Anti-spam techniques?

Hi all. Yes, I'm a newb. I consider myself to be more informed than the general population in regards to computer sciences, but obviously not an expert.

I would like to know if it is possible and if so, how, to find spammers/phishers. I am sick of getting spam, and am on a mission to find the *******s who are sending it to me and bring them to court.

I realize that some of you may be involved in spamming/phishing yourselves. All I can say is that I hope you aren't sending it to me, because I am determined to find every single person who is sending me this crap and sue them! That being said, I'd appreciate any/all help on the subject.

I am sure there is a way to find someone's contact information even if all you have is a fake email address... Is it possible to figure out what IP address the individual was at while creating an "anonymous" email? If you could figure that out, can't you find their physical address, name, phone number, etc with that info?

There MUST be a way to find these guys...

Thanks in advance for any help.

Quote:

---

I am sure there is a way to find someone's contact information even if all you have is a fake email address... Is it possible to figure out what IP address the individual was at while creating an "anonymous" email? If you could figure that out, can't you find their physical address, name, phone number, etc with that info?

---

No, there isn't..................most of this stuff comes from compromised machines that are part of a botnet. Even if you could find out the the true IP address it would not lead you to the real sender.

The rest probably goes through anonymous proxies. Spammers certainly do not use their own equipment to send spam.

Also, the information you mention would not be divulged by the ISPs unless you are a law enforcement agency.

If you are sick of spam perhaps you should ask yourself how they got hold of your e-mail address? ;)

As for suing them...................what makes you think that they operate within your jurisdiction?....................botnets know no frontiers.

I can't believe that it's impossible to track down this info. Everything you do online leaves a trail. Even I know that. I'm sure it isn't easy, but there HAS to be a way to follow that trail back to the original source.

And I don't believe that EVERY spammer is some kind of evil genius. Besides, if they're sending you information about an actual company, there HAS to be a way to at least track down the contact info for that company. I'm fairly certain that it's possible to bring the company to court in the place of the individual who actually sent the email, because they are acting as a representative of the company.

Am I wrong/naïve for thinking any of this is possible? Or does anybody here really care to help me at all?! lol

Welcome to AO. :)

nihil made a good point by saying:

Quote:

---

Also, the information you mention would not be divulged by the ISPs unless you are a law enforcement agency.

---

You could possibly track one of these emails back to the infected computer that is sending them, ask the people at that house if you can take their personal computer for your own inspection, run wireshark on it for a few days/weeks, and wait for the C&C commands to come through to it, then log into that IRC channel [if they are using IRC for C&C], try to get the bot masters IP address, contact that ISP [probably in Russia or China] and ask them who was using that IP address at that time, which may be a university computer, or something like that... Then go and get that computer, check the logs to see if someone had accessed it without permission, or if the person was actually sitting at it at the time... If they accessed it without permission, you would have to get the address they were coming from, and then start that process over. If it was someone actually at the [most likely] public computer, you could see if there are cameras, and then try to get the government to run facial recognition scans on the person... or it could have been a wireless cafe, and you could hope that the person didn't spoof their MAC address while they were using the free wireless... then track down the vendor, and find out who they sold that particular network device to... probably dell or lenovo... then call Dell, find out what system it was put into, and I am sure they will hand you the information on the person that purchased it. Then you can go and beat them with a sock full of quarters.

Or, you could get a better spam filter.

Just sayin' ... :)

Quote:

---

Am I wrong/naïve for thinking any of this is possible?

---

I am afraid so. Look at it another way? spamming is illegal in many countries, but how many arrests and convictions do you see? If law enforcement agencies can't do it with all their statutory powers and resources, how can an individual hope to?

Quote:

---

I'm fairly certain that it's possible to bring the company to court in the place of the individual who actually sent the email, because they are acting as a representative of the company.

---

How do you prove that they were authorised and that it wasn't just the work of a rival trying to cause trouble? Plausible deniability?

Quote:

---

I can't believe that it's impossible to track down this info. Everything you do online leaves a trail.

---

Yes, but can anybody follow it?................if I use a compromised private computer the answer will be "no", particularly if I go through a daisy chain of proxies that don't keep logs.

If somebody compromises your machine and plants a spambot that fires off its crap then self-destructs, will you be any the wiser..............in a word, "no" ;) You may well see some circumstantial evidence that it was there, but that's about all.

The best way to deal with spam is to avoid getting it. For example if you belong to a social networking site don't put your e-mail on it, or your website for that matter. Use a separate e-mail account to subscribe to websites etc.................

Incidentally, do you think that you are the only person in the World bothered by spam...................if it were feasible to do something about it, you can bet that someone would already have done so?

EDIT:

Quote:

---

And I don't believe that EVERY spammer is some kind of evil genius.

---

In which case why don't they get caught? Actually I believe there are different levels in the spamming "industry":

1. Those who pay to have the spam sent.
2. Those who compromise machines.
3. Those who manage the botnets' actual spamming operations.

#2 & #3 would be the evil geniuses

The best way to deal with it is to use emails such as hotmail, which have a setting that only allows emails from your contacts to reach your inbox. All the other free emails I'm aware of allow spam to get through, except that one. Not a single piece of spam, ever.

The anonymity of the web and the global nature of it makes it impossible to hold spammers accountable. The best we can do is, if we know anyone personally who visits or buys from a web site that spammed them, beat them senseless. They're the real culprits. If there were no profit margin in it, it wouldn't happen.

I don't mean to sound like a jerk here, but...

It seems like you guys are just polishing your knuckles here... I'm sure you're all very confident in your abilities as hackers, or whatever you want to call yourselves, especially as a community. I'm sure all these crazy techniques you guys are talking about that spammers/phishers use to scam people are all very impressive.

So, what you guys are essentially saying is that either you think these techniques you describe are completely flawless, or that you just don't have any idea how to do what I'm talking about?

Again, I'm not trying to be a jerk. I'm just calling it like I see it. I realize that the purpose of all the techniques you are describing were developed specifically to ensure anonymity (or at the very least "plausible deniability"). I'm sure it took a long time to discover and perfect all these techniques. I'm also sure that it is more interesting to people to try to do these types of things because of the lure of excitement/profit.

Are you telling me that nobody thinks there's ANY money to be gained by figuring out how to trace these idiots, or that there's not enough glamor involved in cracking these puzzles for it to be considered "worthwhile" by most "hackers?"

I tell ya what... I'm a quick learner. I'm dedicated to this concept. I may not be independently wealthy, by any stretch of the imagination, but I do know that there is money to be made, and that developing a technique to find the people who do this would get SOMEONE at LEAST fifteen minutes of fame.

So here's my call to all you technical geniuses out there who love a challenge and aren't too busy working on "less-than-ethical" projects: Let's get together and hack the hackers!

Oh wait... I'm not going to post any personal contact info here! lol

Whatever. Thanks, anyway...

Quote:

---

Originally Posted by JPnyc

The best way to deal with it is to use emails such as hotmail, which have a setting that only allows emails from your contacts to reach your inbox. All the other free emails I'm aware of allow spam to get through, except that one. Not a single piece of spam, ever.

The anonymity of the web and the global nature of it makes it impossible to hold spammers accountable. The best we can do is, if we know anyone personally who visits or buys from a web site that spammed them, beat them senseless. They're the real culprits. If there were no profit margin in it, it wouldn't happen.

---

I hereby officially nominate this response to be considered the best yet!

Thank you for your thoughts!

I'm a bit of a spaz sometimes, so I'll probably just forget about this in a day or two, but it still pisses me off immensely. I posted an advertisement for services on craigslist, and the only responses I got were all spam. Luckily, craigslist anonymizes your email, so I don't have to worry about any more spam now that the post has been taken down. I actually have a fake email address that I use specifically for signing up to questionable sites. It's "hahafakeemailaddressforspam@[a free email provider].com!" lol

The majority of spam isn't sent out by the people that want it sent. The majority of it comes from zombie machines who aren't even aware they're being used for that purpose. Spammers control huge networks of such zombie machines worldwide. You can trace them if you want but it's just going to lead to some stooge who's not even aware it's going on.

Quote:

---

Originally Posted by JPnyc

The majority of spam isn't sent out by the people that want it sent. The majority of it comes from zombie machines who aren't even aware they're being used for that purpose. Spammers control huge networks of such zombie machines worldwide. You can trace them if you want but it's just going to lead to some stooge who's not even aware it's going on.

---

So, the real fix is to convince Microsoft to fix all the crazy security issues with Windows, convince everybody with a computer that's connected to the internet to use Tor, and develop (unless one already exists?) an open-source firewall program that prevents machines from being susceptible to these kinds of attacks, which you would have to then convince everybody (or at least a good chunk of people) to use it?!

Sounds good! Let's get started... haha

@ JPnyc:

Sure that will work, but do you need to have the contact set up first. That could be a bit limiting if you get an e-mail address from a mutual aquaintance for example? I am afraid I am rather lazy and wait for an incoming mail before setting up a contact record.

Another problem with that would be like I had down the local bar last night (why is it none of you seem surprised at that?:halo:). A friend asked me for advice on some applications for his new Windows 7 box..............this being his first PC at home, and I think he uses XP at work.

I said I would look at my Win 7 machine and get him a list of what I used and the links to it. He gave me his new (top secret) e-mail addy. Now, if he had a contacts only system and didn't realise the implications, I would send him an e-mail that he wouldn't get?...............question is: would I get a failed delivery message, or would it just fall into a black hole?

Not a great issue as I suppoose we will both be in the bar again shortly, but it could be a problem with a more sporadic or casual aquaintance?

I am more inclined towards westin's suggestion of a better spam filter. One of the mail providers I use (Yahoo!) seems to have a quite efficient one.........I end up retrieving about 90% of it, because it isn't spam as such. Sure it is "unsolicited", but is from outfits that I have dealt with or their business partners.

Hey! if I have done business with someone and they don't tell me about new deals they have going, I am not a happy bunny......customer loyalty? what about supplier loyalty?. That said, it is an account I use specifically for that sort of thing.

I guess I just don't get much true spam, if any...........but I will only give a regular e-mail addy to a personal aquaintance or an outfit I would trust enough to send money to ;)

Which takes me back to my earlier question: have you considered why you are receiving this spam?

Quote:

---

The best we can do is, if we know anyone personally who visits or buys from a web site that spammed them, beat them senseless.

---

Not if the item was ladies panties..............pre-filled of course :lildevil:...........I'd want the URL :D

Now, to move the thread on: I really don't see a solution in the short term.

Like a lot of internet problems, it stems from the fact that it is the WWW (World Wide Web) encompasses all sorts of regimes and cultures. We really only have pretty widespread agreement on a few fundamentals such as fraud and child pr0n?

JPnyc has the fundamental answer............ if nobody bought from a spam ad then there wouldn't be a point in them, and they would stop (other than for ladies panties, as previously mentioned:cool:)

Looking at spam (other people's) I note that most of it is either sex, drugs or get rich quick. Many of them are probably totally fraudulent???

Unfortunately there are some very sad and desperate people out there, and I have read that it only takes a very minute fraction of responses to make the exercise economically viable?

I do feel that ISPs are currently shirking what I would consider to be their responsibilities in this area. To hell with the RIAA and MPAA...........they should find a business model that doesn't come from the 1960's............ the ISPs should be made to take a more proactive role in real issues.

They are quick enough to "throttle" traffic when it suits them, so they can spot a spamming zombie if they wanted to, and stop it?

Anyone got other ideas or comments?

Quote:

---

Originally Posted by nihil

I do feel that ISPs are currently shirking what I would consider to be their responsibilities in this area. To hell with the RIAA and MPAA...........they should find a business model that doesn't come from the 1960's............ the ISPs should be made to take a more proactive role in real issues.

They are quick enough to "throttle" traffic when it suits them, so they can spot a spamming zombie if they wanted to, and stop it?

---

I think you hit the nail on the head here, nihil. Although, I think it should be Congress that does the regulating (I know, I know... This isn't a libertarian think-tank, so let's leave our political views aside for a moment, please!). Obviously, protecting consumers is NOT on the top of ANY corporation's to-do list. I don't think we could expect ISPs to do anything even slightly effective towards the end we seek.

On the other hand, the good ol' guvment could at least pass some kind of right-to-know law (or something to that effect) with regards to contact information of companies/individuals - that operate within the U.S., at least (we ARE talking about the U.S. here... right?!) - who are suspected of using anonymous domain hosts and the like for the sole purpose of defrauding people.

Let me make this clear: I use Tor to browse the internet anonymously (Well, most of the time. Let's face it, YouTube is just too good to pass up...). I also run a Tor relay, so that I can help other people do the same. I'm a big fan of anonymity, as opposed to being forced to share your information with whoever feels like finding it. And I'm totally against the government telling people what they can and cannot do with their time, so long as what they choose to do does not hurt anybody.

However, I don't think that people who choose to exploit that freedom and use it to victimize other people should enjoy any protection at all whatsoever, and I think they should be exposed to the public to allow their victims an opportunity to pursue litigation against them if they so choose. I think it is extremely obscene that the government allows these people to operate freely, either through lack of concern, or lack of resources. If we can find Saddam in a whole in the ground, we can find Joe Hacker in his mom's basement.

Start by getting a list of all male purchasers of Proactiv, maybe?! j/k...:D

Quote:

---

Originally Posted by human errer

So, the real fix is to convince Microsoft to fix all the crazy security issues with Windows, convince everybody with a computer that's connected to the internet to use Tor, and develop (unless one already exists?) an open-source firewall program that prevents machines from being susceptible to these kinds of attacks, which you would have to then convince everybody (or at least a good chunk of people) to use it?!

Sounds good! Let's get started... haha

---

One other issue that has not been pointed out yet is, you think that you can just rely on a technical solution for all this. Blame it all on software/hardware. One of the main issues though, that can NOT be fixed easily is user awareness and use education. A very lot of spam could be avoided if people were educated, the normal users, the victims of said zombie machines.

Like Nihil pointed out:

Quote:

---

If you are sick of spam perhaps you should ask yourself how they got hold of your e-mail address?

---

This is a very valid point.

Back to subject:

This example too can be categorized as a user issue. There are many ways to 'avoid' spam, but for this to work, people need to learn and change their ways. While non of the solutions are favourabale (such as posting email addresses like bla[AT]bla[dot]com), or using more advanced captcha, etc...) they do their part in avoiding spam. For this to be more effective though, EVERYONE would have to start using their computers that way which is merely impossible.

I for example have way more than 1 email account, most of them I use for spam possibilities, such as when i sign up to various sites on the internet. Another solution would be those temporary online email services, where you just register a temporary email for 30 minutes, then that account gets erased again. Good enough to receive just 1 email from a public site if that is all you want from them.

In short, there is not reliable technical solution. Most technical solutions do their fair amount of spam filtering, but it is annoying, since a lot of legit emails do get lost in there once in a while.

Now to actively make a difference in the fight against spam, many things are needed. Things that not everyone has or can obtain too easily. Some examples would be:

- Alot of time on your hands.
- Advanced knowledge on computer security, as it would involve setting up various honey pots to collect data that would assist you in your fight against spam.
- ISPs need to work with you, as mentioned above, they would be able to block out zombie machines that are spamming.
- Money.

I remember some years ago, Captain Crunch visited us here on AO, and there was an interesting discussion about fighting spam. Unfortunately i can not seem to find his website anymore (shopip[dot]com).

You want to make a difference out there? Start by spreading the word on how to avoid getting spam. On how to avoid falling victim (basic security 101 rules for average users, such as dont open email attachments from unknown people, dont visit sites/links from people you dont know, all that stuff that you would tell your kids about using the internet etc...). That would be more effective than waiting for a software solution.

Cheers.

Quote:

---

One other issue that has not been pointed out yet is, you think that you can just rely on a technical solution for all this. Blame it all on software/hardware. One of the main issues though, that can NOT be fixed easily is user awareness and user education. A very lot of spam could be avoided if people were educated, the normal users, the victims of said zombie machines.

---

I agree entirely, and would add that you also need motivation. We have a saying over here: "You can lead a horse to water, but you can't make it drink". I am afraid that there are a lot of people who would subscribe to the theory and then go and do exactly nothing about it :(

Back in the mid-1990's in the UK, people typically used a 28.8/33.6Kbps dial-up modem connection. The most common billing option was pay-as-you-go via your phone bill.

People used the internet differently then, as you read and composed e-mails offline and only logged on to send and receive. I had a bit of software that put up a list of mails I was about to send and wanted a password to let it happen. :)

A retrospective method was looking at your sent mail, as you would pretty soon see if you had a problem.

OK, the spammers quickly graduated from hijacking your mail client and packaged their own with their spambots. People were rather more concerned and motivated back then, as there were also "dialers" that connected you to premium phone numbers.:eek: $$$£££

My point is that it cost you personally, so you took more care and were motivated. BTW we didn't have free local calls in the UK back then.

Today we live in a World of "always on, always connected" broadband, and nobody seems to care anymore? presumably because they don't perceive any tangible cost to themselves.

Another point regarding technological solutions is that as soon as one is created the bad guys work like hell on a workaround, so it is a never ending battle.

I must say that I find it rather disappointing that so many corporate and institutional machines show up in lists of spambot zombies. They should have the staff with the knowledge to put a stop to most of it? There certainly seems to be a lack of care and motivation here?

I do believe that a very powerful tool against spam would be deep packet inspection. This would be fine for private and institutional machines, but as soon as ISPs start to use it, it raises massive privacy issues?

I do have software that warns me if a previously unauthorised program tries to access the internet, or when some things actually do (update checkers etc.)

The problem with that sort of software is it annoys a lot of people (Vista UAC anybody?) and most of the rest just go "clicky, clicky", or turn it off :rolleyes:

Perhaps fining institutions that let their systems be zombified and send spam would help send a message? I really don't think that a lot of them have much excuse?

Incidentally, in my previous comment on the structure of the spamming industry I forgot to mention one of the player groups: the harvesters. These guys have spider bots that crawl the web and gather e-mail addresses.

That explains your Craigslist experience, and that of quite a few of my customers. They run small hotels, guest houses and holiday flats, so their e-mail address is on various trade websites and holiday guides. They get loads of spam. Occasionally they will get a corrupted one that screws up their e-mail so they call me out to fix it.

Hey! I guess that makes me a beneficiary of the spamming industry? :D

Oh "human errer" you have much to learn, young Jedi.

Finding and suing the spammers is impossible next only to getting Microsoft to fix security issues....

In one case, you'd have to travel to the organized crime dens in Russia, Ukraine, and pretty much all the other countries on the planet (for a good read on the subject, get: "Fatal System Error" by Joseph Menn). In the other case, well, join the rest of the crowd...

Lets put it this way, I'd rather talk to someone who actually writes software for a living as opposed to someone who's just going to foward it through mailing lists then wait a year while morons speculate over it "HuRr DuRRRr... I don't think this effects my distribution. DuR!"

Edit: Also, that super-dooper secret internet crime ring is ebaumsworld.com

Quote:

---

Originally Posted by human errer

I would like to know if it is possible and if so, how, to find spammers/phishers. I am sick of getting spam, and am on a mission to find the *******s who are sending it to me and bring them to court.

---

LOL

As ridiculous as this sounds, I guess I can't make that much fun of this thread considering this dude making more bank than any of us here http://tinyurl.com/4bopxkx

Quote:

---

AN FRANCISCO - Daniel Balsam hates spam. Most everybody does, of course. But he has acted on his hate as few have, going far beyond simply hitting the delete button. He sues them.

Eight years ago, Balsam was working as a marketer when he received one too many e-mail pitches to enlarge his breasts. Enraged, he launched a Web site called Danhates spam.com, quit a career in marketing to go to law school and is making a decent living suing companies who flood his e-mail inboxes with offers of cheap drugs, free sex and unbelievable vacations.

"I feel like I'm doing a little bit of good cleaning up the Internet," Balsam said.

---

you'd think with a million dollars he'd have a better website :rolleyes:

Its better simple and poorly designed.

If he'd delve to far into web based scripts I might be tempted.

Quote:

---

Originally Posted by The-Spec

Its better simple and poorly designed.

If he'd delve to far into web based scripts I might be tempted.

---

yeah, you and every spammer he's sued, lol. good point.

Quote:

---

(for a good read on the subject, get: "Fatal System Error" by Joseph Menn)

---

- great recommendation;it gives lots of insight.

I actually found 'Fatal System Error' to be kind of dull. I stopped reading with about 20-30 pages left. I might pick it up again sometime. On the other hand, I have found Kevin Poulsen's book 'Kingpin' to be fantastic. I am only about 70 pages in, but so far it has been a hard one to put down.