Subject: [Asrg] News Article - CONFESSIONS OF A FORMER SPAMMER

From: Yakov Shafranovich <[email-masked]>
Date: Sun, 11 May 2003 13:47:50 -0400

Take a look at this SlashDot story:

http://yro.slashdot.org/yro/03/05/11/1648253.shtml?tid=126&tid=111

which refers to this Oregonian article:

http://www.oregonlive.com/business/oregonian/index.ssf?/base/business/105256787116000.xml

---------------------------------------------------------------------------------------------------
Yakov Shafranovich / <[email-masked]>
SolidMatrix Research, a division of SolidMatrix Technologies, Inc.
---------------------------------------------------------------------------------------------------
"One who watches the wind will never sow, and one who keeps his eyes on
the clouds will never reap" (Ecclesiastes 11:4)
---------------------------------------------------------------------------------------------------  

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Sun, 11 May 2003 16:23:43 -0600 (MDT)

> From: Yakov Shafranovich <[email-masked]>

> ....

While reading that article, remember that sort of spammer is more than
anything else a pathological lier that cannot tell the truth, but that
thinks that it can always fool all of the world all of the time.
Nothing in that article is novel to anyone who has a few technical
clues, has seen some spam, and thought about tactics for pumping it
out.  Every bit has been mentioned many times in the favorite newsgroup
of spammers (and spammer fighters), news.admin.net-abuse.email.  It's
hard to say which of his statements in that article are partly true
and which are pure nonsense.  I suspect there is wishful thinking in
some of the technical bits.
 
You might learn about liers and lying by listen to that sort of spammer
(if he's really a spammer and not a wannabe), but you won't learn
anything about spam that you can't find from far more reliable sources.

    ]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]

] From: Yakov Shafranovich <[email-masked]>

] ....
] Section 10.3.2 of RFC 2026 states as follows:

] ...
]
] Now we are not creating documents on the standards track but nevertheless, 
] I think we need to clarify the patents/intellectual rights issues 
] surrounding C/R systems. Perhaps we should solicit a comment from 
] MailBlocks and the IRTF/IETF?

RFC 2026 is not binding on non-participants.  It's not even clear how
binding it is on participants.  Consider the court battle over the
Rambus patents.  See http://www.google.com/search?q=rambus+court

   }}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}

} From: Yakov Shafranovich <[email-masked]>

} ...
} In the same vain, we can also have some tool look at outbound email at 
} alert the user with a similar message when too many "spam-like" emails go 
} through. Some kind of an outbound spam filter, although I am not aware of 
} any in existence.

Several recent statements seem to suggest that ISPs can easily look
at the outbound email of their customers.  That is true only of users
that do not send much email of any sort, spam or not, because they
use the sending MTAs of ISPs.

It's not impossible to sample some of the mail of users who buy
raw IP bandwidth and run their own sending SMTP clients, but it's
not exactly easy.  You can can use packet snoopers or SMTP interception
proxies, but only if your terms of service allow (lest you violate
federal law) and only if your users don't use use SMTP-TLS with
properly shared certificates.

At least one well known ISP was at least at one time using a private
set of DCC servers and clients to detect unauthorized outbound bulk
mail and automatically squelch it in mid-spew.  That works only when
the mail is funnelled through the ISP's computers.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Barry Shein <[email-masked]>
Date: Mon, 12 May 2003 16:00:29 -0400

> some of the technical bits.

I agree 100%, and would add that the telling parts are where he keeps
saying how he avoided this or that behavior because that would be
illegal.

Yeah, right.

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD
The World              | Public Access Internet     | Since 1989     *oo*
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Art Pollard <[email-masked]>
Date: Mon, 12 May 2003 16:21:23 -0600

>http://www.oregonlive.com/business/oregonian/index.ssf?/base/business/105256787116000.xml

While reading the article you posted, my attention focused in on the open 
relays / open ports that he was using.  And while I have known for a long 
time that this was a method used by spammers, I hit upon an idea.

If the spammer is using the open ports / relays without the knowledge or 
permission of the owner of the system and had the sysadmin of the system 
being abused known they would have stopped the use of their system for 
spamming, then it opens an interesting legal approach.

The spammer should in this case be able to be prosecuted under the
anti-hacking statutes.  And with the Patriot Act the consequences of
"hacking" are very severe (though they were already.).

I called my State Attorney General's office and they seemed to agree
that this would be an interesting approach and would be well worth
following up with to see if it could be proved out.  I'll probably make a
few more phone calls to see if it is pursuable or not.

In either case, it is probably beyond the scope of this mailing list
but if a few spammers ended up in prison for using open relays and
mail ports, I wouldn't complain too much and it might go a ways
towards curtailing the abuse of other people's resources for sending
the spam at least.

-Art
-- 
Art Pollard
http://www.lextek.com/
Suppliers of High Performance Text Retrieval Engines.

---

From: Troy Rollo <[email-masked]>
Date: Tue, 13 May 2003 08:31:42 +1000

At 16:21 12/05/03 -0600, Art Pollard wrote:
>if a few spammers ended up in prison for using open relays and

Has already happened in Australia - a Melbourne spammer by the name of 
Hourmouzis was convicted for, inter alia, unauthorised relay that caused 
(temporary) impairment to the operation of the abused machines, based on 
unauthorised access and unathorised impairment offences. Unauthorised relay 
is also a civil trespass, at least in the case where it impairs the 
operation of the system and in most places even without such impairment.
--
Troy Rollo				Chairman, CAUBE.AU
[email-masked]			Executive Director, iCAUCE

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Mon, 12 May 2003 20:03:16 -0400

Other than the standing of the (developed and maintained for use by U.S. 
government agencies, Government contractors, and authorized personnel) system 
owner to bring an action under the Computer Fraud and Abuse Act of 1986 (USC
Title 18, Section 1030), aren't the fact patterns there.?

Why not just ask for an extension (US jurisdiction) of scope of the '86 act?