! :-)
Hitting their lifelines (Score:3, Informative)
After playing the game a couple weeks, I reported his banking connection (a real person) to the London Met Police and his email info to his ISP (SIFY of India - *great* customer service!) and had his accounts terminated.That was a laugh and a breeze.
If you look for the lifelines of 419 scammers, they have their email and their banking connection. Shutting down their email account fast makes their spamming futile. Shutting down their banking connection is harder, but very painful for them. Bottom line: MeThinks 419 scamming will stay benign, they're too easy to wipe out.
Looking for the lifelines of the real spammers (the Viagra, Mortgage, Patches etc. stuff), there are three: Ability to send loads of email, ability to recieve responses (web site or phone number) and ability to receive money. Kill any one of these, and the situation is solved.
The ability to send email is tricky to fix. We all want that email can be sent freely, preferably for free. Fixing/replacing SMTP to include authentication would be great! But we're still awaiting news from this front.
Hitting their web sites could be done in several ways. Proper legislation could make it a felony to operate spam-advertised web sites, and they could be taken out. If spam filters included the ability to automatically spider the web sites referred in the mails, they would have to pay for loads of useless traffic to their sites - and their ISP's would look at disconnecting them. It's not a DoS attack per se, we're just making backup copies of potentially useful information :)
And for hitting back on their payment options, there was an excellent suggestion earlier that the FTC take care of this. That looks very cool,. Much better than more laws that are not enforceable anyway :) So clearly an FTC issue if I ever saw one.
Getting the spammers on any one of these three lifelines would be sufficient - getting them on all three would be very, very effective.
Re:Easy! (Score:2)
>
> Break their fucking legs, and arrest.
You didn't completely answer the question.
"Break their fucking legs, and arrest them. I see no downside to this approach."
There, that's more like it.
Legs no, fingers yes (Score:2, Funny)
A spammer can still spam with broken legs, and possibly get out of an arrest. Typing with broken fingers, well... at least they'll be off spamming for awhile until they can toe-type.
Re:New Internet Business Model (Score:3, Insightful)