The Northern Spy: combatting spam
TweetFollow Us on Twitter

The Northern Spy: combatting spam

By Rick Sutcliffe

Spam is used either as a noun to refer to unsolicited bulk email, or as a verb to refer to the act of sending same. There are two categories of spam -- the difference depending on whether or not the mail has a commercial or monetary aspect;that is, the sender is attempting to obtain money from the recipients for a service, product, or cause.

There may or may not also be a fraudulent aspect to the spam -- generally one should expect that those who engage in one unethical activity would challenged where the truth is concerned as well. For instance, non-commercial spam is frequently sent to argue for or against some cause, and may be abusive of the recipient, or of some identifiable group or organization to which the recipient may be supposed to belong. Sometimes it's even a one-time friend or former fellow member of some organization who is now prosecuting a vendetta in semi-public fashion.

But no matter what the motivation for sending spam, or how the sender justifies his/her actions, the practice is universally condemned by recipients, legitimate internet service providers, and the laws of most jurisdictions. Whether the spammer is sending thirty or thirty million messages at a time, you don't want to get them, the ISPs don't want to transmit them, and law enforcement agencies want to catch them and put them out of business for good.

Just as the typical new server will be attacked by hackers within seconds of joining the Internet for the first time, the typical email inbox begins to fill up with unsolicited messages soon after being opened. One of the most frequently asked questions by newcomers to the web (there still are some) is what to do about all the junk mail. Under another hat, the Spy offers web services, and noted that as much as 90% of all email presented to his servers is marked as spam. Well, the Spy obtained his first email address on Bitnet around 1972 (yes, the reader sees that date correctly) and herewith tenders a few modest suggestions.

What to do:

First, never answer an email message without checking to ensure it is from a known source. Spammers sometimes send email to many names on a domain (joe@thedomain, sally@thedomain, fred@the domain, etc.), hoping to hit a real account with one of several hundred thousand attempts. Replying will merely confirm to the sender that yours is a valid email address, and (s)he will promptly add it to many lists and sell it to other spammers.

Second, never display an email address in clear text on your web site, where it can be harvested by spammers and sold. Instead, obfuscate it. The simplest is to render it as me--AT--thisAddress.com rather than using the "@" sign. There are other ways to do this in text so it does not look like an address to a harvester (see a link at the bottom), or the address can be placed in a graphic so it can only be read by human eyes. Likewise, the Spy has now reluctantly concluded, do not allow your debating club, philatelic society, condo owners association, authors' group, or knitting circle to publish your email address. Such lists are frequently stolen.

Third, never do anything that the unsolicited email requests. Any attached file you open almost certainly contains a malware program that can take over your computer, either for the purpose of sending more spam, to find those stored credit card numbers, passwords, and other personal information, or to vandalize your files. The Spy adopts a zero-tolerance policy toward file attachments. Unless the sender has been specifically asked to send it, he deletes all such unread. Sorry, students, but you cannot submit your homework that way. The risks are too great.

Likewise, clicking on a link in the message will surely take you to a malicious web site. These fall into two categories. The first consists of fake sites pretending to be your bank, PayPal, or some other place where you have an account. The goal is to obtain your ID, your credit card or other personal information, and/or your password to an account. The second group of malicious sites are those set up to exploit bugs in browsers that may allow the site access to your computer and files. The common theme here is identity theft.

Note that no legitimate bank, Internet Services Provider, forum, or other online service will ever ask you to go to a site via a link embedded in an email message and provide your username and password or other information to "verify" your account, to deal with a "security issue" or to remove some "limitation" on your account. These are always frauds. If you have a concern about your account after receiving such a message, send an email to your contact person for that account (not using a link, but by typing in the address) or go to the service's web site (again by typing the address, not using the link.

Many email programs will warn you that a malicious link is not what it purports to be, but the absence of such a warning should not lull the reader into a false sense of security.

Fourth, most email programs have spam and abuse filters. Out of the box, these may be able to detect and mark some spam, then move it to the recipients' junk folder/box. These mailboxes should be checked weekly for "false positives", that is, messages that are marked as spam, but really are not. Commands found in the mail program's menu can then "teach" the filters that some messages are or are not spam. Over time, the filters will be better able to identify mail correctly, but the spammers themselves know of these filters and are constantly changing the wording of their messages to bypass them, so the training must be ongoing.

Fifth, if your email is part of a hosting package and you have a control panel for that hosting package (such as cPanel) you may have additional options for stopping spam at the server. These include:

(i) The server's own mail filtering programs, such as the very common Mailscanner, attach a number to all mail scanned, indicating the likelihood of its being spam or abusive. You can set the mail software at the server level to regard anything over a particular score as "high spam, then refuse delivery of high spam. You may fail to get a few false positives, but your mailbox will slim down considerably.

(ii) The server's control panel may also offer user-defined filters that you can set to discard or reject any mail with a particular phrase in its headers, including a specific "From:" (a blacklist). Again, the action is taken at the server level, and the message will not reach you.

(ii)Along the same lines, when you control your own domain, you can create as many email addresses or forwarders as you want. Give these out when you order on line, and as long as the company you dealt with doesn't sell it to a spammer, continue to use it when corresponding with them. When it does show up sold to a spammer, delete it.

(iii) If you are uncomfortable with changing these settings yourself, you can complain to your own web host or email service provider, who should be more than happy to set server wide or account level blacklisting on a troublesome spammer, preventing acceptance of the message by the server. The system operator also has access to a suite of server-wide filters, blacklists, and spam markings that can be taught to the mail scanner.

(iv) Server level spam filters rely on spammer lists maintained by third parties such as Spamhaus. You may be able to report spam directly to such an organization and have the offender blacklisted worldwide. However, despite defining spam as "unsolicited bulk email" Spamhaus has a more restrictive operational definition than envisioned here, and will only take action on commercial spam, not on other bulk unsolicited email, and not on abusive mail.

(v) Yet another spam prevention service worth cooperating with if you have your own site is Project Honeypot. This involves putting code and an "email address" on your website that when harvested and used in a spam email list immediately identifies the mail as spam, for only an illegitimate automatic harvester would detect the alleged address.

Sixth, ISPs (Internet Service Providers), even if only offering mail services, all have explicit clauses in their terms of reference that ban hate mail, abusive mail, and spam of all kinds. Here is an excerpt from a gmail TOS document:

In addition to (and/or as some examples of) the violations described in the terms of service, users may not:

Generate or facilitate unsolicited commercial email ("spam"). Such activity includes, but is not limited to

o sending email in violation of the CAN-SPAM Act or any other applicable anti-spam law;

° imitating or impersonating another person or his, her or its email address, or creating false accounts for the purpose of sending spam;

° data mining any web property (including Google) to find email addresses;

° sending unauthorized mail via open, third-party servers;

° sending emails to users who have requested to be removed from a mailing list;

° selling, exchanging or distributing to a third party the email addresses of any person without such person's knowing and continued consent to such disclosure;

° sending unsolicited emails to significant numbers of email addresses belonging to individuals and/or entities with whom you have no preexisting relationship.

Here is another from Hotmail:

Terms of Service. The Hotmail Terms of Service (TOS) strictly forbids sending unsolicited e-mail -- and the TOS is enforced with zero-tolerance zeal. All reported accounts in violation of the TOS are terminated immediately and permanently. Hotmail publicly posts its closures of those accounts from which unsolicited commercial e-mail has been sent to anti-spam Usenet newsgroups on a regular basis.

In addition, Hotmail recently instituted a "liquidated damages" clause in the TOS. This clause requires members who misuse Hotmail in connection with spam to pay $5 per spam message to Hotmail. This clause serves as a deterrent to keep Hotmail spam-free and will make it easier to pursue spammers.

Nearly all other such email providers, whether large or small, have similar clauses in their TOS, and enforce them. If you receive spam from a domain whose provider you can recognize, you can complain to the "abuse" department of that provider about the mail, and may be able to get the account cancelled, if the provider is reputable. Of course, the spammer is likely to start up again elsewhere, but you do get a temporary respite. If the amount of spam is large enough or the spammer is using a stolen address list, the provider may be willing to take legal action for the fines, or to put the offender in prison. One can always hope.

Seventh (modification of the very first point above for the brave) If you already know the spammer, or know that (s)he has your real address list anyway, you could consider sending a message to the person requiring that your name be removed from the mailing list being used. Keep this message and any reply. If the person refuses, even if implicitly by continuing to send the spam, complain to their services provider as in the previous section. It is a violation of nearly every provider's TOS to refuse to remove an address from a mailing list on request, so if the service they use is a legitimate one (such as gmail or hotmail) this complaint should result in cancellation of their account there. However, it is the Spy's experience that many companies are not as diligent about this as they ought to be.

If your service happens to be the same as the spammer's (say, gmail) you may be able to complain simply by clicking a box next to the email to tell the system operator that the mail is spam or abusive as far as you are concerned.

Eighth, even where no commercial or fraudulent aspect is present, and the mail contains no abuse, the sending of bulk unsolicited email is illegal in many jurisdictions, and may attract heavy fines and/or jail sentences. In celebrated recent cases spam kings Sanford Wallace and Adam Guerbuez, both of whom spammed Facebook accounts with commercial ads were fined $711M and $873M respectively. The latter judgement, made in California, has now, with exchange, amounted to nearly $1B CDN, and has been upheld by the Quebec Supreme Court. There have been other cases where the fines reached into the hundreds of millions, so these are not unique.

The gold standard now appears to have become a fine of $100 per address per message, and the larger ISPs and social networking sites seem to believe that at some point it is very much worth spending the legal money to pursue spammers, even if little or nothing can ever be recovered by way of paid fines (the offender declares bankruptcy). The hope seems to be that the publicity will deter others.

The Spy suspects that little short of jail will make much difference, for in most cases criminal prosecution is indeed a viable option. This is especially so in cases involving fraud, such as that of Alan Ralsky, the self-proclaimed "Godfather of Spam," who was sentenced to 51 months in prison for a pump-and-dump fraud run through spam.

It is worth noting that abusive mail, even if not explicitly threatening, is not only implicitly so, but its repetition is generally deemed harassment. Since uttering threats and harassment are criminal offences in almost all Western jurisdictions, this type of email can also result in slammer time. The recipient must decide whether the threats and/or harassment are sufficiently grave to file a police report.

Moreover, as in the last section, refusal to remove a name from an email list is a serious offence in many jurisdictions, and this may also be an avenue that either you, your provider, or the offender's provider can pursue.

Finally, an oddity of law in some countries, including the United States, prescribes particular penalties for sending unsolicited mail to a wireless device, offering a further legal option where applicable.

How much action is worth it?
In the case of commercial advertising, it is probably sufficient to stop the spam from getting to you, especially if this can be done at the mail server level before you download your mail to your own computer. In the case of abusive mail, particularly if a stolen database is involved, recipients may wish to give serious consideration to complaining up the line, first to their own ISP, then to the offenders' (if this is not just a server under his own control) and then to the police.

Now, wouldn't it be nice if a column like this never needed to be written? The Spy would be happy to see all spammers busted with heavy fines, all thieves of databases and senders of abusive email locked up. Perhaps the rest of us could then get on with our lives.

Rick Sutcliffe, (a.k.a. The Northern Spy) is professor and chair of Computing Science and Mathematics as well as Senate Chair at Trinity Western University. He is also on the board of CIRA, operator of .ca. He's written two textbooks and several novels, one named best ePublished SF novel for 2003. His columns have appeared in numerous magazines and newspapers (paper and online), and he's a regular speaker at churches, schools, academic meetings, and conferences. He and his wife Joyce have lived in the Aldergrove/Bradner area of BC since 1972.

Want to discuss this and other Northern Spy columns? Surf on over to ArjayBB.com. Participate and you could win free web hosting from the WebNameHost.net subsidiary of Arjay Web Services. Rick Sutcliffe's fiction can be purchased in various eBook formats from Fictionwise, and in dead tree form from Amazon's Booksurge.

URLs


The Northern Spy Home Page: http://www.TheNorthernSpy.com


The Spy's Laws collected: http://www.thenorthernspy.com/spyslaws.htm


The Spy's Shareware download site: http://downloads.thenorthernspy.com/

 

Community Search:
MacTech Search:

Software Updates via MacUpdate

iFFmpeg 6.2.2 - Convert multimedia files...
iFFmpeg is a comprehensive media tool to convert movie, audio and media files between formats. The FFmpeg command line instructions can be very hard to master/understand, so iFFmpeg does all the hard... Read more
ForeverSave 2.1.6 - Universal auto-save...
ForeverSave auto-saves all documents you're working on while simultaneously doing backup versioning in the background. Lost data can be quickly restored at any time. Define your preferred time... Read more
BetterTouchTool 1.961 - Customize Multi-...
BetterTouchTool adds many new, fully customizable gestures to the Magic Mouse, Multi-Touch MacBook trackpad, and Magic Trackpad. These gestures are customizable: Magic Mouse: Pinch in / out (zoom... Read more
EtreCheck 3.1.4 - For troubleshooting yo...
EtreCheck is an app that displays the important details of your system configuration and allow you to copy that information to the Clipboard. It is meant to be used with Apple Support Communities to... Read more
Together 3.7 - Store and organize all of...
Together helps you organize your Mac, giving you the ability to store, edit and preview your files in a single clean, uncluttered interface. Features Smart storage. With simple drag-and-drop... Read more
Together 3.7 - Store and organize all of...
Together helps you organize your Mac, giving you the ability to store, edit and preview your files in a single clean, uncluttered interface. Features Smart storage. With simple drag-and-drop... Read more
EtreCheck 3.1.4 - For troubleshooting yo...
EtreCheck is an app that displays the important details of your system configuration and allow you to copy that information to the Clipboard. It is meant to be used with Apple Support Communities to... Read more
Postbox 5.0.9 - Powerful and flexible em...
Postbox is a new email application that helps you organize your work life and get stuff done. It has all the elegance and simplicity of Apple Mail, but with more power and flexibility to manage even... Read more
DiskCatalogMaker 6.5.16 - Catalog your d...
DiskCatalogMaker is a simple disk management tool which catalogs disks. Simple, light-weight, and fast. Finder-like intuitive look and feel. Super-fast search algorithm. Can compress catalog data... Read more
TrailRunner 3.8.827 - Route planning for...
TrailRunner is the perfect companion for runners, bikers, hikers, and all people wandering under the sky. Plan routes on a geographical map. Import GPS or workout recordings and journalize your... Read more

Latest Forum Discussions

See All

Great zombie games in the spirit of Dead...
Dead Rising 4 arrives tomorrow, giving enthusiasts a fresh chance to take selfies with zombies and get up to other ridiculous end-of-the-world shenanigans. To really get into the spirit of things, we've gone and gathered the best zombie games that... | Read more »
Amateur Surgeon 4 Guide: Advanced tips a...
Amateur Surgeon 4 is still tackling the competition at the top of the App Store charts, so if you haven't tried it out yet, you should probably do that right away. If you've been at it for a while, though, perhaps you're ready to start expanding... | Read more »
Amateur Surgeon 4 Guide: Become the worl...
It's time to wield your trusty pizza cutter again, as Amateur Surgeon has returned with a whole fresh set of challenges (and some old, familiar ones, too). Starting anew isn't easy, especially when all you have at your disposal is a lighter, the... | Read more »
Le Parker: Sous Chef Extraordinaire (Ga...
Le Parker: Sous Chef Extraordinaire 1.0 Device: iOS Universal Category: Games Price: $2.99, Version: 1.0 (iTunes) Description: | Read more »
Telltale Games really is working on a Gu...
Telltale Games' next episodic adventure is indeed Guardians of the Galaxy. A document tied to the voice actors strike suggested that the project was in the work, but now we have direct confirmation following an announcement at the Game Awards that... | Read more »
Amateur Surgeon returns to iOS and Andro...
Amateur Surgeon and its two sequels disappeared from the App Store some time and it was sad days for all. But now, just in time for the holidays, the Adult Swim favorite makes its joyous return in the shape of Amateur Surgeon 4, a remake with... | Read more »
The best board games on mobile
Sometimes you need to ditch all of the high speed, high action games in favor of something a little more traditional. If you don't feel like parting ways from your mobile device, though, there are still plenty of ways to get that old-school fix.... | Read more »
The best Facebook Messenger Instant Game...
Facebook's new Instant Games is now here, meaning you can play games with your friends directly via Facebook. It's a fun new way to connect with friends, of course, but it's also proving to be a solid gaming experience in its own right, with a... | Read more »
You can now play game's on Facebook...
Facebook launched its new Instant Games platform in an exciting new attempt to engage its user base. As a result, you can now play a number of different games directly through Facebook Messenger. All of these games run with HTML5, meaning you play... | Read more »
Apollo Justice Ace Attorney (Games)
Apollo Justice Ace Attorney 1.00.00 Device: iOS Universal Category: Games Price: $.99, Version: 1.00.00 (iTunes) Description: Court Is Back In Session Star as rookie defense attorney, Apollo Justice, as he visits crime scenes,... | Read more »

Price Scanner via MacPrices.net

Monday roundup of Holiday Mac sales: Up to $3...
Take up to $300 off MSRP on the price of a new Apple Mac at B&H Photo today as part of their Holiday sale. Shipping is free, and B&H charges NY sales tax only. Touch Bar MacBook Pros are in... Read more
12-inch WiFi Apple iPad Pros on sale for up t...
B&H Photo has 12″ WiFi Apple iPad Pros on sale for up to $50 off MSRP, each including free shipping. B&H charges sales tax in NY only: - 12″ Space Gray 32GB WiFi iPad Pro: $749 $50 off MSRP... Read more
9-inch Apple WiFi iPad Pros on sale for $20-$...
B&H Photo has 9.7″ Apple WiFi iPad Pros on sale for $20-$50 off MSRP, each including free shipping. B&H charges sales tax in NY only: - 9″ Space Gray 256GB WiFi iPad Pro: $779.95 $20 off MSRP... Read more
Holiday sale: Apple MacBook Airs available fo...
B&H Photo has 13″ MacBook Airs on sale for $100 off MSRP. Shipping is free, and B&H charges NY sales tax only: - 13″ 1.6GHz/128GB MacBook Air (MMGF2LL/A): $899 $100 off MSRP - 13″ 1.6GHz/... Read more
13-inch Silver Touch Bar MacBook Pro in stock...
Amazon has the new 2016 13″ 2.9GHz/256GB Silver Touch Bar MacBook Pro (MLVP2LL/A) in stock today and on sale for $1749 including free shipping. That’s $50 off MSRP, and it’s the lowest price... Read more
Parallels Toolbox 1.3 for Mac Offers 25 Singl...
Parallels has launched Parallels Toolbox 1.3 for Mac, an upgrade that adds five new utilities to the stand-alone application which was released in August and is available exclusively online at http... Read more
OWC Mercury Elite Pro Dual mini Ultra-Portabl...
OWC has introduced the new OWC Mercury Elite Pro Dual mini, a powerful yet ultra-portable dual-drive RAID solution. The new Mercury Elite Pro Dual mini packs phenomenal performance into a small... Read more
Clearance 13-inch Retina MacBook Pros availab...
B&H Photo has clearance 2015 13″ Retina Apple MacBook Pros available for up to $200 off original MSRP. Shipping is free, and B&H charges NY tax only: - 13″ 2.7GHz/128GB Retina MacBook Pro: $... Read more
Roundup of 2016 13-inch 2.0GHz MacBook Pro sa...
B&H has the non-Touch Bar 13″ MacBook Pros in stock today for $50-$100 off MSRP. Shipping is free, and B&H charges NY sales tax only: - 13″ 2.0GHz MacBook Pro Space Gray (MLL42LL/A): $1449 $... Read more
New 13-inch 2.0GHz Space Gray MacBook Pro in...
Adorama has the new 13″ 2.0GHz Space Gray MacBook Pro (non-Touch Bar, MLL42LL/A) in stock for $1499 including a free 3-year AppleCare Protection Plan. Shipping is free, and Adorama charges sales tax... Read more

Jobs Board

Lead *Apple* Solutions Consultant - Apple (...
# Lead Apple Solutions Consultant Job Number: 53586123 Pittsburgh, Pennsylvania, United States Posted: Nov. 28, 2016 Weekly Hours: 40.00 **Job Summary** The Lead ASC Read more
*Apple* Retail - Multiple Positions- Plano,...
Job Description: Sales Specialist - Retail Customer Service and Sales Transform Apple Store visitors into loyal Apple customers. When customers enter the store, Read more
*Apple* Retail - Multiple Positions- Kansas...
Job Description:SalesSpecialist - Retail Customer Service and SalesTransform Apple Store visitors into loyal Apple customers. When customers enter the store, Read more
*Apple* Retail - Multiple Positions- Chicago...
Job Description: Sales Specialist - Retail Customer Service and Sales Transform Apple Store visitors into loyal Apple customers. When customers enter the store, Read more
Hardware Design Validation Engineer - *Apple...
The Apple Watch team is looking for a Hardware Design Validation Engineer. This person will be part of the Apple Watch hardware team with responsibilities for Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.