Subject: [Asrg] 2a. Analysis - Address Harvesting - Chain Letters

From: Yakov Shafranovich <[email-masked]>
Date: Tue, 02 Sep 2003 14:16:31 -0400

This CNN article 
(http://www.cnn.com/2003/TECH/internet/09/01/spam.chainletter/index.html) 
discusses a possible tactic used by spammers to collect email addresses - 
chain letters.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Andreas Saurwein <[email-masked]>
Date: Wed, 03 Sep 2003 01:04:16 -0300

>discusses a possible tactic used by spammers to collect email addresses - 

... and then there was the hope that all the mails with the valuable 
address information "somehow" comes back to the spammer, right?

IMHO this theory is totaly unreasonable - when the spammer is not included 
in the replies, there is not much hope that they will ever receive these 
mails. Except, of course, when they are caught off a mailserver.

Or am I missing something here?

Cheers
Andreas

---

From: "Christopher Bird" <[email-masked]>
Date: Wed, 3 Sep 2003 07:05:50 -0500

This does seem a little strange. When I get a chain email, I am usually
asked to send it to several friends and include the sender. The sender
is often someone that I know (well, of course that isn't quite true -
more likely it is an email address that I recognize).

Now how does the spammer get me harvested as a result of this? I am not
exactly sure. Either they sent it to me in the first place, so the
sender/reply to was spoofed, so when I forward and include the sender,
they get another 5 or 10. Hardly seems worth it, and because they are no
longer anonymous, they can be subject to attack by me or be blacklisted
or whatever.

So, it appears to me as if the article doesn't pass the "sniff test"
(used for milk - if smells OK it is OK!).

While chain letters are annoying, I don't (yet) see real harm.

Chris

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Yakov Shafranovich
Sent: Tuesday, September 02, 2003 1:17 PM
To: [email-masked]
Subject: [Asrg] 2a. Analysis - Address Harvesting - Chain Letters

This CNN article 
(http://www.cnn.com/2003/TECH/internet/09/01/spam.chainletter/index.html
) 
discusses a possible tactic used by spammers to collect email addresses
- 
chain letters.

---

From: [email-masked]
Date: Thu, 4 Sep 2003 02:16:48 -0400

On Wed, Sep 03, 2003 at 01:04:16AM -0300, Andreas Saurwein wrote
> IMHO this theory is totaly unreasonable - when the spammer is not
> included in the replies, there is not much hope that they will ever
> receive these mails. Except, of course, when they are caught off
> a mailserver.
> 

## Begin quote
Email Bug Threatens Privacy

A relatively simple bit of coding can make email messages vulnerable to
spying.
By Jack Karp

A security loophole in many email programs is being publicized by the
Privacy Foundation in an effort to prevent email snooping.

In an advisory dated February 5 (2001) and posted on the Denver-based
organization's website, the group warns that the loophole "allows the
sender of an email message to see what has been written when the message
is forwarded with comments to other recipients."

Privacy Foundation executive director Stephen Keating told CyberCrime
that the loophole allows potential spies with access to a Web server to
intercept and read all the replies and forwards sent in connection with
an email message and to see a recipient list. 
## End quote 

  The full story, and details of the exploit, are at...
http://www.techtv.com/cybercrime/privacy/story/0,23008,3310007,00.html

  Note that only one recipient needs to have javascript enabled in email
(bleagh!!!) and the spy can see that one message, and get all the
recipients off it.

-- 
Walter Dnes <[email-masked]>
Email users are divided into two classes;
1) Those who have effective spam-blocking
2) Those who wish they did

---

From: Kee Hinckley <[email-masked]>
Date: Thu, 4 Sep 2003 09:13:59 -0400

>Now how does the spammer get me harvested as a result of this? I am not

I don't see it as being very useful for formal collection of 
addresses.  On the other hand, some of those forwarded messages do 
end up on bulletin boards and the like, so stripping out the 
addresses is always a good idea.

Of course the article takes the "never open it" approach, which is 
not real useful.  Right up there with "don't trust attachments from 
strangers" which still seems to be bizarrely repeated in the press as 
though those were the only things that were dangerous, despite the 
obvious fact that viruses tend to come from *friends*.
-- 
Kee Hinckley
http://www.messagefire.com/          Anti-Spam Service for your POP Account
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.

---

From: "Eric Dean" <[email-masked]>
Date: Thu, 4 Sep 2003 16:36:18 -0400

Now that I've gotten past the subject line encoding method...does anyone
out there in asrg-land want to demonstrate a crude interoperability of
CRI?  I know that Earthlink has already begun marketing their service
(though I know of no one on the list from Earthlink)..does anyone else
have a CR implementation sitting in a lab they can extend?