Subject: Re: [Asrg] Please critique my anti-spam system

From: "Michael Kaplan" <[email-masked]>
Date: Mon, 10 Jan 2005 02:06:09 -0500

> >> > Let's do the math.  A spammer finds 5% of his spam reaches people.
> >> Way high.
> >
> > Define reach. Hit the disk or eyeball? Sorry if I'm behind here.
> > I think MORE reaches people.
> 
> Hits the eyeball, since disks don't buy stuff.
> 
> We'd have to get good estimate from someplace like AOL.
> 
> Also, a lot of place block at the IP level, so the spam never gets in
> to the spambox in the first place.

I would like to correct my math.  If I may quote from my own website:

"Email service providers will continue their practice of blocking the bulk of email that is suspected of being spam even before it is accepted.  Bounces are never sent to this vast amount of probable spam that is rejected at edge."

One member of this list estimated that 90% of spam was eliminated at the
periphery, before content filtering occurs.  Spam sent with a valid sub-address
will still be subjected to this blocking.

Also there is really no limit to the number of bogus email accounts that could
be fed to spammers.  I mentioned a 2:1 ratio of bogus account to real accounts.
If this isn't enough then how about a 10:1 ratio?  Conventional thinking is that
spammers don't care about bogus address - but now they will.

I would also reiterate the impossibility that a company can exist in the developing
world that would decode CAPTCHA for a legitimate company (Paypal, Amazon, etc.),
then also sell the same decoded list spammers, and expect to keep that
company's business for more than a week.  It would become INSTANTLY obvious that
the company was dishonest when every decoded address is then flooded with spam.
Also remember that a company such as Amazon is not paying to decode billions of CAPTCHA
a year, they would likely only need to decode less than 100,000 (and they are an
enormous internet company).  100,000 addresses wouldn't even approach the daily needs
of a spammer.

A lot is being made of the concept that with a decoded address a spammer can send
you an enormous amount of spam in a single day.  The spammer would much prefer to
send you 1 spam every day than 300 on a single day.  I would much rather receive
an enormous amount of spam once every few months than receive a little bit each day.

Michael Kaplan

-- 
_______________________________________________
Find what you are looking for with the Lycos Yellow Pages
http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.asp?SRC=lycos10

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Devdas Bhagat <[email-masked]>
Date: Mon, 10 Jan 2005 13:22:29 +0530

On 10/01/05 02:06 -0500, Michael Kaplan wrote:
<snip>
> periphery, before content filtering occurs.  Spam sent with a valid
> sub-address will still be subjected to this blocking.

I don't think you really understood my point. There is no way that large
providers can profitably filter out such large spam volumes with content
filtering. Could you provide numbers on the spam volume your Lycos mailbox
gets?

> spammers don't care about bogus address - but now they will.

How about a 1% _delivery_ ratio being good enough? I have heard claims
that as many as 50% of email addresses in a spammers list are bogus.
They just send out twice as many mails.

<snip>
> an enormous amount of spam once every few months than receive a little bit each day.

I would rather not recieve any spam at all, but since that isn't going
to be possible without giving up on email/moving to a pure whitelist, I
would choose the little bit daily. 

Wading through an inbox full of spam is far more irritating then hitting
delete a couple of times (I have the additional effort of adding the
source IP to my access.db, or complaining about the spammer). The last
time I got flooded with spam was when the encrypted zip archive
mailbombs occured, I just blocked all of ARIN space except my regular
whitelisted servers for a week and kept a very careful eye on my logs.
This luxury is simply not available to people not running their own
personal servers.

Devdas Bhagat

---

From: Laird Breyer <[email-masked]>
Date: Mon, 10 Jan 2005 17:45:47 +1000

On Jan 10 2005, Michael Kaplan wrote:

> I would also reiterate the impossibility that a company can exist in
> the developing world that would decode CAPTCHA for a legitimate
> company (Paypal, Amazon, etc.), then also sell the same decoded list
> spammers, and expect to keep that company's business for more than a
> week.  It would become INSTANTLY obvious that the company was
> dishonest when every decoded address is then flooded with spam.

Where else but the developing world would you send the CAPTCHAs for
decoding? Nowhere in the developed world can you offer decoding at 0.1
cent per CAPTCHA.

Figure $5 per hour minimum wage, at 10 seconds per CAPTCHA, that's 
a pure labour cost of slightly more than 1 cent per CAPTCHA. Add in other
expenses, frequent pauses, mistakes etc and probably 3 cents / CAPTCHA is
a basic developed world estimate.

Given this huge difference in cost, the fact that decoded addresses are
being resold is largely irrelevant. Who is going to offer a competing
service and take away their business? 

Moreover, companies in the developing world are usually quite safe
from legal attacks originating in the developed world. So it's easy
money. You really have to make sure the decoded CAPTCHAs are useless
if you want to stop them being sold.

-- 
Laird Breyer.

---

From: Seth Breidbart <[email-masked]>
Date: Mon, 10 Jan 2005 03:44:41 -0500 (EST)

"Michael Kaplan" <[email-masked]> wrote:

> One member of this list estimated that 90% of spam was eliminated at
> the periphery, before content filtering occurs.

You don't get to claim that and 5% deliverable; content analysis is
much better than 50%.

> Also there is really no limit to the number of bogus email accounts
> that could be fed to spammers.

Since they're stealing CAPTCHA'd addresses, somebody is paying for the
bogus ones.

> week.

Maybe they'd gather them for 3 months before spamming.

And the spammers would set up 50 "competing" businesses, so when you
cancel one, who do you go to next?  The next one of theirs?

>  It would become INSTANTLY obvious that the company was dishonest
> when every decoded address is then flooded with spam.

What happens when they're smarter than that, and only some get spam,
perhaps in a way that points to somebody else?

> Also remember that a company such as Amazon is not paying to decode
> billions of CAPTCHA a year, they would likely only need to decode
> less than 100,000 (and they are an enormous internet company).
> 100,000 addresses wouldn't even approach the daily needs of a
> spammer.

Guaranteed deliverability is a big thing.  Divide that by the fraction
that are delivered now, and see how big it looks.

> A lot is being made of the concept that with a decoded address a
> spammer can send you an enormous amount of spam in a single day.
> The spammer would much prefer to send you 1 spam every day than 300
> on a single day.

Maybe; but the address won't stay good for 300 days, so he has more
like 300 seconds to fill your inbox.  That would likely be for 300
different spams.

Seth

---

From: Bill Cole <[email-masked]>
Date: Mon, 10 Jan 2005 09:50:23 -0500

At 2:06 AM -0500 1/10/05, Michael Kaplan wrote:
>"Email service providers will continue their practice of blocking
>the bulk of email that is suspected of being spam even before it is
>accepted.  Bounces are never sent to this vast amount of probable
>spam that is rejected at edge."
>
>sub-address

I'm getting the impression that you have essentially no practical 
experience running any mail system of significant size.

The 'sub-address' model is a whitelisting mechanism. It has been used 
this way for many years. Its use that way is one element of the suite 
of tools that makes possible the envelope-time rejection of  large 
quantities of spam. Anything which exposes more sub-addresses to a 
larger audience and expands the use and awareness of a standard 
sub-address pattern weakens the model and weakens the ability to shun 
so much spam before seeing anything but the envelope.

In short: you can't rework a part of what is now providing a 90% skim 
rate and think you will not directly change that rate.

>spammers don't care about bogus address - but now they will.

That does not make any sense. It is inconsistent with the history of 
spam. Spammers have a solid record not only of not caring about 
validity, but of running brute-force and dictionary spam runs. A 
standard for tagging that is more widespread than the classical 
sendmail pattern and known to be used by specific addresses would be 
hit the same way just as domains with obvious address patterns (e.g. 
fistname.lastname@domain) get hit now with dictionary attacks 
following the patterns. You are suggesting that spammers in the 
future will not behave as spammers have in the past and are behaving 
in the present. It's not rational. It's not SANE.

>the developing
>company's business for more than a week.

It doesn't take a week to sell a bogus list to a fool, and harvesters 
have been successfully doing that for years. Repeat business is not 
necessary, as the continuing stream of new garbage to old bogus 
addresses here proves. The fools come in some interesting forms too. 
Anyone in the US who has some older domain registrations probably 
knows from their mail in the past few weeks that such foolish 
companies as American Express buy years-stale lists of names and 
addresses that no one should have been selling them for any reason, 
even when the data was fresh and valid.

>  It would become INSTANTLY obvious that

So what?

If this was a problem, most of the ROKSO spammers would long be out 
of business.  If it were a problem, Network Solutions would not have 
been selling their list of domain tech contacts for years.

>billions of CAPTCHA

You are displaying your naivete. Amazon has been spamming me for 
years. I've never been a customer of theirs and never will be. For 
some reason they think that a role account that was used on my domain 
registrations through 1997 wants their spam. 95% of what they've sent 
gets rejected in SMTP, but every time they switch spam-for-hire 
providers they stand some chance of getting a piece through.

Go ahead and tell me how Amazon cares about the validity of addresses 
they spam. I know that's a lie.

>spammer can send

Again, not consistent with reality. You are assuming rational 
strategic behavior on the part of spammers as a population, and that 
simply is not how they have behaved or do behave and it is useless to 
assume that they ever will behave that way. The fact that spamming 
seems to correlate well to business failure and legal problems 
(Wallace, Rines, AGIS, Jef Slaton, Jason Vale, Worldcom, Enron, Davis 
Hawke, ...) is a clue that spammers and the people who do business 
with them have a tendency to screw up long-term planning and behave 
in ways that manage to violate the law even without spamming being 
illegal. It is no accident that today's Big Spammers are almost 
entirely people with felony convictions in their past (and in some 
cases, probably more to come...)

Here's a data point for you regarding the specific issue of whether 
spammers will choose deluge addresses. In the past 5 days I've had a 
significant dip in the efficiency of my spam controls, and 39 pieces 
of spam have made it to delivery on my most heavily-spammed address 
(the one in my .sig...) Those 39 messages have 12 unique bodies. 4 of 
the bodies have been sent in 5 copies or more. 2 of those seem from 
my logs to have been offered many dozens of times (i.e. offered from 
similar senders on a handful of IP addresses) over periods of 1 and 2 
days, with the copies that arrived having been early ones hitting 
before  various spam control methods started catching them.

Frankly I think it is very sad that after a decade of experimentation 
in the field and 2 years of the ASRG, the only thing keeping this 
list active is a debate over the details of yet another sweepingly 
naive and hopelessly unworkable FUSSP.

-- 
Bill Cole
[email-masked]