Subject: Re: [Asrg] Textbook example

From: Yakov Shafranovich <[email-masked]>
Date: Tue, 24 Jun 2003 12:01:25 -0400

At 02:14 AM 6/24/2003 -0500, [email-masked] wrote:

>Here's sorta a good textbook example of relatively common spammer 
>tricks.  Let's
>consider it:
>[..]

Out of the twenty spam messages I received this morning at one specific 
account, two were text based and not HTML as follows:

[quote]

2003 20:59:27 -0300
with SMTP; Tue, 24 Jun 2003 02:57:48 +1000
Message-ID: <5a8801c33a47$ac324310$bdb5b46e@xgwij>
Reply-To: "Monty Kambo" <[email-masked]>
From: "Monty Kambo" <[email-masked]>
To: [email-masked]
Subject: xfiles, register or renew any d0main names at a fraction the price
Date: Tue, 24 Jun 2003 04:56:40 -0700
MIME-Version: 1.0
Content-Type: text/plain;
         charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 5.00.2919.6700
X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2919.6700
Status: U
X-UIDL: 28547

Every extensi0n you want to register or renew is available here and it is
che@p.

Most popular:  .net  .info  .tv
Just released:  .club  .travel  .sport

Over 100,000 names registered so far.

http://www.domainsforpeople.com

T@ke me 0ff:
http://www.domainsforpeople.com/cgi-bin/off_list.pl

Thank you for visiting our site!

BduxcihhqmJk
SqxBpfacql

a1-2s
[end quote]

[quote]
with local; Tue, 24 Jun 2003 22:39:41 -0800
Message-ID: <c25501c33a57$d6ef5240$4b7b8c1b@txxasrceychr>
Reply-To: "Jim Turpin" <[email-masked]>
From: "Jim Turpin" <[email-masked]>
To: [email-masked]
Subject: you don't have to choose......................take a look at this
Date: Tue, 24 Jun 2003 05:52:23 -0800
MIME-Version: 1.0
Content-Type: text/plain;
         charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 5.50.4522.1200
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1200
Status: U
X-UIDL: 28550

Every extensi0n you want to register or renew is available here and it is
che@p.

Most popular:  .org  .info  .tv
Just released:  .club  .inc  .med

Flexibility to manage or move your name anytime without c0st.

http://www.domainsforpeople.com

I d0n't w@nt t0 recieve this anym0re:
http://www.domainsforpeople.com/cgi-bin/off_list.pl

Have a nice day!

OhsdWtubcaautj
NsifXswq

e3-ss2
[end quote]  

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Kurt Magnusson" <[email-masked]>
Date: Tue, 24 Jun 2003 17:23:05 -0200

Yakov Shafranovich wrote:
>At 6/24/2003, [email-masked] wrote:
>
>>Here's sorta a good textbook example of relatively common spammer tricks. 
>>Let's consider it:
>>chanty MycXY42jUmagernJQbgbHxg%3D%3D unselfishly o-eVm
>>{a href="http://[email-masked]/dtomi/";>
....
>account, two were text based and not HTML as follows:
..................
>Return-Path: <[email-masked]>
..................

Well, look at the two textbook examples from another
perspective, for they both tell us something else,
the end destination for the spammer, his/her domain.

This is real information, not fake (if it isn't a spammers
version of a DDoS). Skip the rest and use this. URL's need
to be correct to work, independent if a HTML or a ASCII
message. Some web coding of the address is common, but
normally simple to decode when analyzing the incoming,
but if there does not say "http:" it would not work.
It is a bit worse with base64, yes.

Anyway, with a limited number of spammers and most likely
a limited number of domains this is useful. Vernon's list
the other day had more in common with my own list, than
should be expected, since he had far more web-shops in
his list, while I have more web-sites and 50% from Asia.
Of some 7-8000 entries in both lists, 2.500 where common.
If there is a "infinite" number of spammer domains, it
should have been less.

Unfortunately the HTML discussion above as such is redundant.
Most of us sits in a world where we have to service others
with a mail service, for better or for worse. When doing that
we have to remember some simple things:

1. The users want a simple-to-use service

2. They have a reason for using email instead of mail

3. Mail they don't want is always spam, even if we
   don't think so

4. Mail we label spam, is not always spam in their
   eyes

5. What we thing is appropriate as a mail format does
   not have any bearing what so ever on these users
   They want to do tables, they want to do bold and
   (how horrible it may be) they want to use Outlook
   b'cause Oncle Bill included it for automatic install
   in Windows. I.e. they want a function without thinking
   even if it is at a risk for their PC

6. They do not want to change their e-mail address

7. They want to reach their mail when on holiday or
   at work (a webmail interface)

8. They do not want to see any strange mails that require
   them to answer a question or so to communicate with
   rich Auntie Agatha.

In short, they want us to cut spam automatically, so they
do not need to bother. And we can't change this.

On the other hand, spammers (I exclude the DDoS types)
want to:

a. send us ads/web pages that get us to visit a web site
   with a sales pitch

b. to call a phone number to talk with a sales person

so they get the traffic and earn money from it.

What we think about spam is irrelevant, it is what our
customers and the spammers think that is important.

If we avoid this focus, we are never to be able to get
anywhere. I seem to remember that the charter says
something about to create a common "ground" before
"solving" the issue.

Well, where is this common ground, mostly I see complicated
solutions, requiring a lot of either client or MTA changes,
but little common ground. Look at the above, we
canl never fulfill every users expectation, but we need
to find some simple common principles about spam, that
is OK for everybody (excluding the spammers), what is
usable to handle the issue at hand.

The basic definition must therefore be: "Spam is a form
of electronic marketing, where the receiver not asked
to receive it and also stands for the main part of
the transmission cost".

This accounts both for the guy not wanting spam, as
well as the "Shopping Channel"-guy, loving spam. They
have not asked for it and they do pay for the main
part of the cost, through their connection cost or ISP
charges. Going to a web page with ads, we do a active
action for. With spam we don't (except for sometime
have had released our address in a Usenet discussion, a
web page or registration at some function for free)

The second definition must be: "Spam is electronic
marketing, where the sender generally uses a
non-functional sender address as well as sometimes
including non-functional information how to end
sending". Really, opt-out is a joke. It didn't even
worked during Spamford's days.

The third definition is: "Spam is a sociological
phenomena, not a technological". Spam uses technology,
but this is only a mean, not the objective. It also
makes it harder to beat. Virus is simpler, since they
are the objective, even if they also is a sociological
phenomena.  Spam want _us_ to _do_ something.

The fourth definition, is what I wrote in the start:
"Spam do contain some information we can trust, as
a web address or phone numbers".

What can we get from this crap?

Well, the spammer want something in return from _us_,
for sending us that letter, that we go in to his/her
website / call the Call Center to purchase a product.

But the spammer is two entities, the owner of the
product and the sender (sometimes the same person).

If the spammer is the sender, he/she want to get paid
for every lead, his/her customer get from the action.

If the spammer is this customer, he/she want to have as
many leads as possible, because that increases the number
of sold products. If the seller don't get any leads,
the sender doesn't get any assignments, eg. we lose a
spammer.

The best way to cut the number of leads a seller gets, is
to take out the usage of the website address, i.e. a
website in a spam is included in the blocklist -> reduction
of leads, since no-one sees the address. If the seller change
address to get around, honeytraps collect it and include
it againg in the blocklist. Skip sender addresses and such,
concentrate on stabile content.

To use the problem's sociological features, as a base of
handling it, must be a better way than raw technology.

But those not having addresses/numbers, as Nigerians?

I just got such a letter, that succeeded to pass my filter,
it did have a phone number in it. Nigerians also rely on
two-way communication, they can't change mail address in
the middle of the communication with the target, therefore
their addresses usually is very functional for a longer
time. That nigerian was the first I got to my test
mailbox for 3 months, though some 10-15 ended up in the
spambox and those was taken on their sender domains,
collected before february.

And if done correctly, a likely solution should also required
low infrastructure impact, if run as a Milter type of filter,
as an added benefit.

Kurt Magnusson

(Leads is what the marketing whizzes calls when they get
a confirmed contact with a potential customer.)

_________________________________________________________________
STOP MORE SPAM with the new MSN 8 and get 2 months FREE* 
http://join.msn.com/?page=features/junkmail