Bouncing - a bad idea in general?

cmling · Guest

I think that is what the consensus here appears to be? (Then why is it included in MailWasher? I thought it was a nice idea.)

Charley

Ikeb · Posted: Mon Feb 09, 2004 7:54 pm Post subject:

Dunno what this has to do with FA! .... But as to your question, I suggest it's because it was a good idea to reduce SPAM (back when SPAMers kept their own lists and it paid to keep them clean).

Times are different now but FireTrust seems to be doing the ostrich thing, perhaps because this was the "flagship" feature of MW in the past.

Hopefully someone from FireTrust will give us the official reason they still promote it as a SPAM reduction strategy ....

stan_qaz · Posted: Mon Feb 09, 2004 11:25 pm Post subject:

Marketing != Reality

Maybe quietly downplaying it a bit more in each new release would be a good way to go.

Even better would be an automated reply message that the user could configure to say whatever they wanted.

AbdLomax · Private Joined: Mar 10, 2004 Posts: 35 Location: USA

I've written elsewhere about this, but bouncing a la original Mailwasher is a pretty bad idea. A few percent of the spam I receive is now bounces from mails I did not send, and many of these bounces are essentially misinformation.

I agree that a user-configurable autoreply is an excellent idea, I'd probably use it, but the default should be no bounce at all; autoreply would be one option among what happens when mail is processed. In fact, there should be more than one possible autoreply. Basically, if something is clearly spam, it is a waste of resources to reply in any form. But if there is a remote possibility that the mail was legitimate, a notification is appropriate. If this can be automated, it becomes much safer to conceal mail for automatic processing.

The real bad idea, and I haven't seen much written on this, is automatic blacklisting. Mailwasher was (is?) configured to automatically add SpamCop-tagged mail to the local blacklist. Very bad idea. First of all, it catches very little spam. Maybe 1% of my spam, when I had such a local blacklist running, was tagged by the blacklist. IP-tagged mail (i.e., SpamCop) has a record of tagging a small percentage of legitimate mail, typically an AOL user whose server was temporarily on the SpamCop list. With autoblacklisting, that user would get added to my local blacklist. Not good. When I killed my huge blacklist it had almost no effect on spam identification.

Here is what I consider a proper use for a local blacklist: I set a spamtrap address on my web site. Mail to that address is nearly certain to be from a spammer. So mail to that address gets the sender added to my local blacklist, and possibly other things get done with it automatically (such as reporting it as spam). However, what if the From address was spoofed? I would definitely want a message to automatically go to the From address with instructions as to how to get removed from the blacklist -- and apologies for the trouble.

Ikeb · Posted: Tue Mar 16, 2004 11:48 am Post subject:

AbdLomax · Private Joined: Mar 10, 2004 Posts: 35 Location: USA

It was written:
"Sure you could send an apologetic letter but the next SPAM from the same SPAMer has a new forged address."

I think the proposed process has not been completely understood. No wonder, when I read the response, my own first reaction was, "Right, that would be useless."

Let me restate the conditions under consideration here. I would set a spamtrap on our web site, a visible address that has some warning text near it saying "DON'T send mail to ." This would be picked up by the bots that search for email addresses, and spam would be sent to it. That spam could be autodelected, no problem. However, I'm monitoring at least five different addresses, several of which are quite public. I've noticed that a new spam often goes to all the addresses, with the same From header. I'm assuming that much of the spam I get to one of the spamtrap addresses would similarly be accompanied by spam to the real addresses found on the same web page. So I'd like to automatically add to a local, short-lived blacklist the source of mail to a spamtrap address. This is easy to do in Mailwasher. But because of spoofing, it is quite possible -- if rare -- that the address added would be of a legitimate mailer being spoofed. So I want a warning to go out.

"So there you are sending apologies to all those innocent saps who, unbenounced to them, had their address forged."

I already get tons of those every day. Now, address forgery is, in the U.S., a federal crime with rather serious penalties. Since spammers do want to sell something, usually, there are ways that spammers who forge from addresses could be prosecuted. It is a more serious crime than that of merely sending unsolicited mail. This may not be very practical at the moment, but is very much a part of what could be done in the future.

"Meanwhile, you have no effective anti-SPAM measure in place since the next address will seldom be the same one."

Hmm.... it depends on whether or not spammers send blocks of mail using the same From header. If they do, the scheme I described would block more spam than it creates. (It creates spam by creating another address that spammers can find and send mail to; however, the spam is trivial to identify, so it would not create a burden for me as a user. The question is whether or not it would catch some additional spam.) However, a better use for a spamtrap would be fast reporting. There is one case where auto-reporting of spam might make sense: mail to a spamtrap address. I think this is already being done to some extent, but any of us with a public web site could set up a spamtrap address. If it met certain standards, it would be quite appropriate to allow mail to the trap to be autoreported.

If such autoreporting were set up at the server level, now *there* would be a fast spam detector. Remember, the faster spam can be detected and confirmed, the fewer people need to see it.

With the First Alert system, this would be particularly effective because it would provide fresh meat for the content analysis and tagging machine.

This is how it could work. I can set on my mail server that mail to a particular address will be autoforwarded to anywhere. So a spam address would be set up. Send spam to this address to have it automatically analysed and added to the spam database. Of course, how spammers might attempt to gum up the system would need to be considered; so some kind of confirmation would still be needed. But the intial reporting would be fast, it could be a matter of seconds from the first spam message going out. Then the mail would go into queue for administrative review. If in the meantime a report from a validated user who has looked at the mail coming in arrives, and the content matches what has just been autoreported from a spamtrap, that would be sufficient to add the mail to the database. At that point one would have a presumptive sign of spam (mail to a spamtrap) plus a human verification that the spam content was not innocent. In order to defeat this system, the spammer would have to grab some legitimate mail and send it to the spamtrap (not difficult, though it involves identifying the spamtrap as such, i.e., it involves a human looking at that web page) *and* have set up a user who has been validated in order to report the spam. Getting a user validated would involve time *and* money. So it would cost the spammer to attempt to gum up the system. If the First Alert system is such that damage from false positives is limited (which could be done if warning messages are sent), then the cost to spammers would exceed the cost to the rest of us. Not a situation they will like.

Pancake · Posted: Tue Mar 16, 2004 8:51 pm Post subject:

There is always the option to turn it off should the user so desire.

AbdLomax · Private Joined: Mar 10, 2004 Posts: 35 Location: USA

stan_qaz · Posted: Tue Mar 16, 2004 11:39 pm Post subject:

AbdLomax, there has been a bunch of bouncing discussion in these forums, you might want to look it over and see if you like any of the other suggestions that have come up. Your user configurable message seems to be one of the most popular ones but making sure the address isn't forged is a real problem otherwise we are just beating up on the poor sucker that got joe jobbed. Check out the discussion of mailblocks (?) on the spamcop groups for a bad implementation.

Ikeb · Posted: Wed Mar 17, 2004 1:59 am Post subject:

Yes! I second that request! Abd, your assessment of the bounce discussions to date would be most welcome and appreciated.

AbdLomax · Private Joined: Mar 10, 2004 Posts: 35 Location: USA

Ikeb · Posted: Wed Mar 17, 2004 11:39 pm Post subject:

Hear! Hear!

BTW, please, more details regarding:

rusticdog · Posted: Thu Mar 18, 2004 6:49 pm Post subject:


	Home ˇ Topics ˇ Submit News ˇ Top 10 This entire site, Cops Themes, and Computer Cops are Š 2002 - 2004 Computer Cops, LLC. All rights reserved. You can syndicate our news using the file RSS 0.91, ultramode.txt, or RSS 1.0. Acceptable Use Policy. Use signifies your agreement. Engine Copyright Š 2002 by PHP-Nuke, GNU/GPL Licensed. ICRA Member. Paul Laudanski, Member of Computer Cops, LLC Server Load: 685 pages served in previous 5 minutes. Page Rendered: 0.546 seconds.