Subject: Slightly OT - Stupid Spammers

From: "Charles Lindsey" <[email-masked]>
Date: Wed, 14 Dec 2005 13:03:26 GMT

Well we all know that spammers trawl newsgroups looking for valid email
addresses. But the more stupid ones also pick up message-ids and try to
email spam to them. I have been getting around 50 spams a night addressed
to non-existent users on my machine, which turn out to be message-ids that
I have used. They all come via zombied machines, but the spammer appears
to be feeding the zombies in real time, because the times of posting of a
batch are all close together, even though they come from different
zombies. The contents cover all the spam topics that seem to be
fashionable at the moment.

Anyway, I thought I would try to discover exactly which groups the spammer
had been trawling, but Google only had a few of those message-ids (from
some widely separated copies of a FAQ I post).

But then, to my surprise, I found 5 of them were the message-ids of
messages I had posted to this list (I only looked at those 5, so there
were probably a lot more - they were from the days when the list was
hosted at Landfield, because looking for message-ids on the present
archive is _really_ hard work).

Now this list is not archived at Google, AFAICT, so the spammer must have
been trawling in gmane.

Anyway, has anyone else been getting spams derived from their message-ids
used on this list?

-- 
Charles H. Lindsey ---------At Home, doing my own thing------------------------
Tel: +44 161 436 6131 Fax: +44 161 436 6133   Web: http://www.cs.man.ac.uk/~chl
Email: [email-masked]      Snail: 5 Clerewood Ave, CHEADLE, SK8 3JU, U.K.
PGP: 2C15F1A9      Fingerprint: 73 6D C2 51 93 A0 01 E7 65 E8 64 7E 14 A4 AB A5

---

From: "Ruud H.G. van Tol" <[email-masked]>
Date: Wed, 14 Dec 2005 18:57:24 +0100

Charles Lindsey schreef:

> Anyway, has anyone else been getting spams derived from their
> message-ids used on this list?

I get from this that you have a catch-all setup.

If you choose to have messages accepted for non-deliverable addresses,
then all you can do is silently discard them.

Catch-all is evil. Non-existent hostnames and usernames should be
rejected at the very start of the SMTP-conversation (maybe after a
minute of silence).

Something similar happens when such a message is addressed to multiple
recipients from which a few exist, so compare the Envelope-To: with the
embedded To:.

The Message-IDs can have been scraped from the web, simply triggerd by
the '@' inside them. There will be other places than gmane that archive
this list.

-- 
Grtz, Ruud

---

From: Russ Allbery <[email-masked]>
Date: Wed, 14 Dec 2005 11:44:03 -0800

> message-ids used on this list?

I've gotten so much spam to message IDs for so many years that I wrote
special rules into my mail server to handle it something like five years
ago, so I don't even notice new instances any more.

-- 
Russ Allbery ([email-masked])             <http://www.eyrie.org/~eagle/>

---

From: Frank Ellermann <[email-masked]>
Date: Wed, 14 Dec 2005 21:47:10 +0100

Charles Lindsey wrote:

> the spammer must have been trawling in gmane.

With its Web / RSS interfaces that would require some special
knowledge about the "raw" article view, no rocket science but
still a special procedure.  I'd guess it's plain old NNTP.

> has anyone else been getting spams derived from their

I get spam to my Message-IDs all the time, even before I used
GMaNe.  Rarely I get spam to an address that I used precisely
once in de.admin.net-abuse.mail several years ago.  <shrug />

                           Bye, Frank

---

From: "Ruud H.G. van Tol" <[email-masked]>
Date: Thu, 15 Dec 2005 00:18:17 +0100

Frank Ellermann:
> Ruud H.G. van Tol:

>> all you can do is silently discard them.
>
> After reporting them to SpamCop, that's what I do...

Mail that is not properly addressed, doesn't get past SMTP here. But I
have spamtraps too, and my addresses are quite old and known, so I get a
lot of spam, and occasionally infected messages that weren't detected by
a the self-updating virus scanners yet.

I only report spam that is not already known by (a private selection of)
the big blacklists, which limits it for me to about 30 per day.
The infected messages (that carry complete zips or Windows-executables)
I send to a McAfee submit address following the procedure on
http://vil.nai.com/vil/submit-sample.asp

>> Catch-all is evil.
>
> ...the vanity host @xyzzy is the only way to create
> correct Message-IDs with my UA, and it comes with a
> catch-all, TINSTAAFL.

Would it work if you could put subhosts like "host01.xyzzy.claranet.de"
in DNS as localhost addresses like 127.6.66.01?

> Adding SPF FAIL it's still possible to use catch-all.
> Without SPF I'd given up on SMTP and/or Message-IDs.

I have never really looked into SPF.

>> [receiving messages that were not properly addressed]
>> compare the Envelope-To: with the embedded To:
>
> Won't fly for BCC.

If you have the complete Envelope-To, or at least the selection that
holds all te addresses that are yours, then you can check the
differences, and find the BCC ones. My main provider (xs4all.nl) adds an
Envelope-To header field to the messages with such a selection.

> But "reject as much as you can" is certainly the way to go.

For most people it should be.

I have seen spammers switching IP-nrs quite frequently lately, using an
IP-nr for only one or two days, or even just a few hours, every few
weeks, to let them flow out of black lists again. Some spammers have
been doing that for years already, but it seems to be getting more
popular.

-- 
Grtz, Ruud

---

From: "Charles Lindsey" <[email-masked]>
Date: Thu, 15 Dec 2005 17:02:21 GMT

>ago, so I don't even notice new instances any more.

Yes, I am about to arrange a filter upstream of myself (since I obviously
know the format of my locally generated message-ids), so that I don't
see them.

It just struck me that spammers could find more fertile places to scrape
than this list :-).

---

From: Florian Weimer <[email-masked]>
Date: Fri, 16 Dec 2005 19:15:57 +0100

> Now this list is not archived at Google, AFAICT, so the spammer must have

Are you sure?  I would expect that given the size of the list, a few
subscribers use compromised Windows machines, and the spam bots got
the addresses from there.

The solution is simple: use a separate domain for message IDs.
(Rejecting in the MTA does not really help if there are too many
message IDs floating around.)  Obviously, it only works in a setting
where you have some control over the clients.