Subject: RE: [Asrg] define spam

From: "Nickle, Michael" <[email-masked]>
Date: Fri, 4 Apr 2003 11:01:48 -0800

At 1:12 AM -0900 4/3/03, Kee Hinckley wrote:
>At 8:06 PM -0700 4/3/03, Vernon Schryver wrote:
>>The disagreement concerns the existence of bazillions of people whose
>>free provider addresses are being forged into most spam every day.
>>I claim most of those people do not exist, unless you think using your
>>own address in spam is forgery.

>I don't think anyone has claimed that spammers are forging the 
>addresses of real hotmail users (at least, not intentionally).  The 
>claim is that they are using *fake* hotmail addresses.  But yes--a 
>few simple stats from Hotmail would resolve this argument.

I recently had my yahoo address "hijacked" by a spammer.  This proved to me
several things:  1)spam is getting more sophisticated, 2)spammers are
forging legitimate addresses (albeit unknowingly) 3) Yahoo's signup
mechanism is slowing signups for bogus addresses and 4)very few people reply
to spam.  I won't waste the groups time with lengthy descriptions for each
of these.  email me if you want details.

This being said, I think that the forgery problem has the potential to
become huge.  What if biffy the spam king decided to use ibm.com or doj.gov
as his source domain?  Would the repetition of such an event alter the UCE
problem?  I know that with the one(?) spammer that is using my yahoo address
as one of his/her source addresses, I've gotten ~1500 bounce messages in the
past 10 days or so.  A concentrated spam campaign using a specific source
domain could effectively cause a DoS against a small company that
administers its own mail.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Fri, 4 Apr 2003 12:54:29 -0700 (MST)

> From: "Nickle, Michael" <[email-masked]>

> ...

"They've been there and done that."  See
http://www.google.com/search?q=spam+%22flowers.%2Bcom%22

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Kee Hinckley <[email-masked]>
Date: Fri, 4 Apr 2003 16:26:20 -0500

>become huge.  What if biffy the spam king decided to use ibm.com or doj.gov

Potential?  I used to spend several hours a week doing nothing but 
dealing with the problems caused by forged return addresses.  Phone 
calls to my home-office line at 4 in the morning. DoS attacks in 
response to the spam.  Crashed servers due to all of AOL's servers 
bouncing it back all at once.  Threats to me and my family.... 
Fortunately the problem has died off as spammers have moved to using 
free-email services in their return addresses.  But it could very 
easily come back.

This isn't a new problem.

-- 
Kee Hinckley
http://www.messagefire.com/          Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Jon Kyme" <[email-masked]>
Date: Sat, 05 Apr 2003 10:00:23 +0100

> dealing with the problems caused by forged return addresses.

There are (at least) 2 classes of forgery that might need to be considered:

1. Fraudulent use of a valid identifier.
2. Invalid identifiers used without authority of the (what? "namespace"?)
"owner"

These distinct classes of "forgery" will have different problems associated
with them.