Off-Topic for VMS - Spam

[Art Wiens]

I looked at the list of available forums but none seem to apply.

I'm wondering if "the rest of the world" is receiving a preponderance of just plain "junk" email (or is it just me :-( ).

They may or may not have a subject line and the displayed sender-name is random characters @ some domain which may or may not be real or random as well. There is no message body. If one looks at the email headers they come from a variety of sources - mostly hotmail.

What is the point of these (making the assumption that there is some point to spam)? Is it some test to see if recipient email addresses are valid ... so I can then be further spammed by other poorly written messages hawking "cheap meds" or "cheap warez" ?

Happy New Year,
Art

[Uwe Zessin]

Over the last years I have received a few mails of this type through the INFO-VAX mailing list, but I have always ignored them. So far I have managed to keep my business account quite clear, phew ;-)

It might be a test for address validity, denial of service attempt or simply an incompetent 'script kiddy', who knows?

If you really like information about meds and warez, hey, I can set a forward from my DECUS Munich account to yours ;-)

[Craig A Berry]

If there's an attachment, it's probably a virus spreading itself, but it not, then you're probably right about spammers just running a test. They may well be testing open smtp relays rather than any specific address so your in-box may just be a collateral damage site.

[Art Wiens]

I'm just curious why they exist? They must provide some value for the sender ... or it's really just electronic "litter" ?

Any "black hats" out there want to clue me in?

Art

[Robert Gezelter]

Art,

The world is full of gullible people. SPAMmers essentially rely on the very small percentage of people who respond. Since internet connectivity is so inexpensive, the normal economic controls which constrain bulk postal mailers do not work well (Bulk solicitations through the post typically have a response rate in single percents, the cost of producing the mailing is non-trivial, so marketers are careful about their mailing lists.

As some signature lines say, "100% recycled electrons". The cost of sending SPAM is orders of magnitude lower than physical mail, thus the hit rate to make it useful is correspondingly smaller.

There have also been reports of people using SPAM for other purposes, but that is a whole other story.

Suffice it to say, there are several precautions you can do, depending upon your SMTP software:
- require domains to be valid
- check the Real-time Black Hole lists (RBL)
- use anti-SPAM analyses software (however, you need to be careful, a newsletter sent to 20 people in the firm can be mis-labeled as SPAM, and cause problems. This can also happen when memoranda have large CC lists).

I do not recommend that people reject attachments, while they are frequently nasty, they are also often real data). My preferred solution is to use a mail reader which does not automatically open attachments.

- Bob Gezelter, http://www.rlgsc.com
Author of an upcomming chapter on the history and evolution of Email

[Art Wiens]

Sorry, I just realized that my request might make it seem like any further responses would be coming from "black hats". I intended no such thing...maybe you just know someone who owns a "black hat" ;-)

My apologies,
Art

[John Gillings]

Art,

In the arms race style escalation between spammers, virus & worm writers and purveyors of virus scanners and spam filtering software (which the cynics amongst us suspect may be the very same people!), there are many places that filtering is performed.

Your messages with no text body and no attachments may have had content stripped off at any of the gateways or firewalls that the message has traversed, with or without an indication that anything has happened.

Another possibility is they're a plot by the ISVs to increase your bandwidth consumption so they can charge you more?

Or, they're from victims of people selling get rich quick using email schemes. "Give us money and we'll give you software to send emails which will make you money...", but the suckers don't comprehend that without a way to get back to them, there's no way to make money, and if there IS a way to get back to them, in some countries they can expect an early morning door knock from the Police for contravening communications laws.

[Willem Grooters]

Art,

Happy (spam-free...) New Year as well, to start with.

I wouldn't consider this "off topic" because you can take precautions easily, as I found out.

I have the luck that the mail server in my domain is a VMS box (7.3-2, TCPIP 5.4 ECO4) and that gives me quite lot of control what to block:
- any publicly "known" spam source.
- any site (that you specify) you do not want to receive mail from because _you_ consider it a source of spam and other unsollicited messages. Either a specific address, or a whole group, or domain!
- any unknown (random) "domain" - quite likely to be SPAM (or testing...)
- relay attempts for other sender than your own domain (that's the way my ISP tests my server each week...)
- unintended (internal) use (for instance, when breaking in into you Wireless)

You can configure it that it will just disconnect. To te sender it will look like the source does not exist.
Not that you're freed from their attempts, but you won't see them in your inbox - but you will the attempts in operator.log, if you wish.

The fun line: This is all STANDARD. You only have to configure it. So why rely on an external mail server if you can block at least the big lot? Or just use the ISP as a backup if messages are blocked for one of those reasons.

There are even additions possible.
Karl Zielonko (at HP) has ported Spamassasin to VMS and that may be able to filter out any spam (on sender address, subject and (probably) content), I still have to give it a try. (it's written in PERL).

Willem

[Art Wiens]

John:

"... the arms race ..."

Exactly, these messages have to have some reconnaissance value.

Willem:

"I wouldn't consider this "off topic" "

Sadly it is, I was whining about the messages in my Exchange/Outlook Inbox and I (thankfully ! ;-) don't administer that world anymore.

Oh well, Shift|Delete always solves the problem.

Thanks,
Art

[Art Wiens]

And sometimes maybe they're just designed to make you smile ;-)

-----Original Message-----
From: Crocker@doneasy.com [mailto:Crocker@doneasy.com]
Sent: Thursday, January 06, 2005 9:08 PM
Subject:


---------------------
Received: from user-0cetd7d.cable.mindspring.com ([24.238.180.237]) by fwb; Thu, 06 Jan 2005 21:04:43 -0600 (CST)
Received: (from @24.238.180.237) by .148.133.74.248 (.[2
X-Sybari-Space: 00000000 00000000 00000000 00000000
From: Crocker@doneasy.com
Bcc:
Return-Path: Crocker@doneasy.com
Message-ID:
Cheers,
Art