Subject: [Asrg] Spammers looking for sites that don't bounce?

From: Kee Hinckley <[email-masked]>
Date: Wed, 25 Jun 2003 22:50:54 -0400

On another mailing list (still waiting for permission to quote), 
someone running  an ISP made the following claim.

He says that if he sets up his mail server to blackhole spam instead 
of bounce it, the spammer shortly shifts to a different IP address 
with slightly different text.  He claims they are seeding the spam 
with known bad addresses, and if they don't get back a failed status 
from the SMTP server, they know that their spam is getting trapped by 
filters.

I don't have any idea what methodology he's using, and without a good 
control group to compare with this could be just a case of seeing 
lots of spam.  However conceptually it makes sense.  It's the inverse 
of checking for bounces on valid addresses, and it would allow a 
spammer to fine-tune their message to get through filters.

Can anyone confirm this?
-- 
Kee Hinckley
http://www.messagefire.com/          Anti-Spam Service for your POP Account
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Wed, 25 Jun 2003 21:10:36 -0600 (MDT)

> From: Kee Hinckley <[email-masked]>

> ...

As stated, that makes limited sense, because it is based on the
assumption that filters reject spam.  In fact many filters silently
discard, or rather, in effect like with a 250-OK SMTP status.  Consider
most procmail recipies.  Yes, the possibility of false positives urge
filters not lie, but that's not always possible (e.g. usually not with
procmail)and many people prefer to not leak information about their
filters to spammers.

There is a related scenario that makes more sense.  Contributors to
NANAE have reported that some spammers use almost certainly bogus
addresses (e.g. 15 random letters) to determine whether an SMTP server
lies about bogus addresses.   If a server answers "no such user," then
throwing a dictionary of 50,000 common user names at it will yield a
bunch of "confirmed" addresses that can be sold or spammed later.  If
not, then such a dictionary attack is a waste of time.

Vernon Schryver    [email-masked]

---

From: [email-masked]
Date: Wed, 25 Jun 2003 18:00:58 -0700 (PDT)

I can confirm this. They are using 10+ random names for email at the known 
isp domains with more then one name like that used. Very similar attempts 
happen from both blackholed ip blocks and from other ip blocks. I'v so far 
found two of these correlations in the logs and its not easy to notice it.

This is yet another technique spammers use to prepare for mass mailing 
when they have multiple servers and want maximum effectiveness.

---

From: Kee Hinckley <[email-masked]>
Date: Thu, 26 Jun 2003 00:26:19 -0400

>assumption that filters reject spam.  In fact many filters silently

I think you misread what I said.  I said that they are specifically 
looking for NON-rejected messages to fake addresses as a sign that 
mail is being filtered out without being bounced.
-- 
Kee Hinckley
http://www.messagefire.com/          Anti-Spam Service for your POP Account
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: "Chris Lewis" <[email-masked]>
Date: Thu, 26 Jun 2003 17:20:21 -0400

Kee Hinckley wrote:

> looking for NON-rejected messages to fake addresses as a sign that mail 
> is being filtered out without being bounced.

You couldn't prove that by my spamtrap.

It accepts everything, but doesn't forward anything anywhere.

The daily volume is going up very quickly (it's > 2 million/day now).

There are some very stupid dictionary scanners (one day 7+ million 
probes by an IP in singapore.  Next day another few million from another 
IP  in singapore. Rinse, lather and repeat.)

---

From: Barry Shein <[email-masked]>
Date: Thu, 26 Jun 2003 17:23:52 -0400

I suppose anything that can be programmed is possible.

But one also has to be careful of that effect whose name I forget
where people see patterns in random noise.

As I've reported here before spammers often use over a hundred
hijacked computers nearly simultaneously spewing the same basic spam
(including variations, but I mean for the same "client", the same
basic come-on.)

So for example if they were streaming by on your screen you might
notice that when you raise you right hand, they switch to IP addresses
with at least one prime number in the quad, but when you raise your
left hand, they switch back to non-primes, etc.

It's a common effect and at least one to watch out for.

Also, anthropomorphizing the data, a similar effect, assigning intent
to what might be random behavior in the data.

Or maybe they're doing all this.

Or maybe he's being slammed by what appears to be spam from a clever
and malicious script-kiddie just trying to drive him bonkers because
he closed an account for non-payment or something.

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD
The World              | Public Access Internet     | Since 1989     *oo*