Subject: RE: [Asrg] TitanKey and "white lies"... (Faking SMTP hard errors "improves" C/R utility?)

From: "Eric D. Williams" <[email-masked]>
Date: Thu, 29 May 2003 22:14:01 -0400

On Thursday, May 29, 2003 5:30 PM, Barry Shein [SMTP:[email-masked]] wrote:
8<...>8
> Yeah sure and I'm the King of the Gypsies...
>
> Maybe a better way to say that is:
>
>       Since IN THEORY there MIGHT exist a spamming program
>       which responds to a permanent SMTP error...
>
> How is a virus-hijacked thrall server going to remove addresses or
> even report the error back?

Barry again inserts (to me) an interesting point on 'spamming' tools e.g. 
zombies and robots; introduced by surreptitious or malicious means e.g. 
viruses.  I think there may be evidence, however, that these 'spamming' methods 
do use clandestine communications channels to other compromised (or not) 
systems to 'peruse' economically unproductive distribution.  I still think the 
best way to a proof of this is to obtain some code for forensic analysis.  If 
there is some [code] available I think that would be a valuable activity to 
engage.  I would be willing to contribute to that effort and will make analysis 
and code available if I run across any.

-e
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Thu, 29 May 2003 22:02:56 -0600 (MDT)

> From: "Eric D. Williams" <[email-masked]>

> ...
> viruses. 

Yes, it was an interesting point.

>     I think there may be evidence, however, that these 'spamming' methods 
> engage. ...

I do not understand that.  If you found some code and figured it out,
you would know at most what some spammers may have done in one case.
You would not know what other spammers or the same spammers might do
tomorrow.  If you failed to find any such code, you would only know
that you had failed to find such code, and could not conclude anything
about what any spammers did yesterday or will do tomorrow.

I don't see the point of such a forensic analysis.  This group is not
trying to convict a crook, fix a cause of death, figure out who did
what to whom, or any of the usual reasons to "[apply] scientific
knowledge to legal problems"
http://www.m-w.com/cgi-bin/dictionary?book=Dictionary&va=forensic

Better is to 
  - discover the nature of the environment,
      Does AOL automatically blacklist IP addresses after a bunch
      of bad recipients?
  - figure out the resulting pressures on spammers and spamware,
      Bad entries in target lists hurt spammers that want to hit AOL.
   - predict the results of those pressures,
      Spammers will tend to honor 550s if they like hitting AOL.
   - check of that prediction.
      Do few, some, or many spammers that like hitting AOL honor 550s?

The code I wrote yesterday is related to the code I'll write tomorrow
only by my style and general interests.  If I hear of a good idea,
I'm likely to apply it.  I often abandon code and ideas that seemed
good yesterday in favor of new code because of new ideas, changing
requirements, or mere boredom.  There's no obvious reason why spammers
don't do the same.

Still, if you want spamware, there's plenty available.  No great
sleuthing is needed.  Ask one of the people in news.admin.net-abuse.email
who spends time talking to spammers for an introduction to the "bulk
barn" and similar forums, and then blandly ask for software, without
mentioning why you want it.  I'd probably start by asking
[email-masked].  Steve Linford might also have some valuable
pointers.  Or check the Spamhaus and Sapient Fridge's spamware sites
listing; see http://www.spamfaq.net/spamfighting.shtml#halls_of_shame
Or look at the ads for spamware you get with
http://groups.google.com/groups?q=spamware+list+group%3A*abuse.email

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Barry Shein <[email-masked]>
Date: Fri, 30 May 2003 19:00:38 -0400

I suppose the quickest way to get some small measure on this question
of to what extent spammers remove addresses on 5xx codes is to
honeypot some addresses, wait a while until they're being spammed, and
then begin returning 5xx codes for them and see if it makes any
measurable difference in the traffic.

The hard part there is "honeypotting" in a meaningful way soas not to
overly bias the sample.

I'll guess it'd take a few weeks to run such an experiment full cycle.

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD
The World              | Public Access Internet     | Since 1989     *oo*
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg