Linux Format forums

Re: Oh soo fed up of spam

Bl�tann — Tue Jul 04, 2006 7:33 pm

Author: Bl�tann

Posted: Tue Jul 04, 2006 7:33 pm

I may flag something aready written in this thread but has anyone mentioned viruses?
As a lot of modern viruses is designed to make zobies out of pc�s so that they can be abused by some hacker.

I once read something on the net about a hacker renting out hes botnet of about 100.000 pc�s (zombies) for about $100.-/hour
A spammer will gladly pay to use these machines as a cluster of spam machines.

Thereby there is actualy a risk sending an email to a friend with a possible vulnerable machine.
If the machine is compromised your message may be picked up and inkluded in a spammers list.

Acording to "How stuff works" the mail lists is sold on cd�s as "spam free" addresses, that is people that have agreed to receive spam(!)

It does not matter how good you hide your address, the virus or spyware compromised pc�s of your friends will give it away.

Viruses or spyware often runs it�s own smpt server and may send messages in the background.
Thereby, neither IP or the senders address is caracteristic of a spam message.

Re: Oh soo fed up of spam

nelz — Wed Mar 29, 2006 10:11 pm

Author: nelz

Posted: Wed Mar 29, 2006 10:11 pm

I know, I was merely pointing out why it is not suitable for sending out mass mailings.

Re: Oh soo fed up of spam

CJLL — Wed Mar 29, 2006 6:11 pm

Author: CJLL

Posted: Wed Mar 29, 2006 6:11 pm

nelz wrote:

Limnits on the lengths of headers mean Bcc: can only be used to send to a fairly small number of addresses, whereas listing then in the SMTP envelope is limited only by the mail server (some have limits to prevent their being used for spam).

BCC is an e-mail client convenience, and not a SMTP feature. Your e-mail client still issues a RCPT TO: command regardless of whether the address is in the To: Cc: or Bcc: header.

It it up to the receiving mail server or client to be discrete and remove the other recepients. Not all of them do, so be aware.

Re: Oh soo fed up of spam

nelz — Wed Mar 29, 2006 9:29 am

Author: nelz

Posted: Wed Mar 29, 2006 9:29 am

The techniques used are somewhat different in that case. Try replying to a few phishing mails for a more compatible form of mugging...

Re: Oh soo fed up of spam

TheDoctor — Wed Mar 29, 2006 1:10 am

Author: TheDoctor

Posted: Wed Mar 29, 2006 1:10 am

Quote:

Spam is basically mailing lists without you needing to take the trouble to subscribe

lol

Like being mugged is basically a money transfer without you needing to contact your bank...

Re: Oh soo fed up of spam

nelz — Wed Mar 29, 2006 12:45 am

Author: nelz

Posted: Wed Mar 29, 2006 12:45 am

Limnits on the lengths of headers mean Bcc: can only be used to send to a fairly small number of addresses, whereas listing then in the SMTP envelope is limited only by the mail server (some have limits to prevent their being used for spam). Spam is basically mailing lists without you needing to take the trouble to subscribe, the same distribution methods are used for both.

Re: Oh soo fed up of spam

TheDoctor — Tue Mar 28, 2006 11:24 pm

Author: TheDoctor

Posted: Tue Mar 28, 2006 11:24 pm

CJLL, that's interesting. It explains some puzzles I've had about the headers in spam I've received. They've not made sense, and your explanation shows how this can happen.

Of course, our explanations are not mutually exclusive, although I can see how a serious spammer could cover his/her tracks much more thoroughly by your method.

Re: Oh soo fed up of spam

CJLL — Tue Mar 28, 2006 7:05 pm

Author: CJLL

Posted: Tue Mar 28, 2006 7:05 pm

TheDoctor wrote:

wyliecoyoteuk wrote:

Some that bother me are ones sent to hxxxxxxx@blueyonder.co.uk
where xxxxxxx is a nonsense string, eg ham3fxdy, but still gets to my email address (hxxxxxx2@blueyonder.co.uk, name changed to protect the guilty)

That's because they put your actual address (and those of other victms) in the BCC: field.

Nope, this is because the actual receipients and the headers you see in your e-mail client are set differently.

This is an example of a SMTP conversation with sendmail:

Code:

telnet localhost 25
Trying 127.0.0.1...
Connected to localhost.localdomain.
Escape character is '^]'.
220 localhost.localdomain ESMTP Sendmail 8.13.4/8.13.4/Debian-3sarge1; Tue, 28 Mar 2006 18:46:07 +0100; (No UCE/UBE) logging access from: localhost.localdomain(OK)-localhost.localdomain [127.0.0.1]
HELO localhost

first of all, introduce yourself using the HELO command

Code:

250 localhost.localdomain Hello localhost.localdomain [127.0.0.1], pleased to meet you
MAIL FROM: test@localhost

Then tell the MTA who you really are. Ok spammers lie at this stage, but a well configured mail server will check that the domain exists.

Code:

250 2.1.0 test@localhost... Sender ok
RCPT TO: cjll@localhost
250 2.1.5 cjll@localhost... Recipient ok

Now tell it, who you are sending it to using RCPT TO. You can do a whole bunch of e-mail addresses here.

Next comes the information that your mail client will actually look at, after the data command:

Code:

DATA
354 Enter mail, end with "." on a line by itself
To: Fred Bloggs <freedy@bloggs.com>
From: Leet Haxor <leet@example.com>
Subject: This is fun

The MTA will add some data about the route the mail message has taken to be delivered, but usually most of the info will be untrustworthy.

Your mail client will treat everything before Subject: as a header, so you add as many wierd and wonderful headers as you like. The MTA doesn't care.

Code:

Hi

This haxoring is fun!

.
250 2.0.0 k2SHk7m8005877 Message accepted for delivery
QUIT
221 2.0.0 localhost.localdomain closing connection
Connection closed by foreign host.

Finally, send a full stop on it's own to indicate that the message is finished and say goodbye.

Re: Oh soo fed up of spam

TheDoctor — Mon Mar 27, 2006 9:35 pm

Author: TheDoctor

Posted: Mon Mar 27, 2006 9:35 pm

wyliecoyoteuk wrote:

That's because they put your actual address (and those of other victms) in the BCC: field.

BTW I've got SpamBayes running and, while I get a lot of spam to my PC, I hardly ever see any of it. A marvellous product and much better than letting some third party decide what I can or can't receive.

Re: Oh soo fed up of spam

godofthedevil — Mon Mar 27, 2006 12:54 pm

Author: godofthedevil

Posted: Mon Mar 27, 2006 12:54 pm

ive tried emailing isps before but the trouble is that some ips are from places that dont speak or understand english for they know or care your offering them a naked woman and to assissinate their leader and help the freedom fighters.

the spam for software i get is in my yahoo box and it says what is 0em (zero em) and whats it about from about 20 diffrent email addresses. but if i took the time to look at the headers they would come more or less from the same geographic locatation

Re: Oh soo fed up of spam

shifty_ben — Mon Mar 27, 2006 12:23 pm

Author: shifty_ben

Posted: Mon Mar 27, 2006 12:23 pm

With regards to the ISPs taking some responsiblity, it sounds like that is part of the argument being used by At&T et al in the states to try and allow congress to let them charge differently for the internet. The fact that Yahoo and others is allowing companies to pay for email to avoid their spam filters is terrible, I know they have strict rules about spam etc. but as anyone who has TPS or MPS will know there is always some kind of unsolicited phonecall/mail that falls just outside the category that gets blocked. Same is likely to be true with this.
Think for now as the influx into my main account is currently quite small, im going to do an nslookup on the source IP of every bit of spam I get, and email their ISP with the details, hopefully enough people will end up doing something similar, and it will be more cost effective to deal with the issue than to deal with the emails, letters and calls. Its a while away yet though i think.

Oh and I've started getting the same thing daily

Buy photoshop, XP, Office now!

One can't help wonder if they are a) legal copies and b) whether they are in fact not just blank cds

One day this madness will end

Re: Oh soo fed up of spam

jjmac — Mon Mar 27, 2006 10:40 am

Author: jjmac

Posted: Mon Mar 27, 2006 10:40 am

"right"

jm

Humpty Dumpty Was Pushed !

Re: Oh soo fed up of spam

godofthedevil — Mon Mar 27, 2006 8:18 am

Author: godofthedevil

Posted: Mon Mar 27, 2006 8:18 am

do you think its wrong or right of me to report teenyspammers to report_spam@hotmail.com or abiuse@yahoo.co.uk for sending me chain mail?

the mood they make me i would wanna do something a lot worse if it was legal

Re: Oh soo fed up of spam

jjmac — Mon Mar 27, 2006 6:50 am

Author: jjmac

Posted: Mon Mar 27, 2006 6:50 am

I mean filtering on the tcp/ip headers, not the actual payload. But, the duty of care acceptance would leave isp's open to SCO type abuse anyway, so i doubt if that would ever be implemented.

jm

Re: Oh soo fed up of spam

Nigel — Mon Mar 27, 2006 12:36 am

Author: Nigel

Posted: Mon Mar 27, 2006 12:36 am

jjmac wrote:

I think isps' need to provide "point of departure" filtering. That is, if the return address on a pkt dosen't match its' origin then it should be blocked. For pkts that actually originate from that isp, not routed/in route pkts.

That would cause me severe problems. The ISP we use at work is different from the one I use at home, and neither will allow you to use their SMTP server unless you are connecting via their dialup/ADSL lines. So when I'm working at home I send email through my home ISP's SMTP server with a return address pointing to the company's ISP.
Even worse, my private domain is not hosted by my home ISP - again I use my home ISP's SMTP server for outgoing mail and my domain host's POP3 server for incoming mail - the filtering you suggest would cut me off completely !