August 9, 2007
Dear friend,
Have you been dreaming of leaving work behind and taking a well-deserved vacation? Go ahead: Head for that romantic cruise or adventurous getaway. The moment is now! You've seen our pills on TV, in your local health stores, and on the Web, and the question you have been asking yourself is — do they really work? The answer is YES! WE have your casino winnings! Five hundred dollars NOW. Click the link! Click it!
Love,
Annoying Spam*
*Need I say more?
I haven't had a single spam in two years.
I use gmail for personal correspondence and have absolutely ZERO spam. At work, we use a service that prevents all spam as well. I haven't had spam in 14 months.
Why cannot the law enforcement follow the links in the Spam email and punish the benefactor of the Spam email?
I would happily sign up for a service that billed me a penny for every message that I send and would not let through any email that didn't pay the service a penny for every email they send me.
I've used computers for over 15 years, and I know when something looks 'spammy'.
How do I keep my loving, but computer challenged family from inadvertently opening spam that infects my computer? I have had to do three destructive restores in the last year alone to undo the damage, and they keep making the same silly mistakes! Can I teach them without sending them to night school?
Also, I suspect that Microsoft Updates cause intentional vulnerabilities, any comment?
I know the moderators mentioned this in passing, but "Denial of Service" Spam campaigns are already used as political attacks. When Estonia took down a statue of a Russian soldier (precious to Russian Estonians but disliked by native Estonians)
http://www.rferl.org/featuresarticle/2007/05/595ff9a7-b58e-4c63-b68d-9606c6d805f7.html
Russian sponsored spammers shut down Estonia's governmental websites as retribution for the Statue's removal. Turns out NATO has cyber-terrorism units. Spam, not just for ID anymore.
I have been using a freeware program called SpamBayes, utilising a Bayesian filter, after set up, and trained, it works well. I would recommend SpamBayes to anyone looking for a low cost alternative to stopping spam.
Apache is the most popular web hosting software (ala IIS) and has been so for many years. Apache does not have the security problems that Microsoft's IIS does.
We must remember to make a distinction between operating system security (unix, linux, MS, OS X, etc) and browser security (safari, IE, firefox, etc). On a secure system, the user is always prompted to enter a password before malware can even be installed.
I switched my email service to Gmail and I never get spam in my Mailbox! My work uses Outlook and I receive about 10 spam messages per day.
For years I have used a Yahoo account for general email and a different account for personal email. While I still get spam to Yahoo, most of it goes to the bulk folder and the stray ones are easy to delete. My personal email has not had spam in more than 2 years.
I am sitting in my air conditioned home where it's about 90 degrees outside knowing that next week I and 29 other overheated people will be jammed into my elementary school classroom where there is no air conditioning. You don't have to be outdoors to have a job that deals with oppressive heat.
Here's an idea. Why not ask Congress or the Bush Administration to set up secret "extraordinary spammer rendition" rendition program? We could send Special Forces troops into Russia, Romania, Nigeria, China, etc. to capture spammers and spirit them away to some super-secret CIA facility where they would be subjected to round-the-clock pharmaceutical ads piped into TV monitors plastered on every surface of their holding cells.
Better yet, why not forcibly administer the pharmaceuticals to them on a daily basis? That way the spammers could experience first-hand the myriad of unpleasant side effects listed in the ad disclaimers such as headaches, nausea, drowsiness, cramping, bloating, nose bleeds, erections lasting more than four hours or hopefully anal seepage!
After a few years of this treatment we could have the CIA release them back into the custody of their home government. The spammers could share their rendition experiences with other would-be spammers.
Since much spam is sent by zombie computers, the guest's practice of writing back to spammers that hawk Viagra is ludicrous as it won't be the sender.
I listened to your show about Spam. I was very disappointed in the knowledge level of your guests. The "expert" was a venture capitalist?! Those aren't the qualifications I'd look for to discuss a technical subject like email spam, virus propagation, and countermeasures.
The dismissing of Macs and Linux because they were not the market leader shows the the so called expert did not have sufficiently broad knowledge of the field.
Next time you address computer security, get a real expert. I'd suggest someone at the SANS Institute (http://www.sans.org/) or Carnegie Mellon University's Computer Emergency Response Team (CERT) at http://www.cert.org/.
Also, I cringed at the comment that Bill Gates was knowledgeable about software security. He is a business man who knows how to use illegal methods to perpetuate a monopoly, buy political influence, and lie in federal court without being held accountable. His predictions about the future directions of technology have been almost universally been wrong.
I believe that the federal "Can-Spam Act," signed into law with much fanfare by the Bush administration in late 2003, is directly responsible for the current avalanche of online scams and spam. This flawed legislation forces recipients to "opt-out" of email lists to which they may never have knowingly "opted-in." Detractors of Can-Spam argued that if it became law as written, the volume of spam and scams would grow exponentially. Corporate lobbyists won the day and, as everyone with an email address now knows, that's exactly what happened.
By contrast, a similar Australian anti-spam law took an "opt-in" approach and has been much more successful. Bulk emailers are forbidden from sending their pitches to anyone who has not specifically requested them. This keeps legitimate marketers in line and makes it much easier to find, prosecute, or ban criminals who engage in network abuse. Spam originating on Australian servers quickly dropped to a relative trickle and has remained among the lowest levels in any developed country. We could learn much from the Australian model.
To simply dismiss Can-Spam as a failure misses the mark. While legislation by itself cannot stem the tide, and while Can-Spam is currently worse than useless, that doesn't mean that legislation is useless. The vast majority of the world's spam originates in the US. It may be routed through offshore servers or open relays in China, Russia, Brazil and elsewhere, but the spammers are, for the most part, right here. Sadly, US ISPs have not been compelled to secure open network relays and legislators have yet to stand up against the telecom, marketing and lobbying interests who profit from an assault on the world's inboxes.
Shortly before Can-Spam became law, I was a guest on a TechTV segment about spam. Panelists on the segment included Conrad Burns (former U.S. Senator from Montana and a co-author of Can-Spam) and a representative of the Direct Marketing Association. I was invited to participate because my domain name had been "spoofed" to relay spam about an illegal online pharmacy by a convicted cocaine dealer. Last I heard, this creep is still running around loose in Florida.
A well-written law, with real teeth, would do much to bring the problem into the realm of manageable. As of today, I have 60,410 spam emails on file (since 2003). I report all spam I receive to Spamcop.net -- which takes about an hour of my time each day.
The Internet is easily one of the most important advance in human communication since the invention of the printing press. I encourage voters to contact their representatives demanding a review of Can-Spam. We do not have to resign ourselves to the prospect of living with it. Naturally, all spam would end tomorrow if nobody bought the garbage being peddled by spammers. But until the tiny minority of social pariahs who are either too stupid or too greedy to stop wrecking the net for the rest of us mend their ways, we have the right to expect and demand legislation that protects consumers instead of special interests.
I am in agreement with Bruce Dubbs's comments. To dismiss Linux and Mac security with the old-and-tired "security through obsucrity" argument shows a severe lack of knowledge of the operating systems. Even when corrected by Mr. McCullagh, Mr. Cowan insisted on this, which shows that there's more than a little lack of understanding there.
I can think of two major issues just off the top of my head that make Linux and most Unix-based systems more secure: there is no system registry to corrupt, and there is a separation between user and administrator functions. These make certain functions more cumbersome, but boost security. The registry, by itself acts as shopping list for malware to corrupt the programs installed on the system. It also doesn't help that Windows has a tendency to screw up it's own registry.
I am truly amazed that anyone calling themselvews an expert in computer security would rest on such a flawed argument.
I know you can spoof email addresses, but I still havn't seen an email client with a filter that says, "Only let these addresses through."
'twould go a long way.....
In response to the above comments by Mr. Dubbs: Why do you think a purely technical guy has ANY knowledge about spam other than how it is done? The problem is a market and social problem brought about by new technologies. The geek world's solution is "MAC OS and Linux." The venture capitalist on the show pointed out the ugly truth: the only reason that Linux and MAC OS are less susceptible to spam is because it is not worth the spammers' time and effort to attack them; there are too few to make it profitable, not that they are somehow better architected or better written because they are more open. The fact that Mozilla Firefox browsers are being regularly attacked and there are a growing number of MAC spam products (SpamSieve, SpamSweep, etc) is proof that it is just a matter of having enough targets to attack that makes MAC OS and Linux relatively safe right now. There is an arrogance in suggesting "...if only all you people used the software I used, you'd be OK." Truth is, if we did, we'd be whispering how spam free Microsoft is!
PS: I'd never want to be a Bill Gates apologist, but it is amazing to hear people huff and puff about how "His predictions about the future directions of technology have been almost universally been wrong." True enough, who's ever been consistently right? But apparently he's been right enough when it counted.
As of late I've taken a different tactic with the spammers and in some cases it has worked very well.
If you get a lot of spam, you can't find your "real" email, right. To turn the tables, I reply to the spam... In the reply I often copy another another spammers message to them and add an attachment just shy of 5 megabytes. The theory is this:
1) if the Spammers get many bogus replies, they will not be able to find their prey.
2) 5 mb is the limit of a lot of servers and if they are not on broad band, the one email can shut them down for
an hour or so. Remember dial up?
3) If enough people do this, it will shut down the servers they use and those host will take action to stop the spam.
4) If as a community we can take the profit out of spamming, it will stop.
The above has taken me from 20-30 direct email "spam" messages per day to 3-8 per week... not to bad.
For the spam linked to web sites I don't have a good answer yet. Here are some general tips that help:
1) Report spam to Spam Cop
2) The SEC and FDA have reporting lines for stock and drugs respectively:
enforcement@sec.gov ,
3) I run a business and occasionally get credit card purchase requests that are obviously bogus. I copy these to
the local police department in the ship-to jurisdiction.
4) Clean your computer with a spyware tool, Spybot is one I use but there are others and maybe better ones out
there.
NPR thanks our sponsors
Blog of the Nation is the official blog of the NPR talk show Talk of the Nation. Before you participate make sure to give our discussion rules a read.
For more information about the blog, the show and everything else in between, please be sure to read our show's Frequently Asked Questions.
Want us to contact us privately? Write us!
Comments
Discussions for this story are now closed. Please see the Community FAQ for more information.