The Northern Spy: combatting spam
TweetFollow Us on Twitter

The Northern Spy: combatting spam

By Rick Sutcliffe

Spam is used either as a noun to refer to unsolicited bulk email, or as a verb to refer to the act of sending same. There are two categories of spam -- the difference depending on whether or not the mail has a commercial or monetary aspect;that is, the sender is attempting to obtain money from the recipients for a service, product, or cause.

There may or may not also be a fraudulent aspect to the spam -- generally one should expect that those who engage in one unethical activity would challenged where the truth is concerned as well. For instance, non-commercial spam is frequently sent to argue for or against some cause, and may be abusive of the recipient, or of some identifiable group or organization to which the recipient may be supposed to belong. Sometimes it's even a one-time friend or former fellow member of some organization who is now prosecuting a vendetta in semi-public fashion.

But no matter what the motivation for sending spam, or how the sender justifies his/her actions, the practice is universally condemned by recipients, legitimate internet service providers, and the laws of most jurisdictions. Whether the spammer is sending thirty or thirty million messages at a time, you don't want to get them, the ISPs don't want to transmit them, and law enforcement agencies want to catch them and put them out of business for good.

Just as the typical new server will be attacked by hackers within seconds of joining the Internet for the first time, the typical email inbox begins to fill up with unsolicited messages soon after being opened. One of the most frequently asked questions by newcomers to the web (there still are some) is what to do about all the junk mail. Under another hat, the Spy offers web services, and noted that as much as 90% of all email presented to his servers is marked as spam. Well, the Spy obtained his first email address on Bitnet around 1972 (yes, the reader sees that date correctly) and herewith tenders a few modest suggestions.

What to do:

First, never answer an email message without checking to ensure it is from a known source. Spammers sometimes send email to many names on a domain (joe@thedomain, sally@thedomain, fred@the domain, etc.), hoping to hit a real account with one of several hundred thousand attempts. Replying will merely confirm to the sender that yours is a valid email address, and (s)he will promptly add it to many lists and sell it to other spammers.

Second, never display an email address in clear text on your web site, where it can be harvested by spammers and sold. Instead, obfuscate it. The simplest is to render it as me--AT--thisAddress.com rather than using the "@" sign. There are other ways to do this in text so it does not look like an address to a harvester (see a link at the bottom), or the address can be placed in a graphic so it can only be read by human eyes. Likewise, the Spy has now reluctantly concluded, do not allow your debating club, philatelic society, condo owners association, authors' group, or knitting circle to publish your email address. Such lists are frequently stolen.

Third, never do anything that the unsolicited email requests. Any attached file you open almost certainly contains a malware program that can take over your computer, either for the purpose of sending more spam, to find those stored credit card numbers, passwords, and other personal information, or to vandalize your files. The Spy adopts a zero-tolerance policy toward file attachments. Unless the sender has been specifically asked to send it, he deletes all such unread. Sorry, students, but you cannot submit your homework that way. The risks are too great.

Likewise, clicking on a link in the message will surely take you to a malicious web site. These fall into two categories. The first consists of fake sites pretending to be your bank, PayPal, or some other place where you have an account. The goal is to obtain your ID, your credit card or other personal information, and/or your password to an account. The second group of malicious sites are those set up to exploit bugs in browsers that may allow the site access to your computer and files. The common theme here is identity theft.

Note that no legitimate bank, Internet Services Provider, forum, or other online service will ever ask you to go to a site via a link embedded in an email message and provide your username and password or other information to "verify" your account, to deal with a "security issue" or to remove some "limitation" on your account. These are always frauds. If you have a concern about your account after receiving such a message, send an email to your contact person for that account (not using a link, but by typing in the address) or go to the service's web site (again by typing the address, not using the link.

Many email programs will warn you that a malicious link is not what it purports to be, but the absence of such a warning should not lull the reader into a false sense of security.

Fourth, most email programs have spam and abuse filters. Out of the box, these may be able to detect and mark some spam, then move it to the recipients' junk folder/box. These mailboxes should be checked weekly for "false positives", that is, messages that are marked as spam, but really are not. Commands found in the mail program's menu can then "teach" the filters that some messages are or are not spam. Over time, the filters will be better able to identify mail correctly, but the spammers themselves know of these filters and are constantly changing the wording of their messages to bypass them, so the training must be ongoing.

Fifth, if your email is part of a hosting package and you have a control panel for that hosting package (such as cPanel) you may have additional options for stopping spam at the server. These include:

(i) The server's own mail filtering programs, such as the very common Mailscanner, attach a number to all mail scanned, indicating the likelihood of its being spam or abusive. You can set the mail software at the server level to regard anything over a particular score as "high spam, then refuse delivery of high spam. You may fail to get a few false positives, but your mailbox will slim down considerably.

(ii) The server's control panel may also offer user-defined filters that you can set to discard or reject any mail with a particular phrase in its headers, including a specific "From:" (a blacklist). Again, the action is taken at the server level, and the message will not reach you.

(ii)Along the same lines, when you control your own domain, you can create as many email addresses or forwarders as you want. Give these out when you order on line, and as long as the company you dealt with doesn't sell it to a spammer, continue to use it when corresponding with them. When it does show up sold to a spammer, delete it.

(iii) If you are uncomfortable with changing these settings yourself, you can complain to your own web host or email service provider, who should be more than happy to set server wide or account level blacklisting on a troublesome spammer, preventing acceptance of the message by the server. The system operator also has access to a suite of server-wide filters, blacklists, and spam markings that can be taught to the mail scanner.

(iv) Server level spam filters rely on spammer lists maintained by third parties such as Spamhaus. You may be able to report spam directly to such an organization and have the offender blacklisted worldwide. However, despite defining spam as "unsolicited bulk email" Spamhaus has a more restrictive operational definition than envisioned here, and will only take action on commercial spam, not on other bulk unsolicited email, and not on abusive mail.

(v) Yet another spam prevention service worth cooperating with if you have your own site is Project Honeypot. This involves putting code and an "email address" on your website that when harvested and used in a spam email list immediately identifies the mail as spam, for only an illegitimate automatic harvester would detect the alleged address.

Sixth, ISPs (Internet Service Providers), even if only offering mail services, all have explicit clauses in their terms of reference that ban hate mail, abusive mail, and spam of all kinds. Here is an excerpt from a gmail TOS document:

In addition to (and/or as some examples of) the violations described in the terms of service, users may not:

Generate or facilitate unsolicited commercial email ("spam"). Such activity includes, but is not limited to

o sending email in violation of the CAN-SPAM Act or any other applicable anti-spam law;

° imitating or impersonating another person or his, her or its email address, or creating false accounts for the purpose of sending spam;

° data mining any web property (including Google) to find email addresses;

° sending unauthorized mail via open, third-party servers;

° sending emails to users who have requested to be removed from a mailing list;

° selling, exchanging or distributing to a third party the email addresses of any person without such person's knowing and continued consent to such disclosure;

° sending unsolicited emails to significant numbers of email addresses belonging to individuals and/or entities with whom you have no preexisting relationship.

Here is another from Hotmail:

Terms of Service. The Hotmail Terms of Service (TOS) strictly forbids sending unsolicited e-mail -- and the TOS is enforced with zero-tolerance zeal. All reported accounts in violation of the TOS are terminated immediately and permanently. Hotmail publicly posts its closures of those accounts from which unsolicited commercial e-mail has been sent to anti-spam Usenet newsgroups on a regular basis.

In addition, Hotmail recently instituted a "liquidated damages" clause in the TOS. This clause requires members who misuse Hotmail in connection with spam to pay $5 per spam message to Hotmail. This clause serves as a deterrent to keep Hotmail spam-free and will make it easier to pursue spammers.

Nearly all other such email providers, whether large or small, have similar clauses in their TOS, and enforce them. If you receive spam from a domain whose provider you can recognize, you can complain to the "abuse" department of that provider about the mail, and may be able to get the account cancelled, if the provider is reputable. Of course, the spammer is likely to start up again elsewhere, but you do get a temporary respite. If the amount of spam is large enough or the spammer is using a stolen address list, the provider may be willing to take legal action for the fines, or to put the offender in prison. One can always hope.

Seventh (modification of the very first point above for the brave) If you already know the spammer, or know that (s)he has your real address list anyway, you could consider sending a message to the person requiring that your name be removed from the mailing list being used. Keep this message and any reply. If the person refuses, even if implicitly by continuing to send the spam, complain to their services provider as in the previous section. It is a violation of nearly every provider's TOS to refuse to remove an address from a mailing list on request, so if the service they use is a legitimate one (such as gmail or hotmail) this complaint should result in cancellation of their account there. However, it is the Spy's experience that many companies are not as diligent about this as they ought to be.

If your service happens to be the same as the spammer's (say, gmail) you may be able to complain simply by clicking a box next to the email to tell the system operator that the mail is spam or abusive as far as you are concerned.

Eighth, even where no commercial or fraudulent aspect is present, and the mail contains no abuse, the sending of bulk unsolicited email is illegal in many jurisdictions, and may attract heavy fines and/or jail sentences. In celebrated recent cases spam kings Sanford Wallace and Adam Guerbuez, both of whom spammed Facebook accounts with commercial ads were fined $711M and $873M respectively. The latter judgement, made in California, has now, with exchange, amounted to nearly $1B CDN, and has been upheld by the Quebec Supreme Court. There have been other cases where the fines reached into the hundreds of millions, so these are not unique.

The gold standard now appears to have become a fine of $100 per address per message, and the larger ISPs and social networking sites seem to believe that at some point it is very much worth spending the legal money to pursue spammers, even if little or nothing can ever be recovered by way of paid fines (the offender declares bankruptcy). The hope seems to be that the publicity will deter others.

The Spy suspects that little short of jail will make much difference, for in most cases criminal prosecution is indeed a viable option. This is especially so in cases involving fraud, such as that of Alan Ralsky, the self-proclaimed "Godfather of Spam," who was sentenced to 51 months in prison for a pump-and-dump fraud run through spam.

It is worth noting that abusive mail, even if not explicitly threatening, is not only implicitly so, but its repetition is generally deemed harassment. Since uttering threats and harassment are criminal offences in almost all Western jurisdictions, this type of email can also result in slammer time. The recipient must decide whether the threats and/or harassment are sufficiently grave to file a police report.

Moreover, as in the last section, refusal to remove a name from an email list is a serious offence in many jurisdictions, and this may also be an avenue that either you, your provider, or the offender's provider can pursue.

Finally, an oddity of law in some countries, including the United States, prescribes particular penalties for sending unsolicited mail to a wireless device, offering a further legal option where applicable.

How much action is worth it?
In the case of commercial advertising, it is probably sufficient to stop the spam from getting to you, especially if this can be done at the mail server level before you download your mail to your own computer. In the case of abusive mail, particularly if a stolen database is involved, recipients may wish to give serious consideration to complaining up the line, first to their own ISP, then to the offenders' (if this is not just a server under his own control) and then to the police.

Now, wouldn't it be nice if a column like this never needed to be written? The Spy would be happy to see all spammers busted with heavy fines, all thieves of databases and senders of abusive email locked up. Perhaps the rest of us could then get on with our lives.

Rick Sutcliffe, (a.k.a. The Northern Spy) is professor and chair of Computing Science and Mathematics as well as Senate Chair at Trinity Western University. He is also on the board of CIRA, operator of .ca. He's written two textbooks and several novels, one named best ePublished SF novel for 2003. His columns have appeared in numerous magazines and newspapers (paper and online), and he's a regular speaker at churches, schools, academic meetings, and conferences. He and his wife Joyce have lived in the Aldergrove/Bradner area of BC since 1972.

Want to discuss this and other Northern Spy columns? Surf on over to ArjayBB.com. Participate and you could win free web hosting from the WebNameHost.net subsidiary of Arjay Web Services. Rick Sutcliffe's fiction can be purchased in various eBook formats from Fictionwise, and in dead tree form from Amazon's Booksurge.

URLs


The Northern Spy Home Page: http://www.TheNorthernSpy.com


The Spy's Laws collected: http://www.thenorthernspy.com/spyslaws.htm


The Spy's Shareware download site: http://downloads.thenorthernspy.com/

 

Community Search:
MacTech Search:

Software Updates via MacUpdate

Stacks 3.5.5 - New way to create pages i...
Stacks is a new way to create pages in RapidWeaver. It's a plugin designed to combine drag-and-drop simplicity with the power of fluid layout. Features Fluid Layout: Stacks lets you build pages... Read more
Yasu 4.0.5 - System maintenance app.
Yasu was created with system administrators who service large groups of workstations in mind, Yasu (Yet Another System Utility) was made to do a specific group of maintenance tasks quickly within a... Read more
Things 3.2 - Elegant personal task manag...
Things is a task management solution that helps to organize your tasks in an elegant and intuitive way. Things combines powerful features with simplicity through the use of tags and its intelligent... Read more
iMazing 2.4.2 - Complete iOS device mana...
iMazing (was DiskAid) is the ultimate iOS device manager with capabilities far beyond what iTunes offers. With iMazing and your iOS device (iPhone, iPad, or iPod), you can: Copy music to and from... Read more
Google Chrome 61.0.3163.100 - Modern and...
Google Chrome is a Web browser by Google, created to be a modern platform for Web pages and applications. It utilizes very fast loading of Web pages and has a V8 engine, which is a custom built... Read more
Quicken 4.6.4 - Complete personal financ...
Quicken makes managing your money easier than ever. Whether paying bills, upgrading from Windows, enjoying more reliable downloads, or getting expert product help, Quicken's new and improved features... Read more
Google Chrome 61.0.3163.100 - Modern and...
Google Chrome is a Web browser by Google, created to be a modern platform for Web pages and applications. It utilizes very fast loading of Web pages and has a V8 engine, which is a custom built... Read more
iMazing 2.4.2 - Complete iOS device mana...
iMazing (was DiskAid) is the ultimate iOS device manager with capabilities far beyond what iTunes offers. With iMazing and your iOS device (iPhone, iPad, or iPod), you can: Copy music to and from... Read more
Quicken 4.6.4 - Complete personal financ...
Quicken makes managing your money easier than ever. Whether paying bills, upgrading from Windows, enjoying more reliable downloads, or getting expert product help, Quicken's new and improved features... Read more
Yasu 4.0.5 - System maintenance app.
Yasu was created with system administrators who service large groups of workstations in mind, Yasu (Yet Another System Utility) was made to do a specific group of maintenance tasks quickly within a... Read more

The best visual novels on mobile
Narrative games have been around for ages, but only now have they been creeping into the mainstream spotlight. These games tell some of the industry's finest stories, and they break new ground in terms of gameplay and mechanics regularly. Here are... | Read more »
The best new games we played this week -...
It's pretty much been one big release after another. We were privy to a bunch of surprises this week, with a lot of games we'd been waiting for quite some time dropping unexpectedly. We hope you're free this weekend, because there is a lot for... | Read more »
Stormbound: Kingdom Wars guide - how to...
Stormbound: Kingdom Wars is an excellent new RTS turned card battler out now on iOS and Android. Lovers of strategy will get a lot of enjoyment out of Stormbound's chess-like mechanics, and it's cardbased units are perfect for anyone who loves the... | Read more »
The best AR apps and games on iOS right...
iOS 11 has officially launched, and with it comes Apple's ARKit, a helpful framework that makes it easier than ever for developers to create mobile AR experiences. To celebrate the occassion, we're featuring some of the best AR apps and games on... | Read more »
Phoenix Wright: Ace Attorney - Spirit of...
Phoenix Wright: Ace Attorney - Spirit of Justice 1.00.00 Device: iOS Universal Category: Games Price: $.99, Version: 1.00.00 (iTunes) Description: ************************************************※IMPORTANT※・Please read the “When... | Read more »
Kpressor (Utilities)
Kpressor 1.0.0 Device: iOS Universal Category: Utilities Price: $4.99, Version: 1.0.0 (iTunes) Description: The ultimate ZIP compression application for iPhone and iPad. - Full integration of iOS 11 with support for multitasking.-... | Read more »
Find out how you can save £35 and win a...
Nothing raises excitement like a good competition, and we’re thrilled to announce our latest contest. We’ll be sending one lucky reader and a friend to the Summoners War World Arena Championship at Le Comedia in Paris on October 7th. It’s the... | Read more »
Another Lost Phone: Laura's Story...
Another Lost Phone: Laura's Story 1.0 Device: iOS Universal Category: Games Price: $2.99, Version: 1.0 (iTunes) Description: Another Lost Phone is a game about exploring the social life of a young woman whose phone you have just... | Read more »
The Witness (Games)
The Witness 1.0 Device: iOS Universal Category: Games Price: $9.99, Version: 1.0 (iTunes) Description: You wake up, alone, on a strange island full of puzzles that will challenge and surprise you. You don't remember who you are, and... | Read more »
Egg, Inc. guide - how to build your gold...
Egg, Inc.'s been around for some time now, but don't you believe for one second that this quirky clicker game has gone out of style. The game keeps popping up on Reddit and other community forums thanks to the outlandish gameplay (plus, the... | Read more »

Price Scanner via MacPrices.net

Sunday sale: 13-inch 3.1GHz MacBook Pros for...
Amazon has 2017 13″ 3.1GHz MacBook Pros on sale today for up to $150 off MSRP, each including free shipping: – 13″ 3.1GHz/256GB Space Gray MacBook Pro (MPXV2LL/A): $1649.99 $150 off MSRP – 13″ 3.1GHz... Read more
Looking for a 2017 12″ Retina MacBook? Save $...
Apple has Certified Refurbished 2017 12″ Retina MacBooks available for $200-$240 off the cost of new models. Apple will include a standard one-year warranty with each MacBook, and shipping is free.... Read more
Apple Offering Up To $455 Credit Toward iPhon...
iPhone 8 and 8 Plus are now available at the Apple Store, and you can receive up to $375 credit toward a new iPhone purchase when you trade in your eligible smartphone. Photo Courtesy Apple Just... Read more
AnyTrans Offers iOS Users Three Ways For Movi...
iMobie Inc. today announceed AnyTrans v6.0.1, which now can help iOS users move all data to iPhone 8/8 Plus seamlessly. The software is available both on Mac and Windows and fully able to move all... Read more
Snag a 13-inch 2.3GHz MacBook Pro for $100 of...
B&H Photo has 2017 13″ 2.3GHz MacBook Pros in stock today and on sale for $100 off MSRP, each including free shipping plus NY & NJ sales tax only: – 13-inch 2.3GHz/128GB Space Gray MacBook... Read more
Verizon offers new iPhone 8 for $100-$300 off...
Verizon is offering the new iPhone 8 for up to $300 off MSRP with an eligible trade-in: • $300 off: iPhone 6S/6S Plus/7/7 Plus, Google Pixel XL, LG G6, Moto Z2 Force, Samsung Galaxy S7/S7 edge/S8/S8... Read more
Apple Refurbished 2017 13-inch MacBook Pros a...
Apple has Certified Refurbished 2017 13″ Touch Bar MacBook Pros in stock today and available for $200-$300 off MSRP. A standard Apple one-year warranty is included with each MacBook, and shipping is... Read more
OWC USB-C Travel Dock with 5 Ports Connectivi...
OWC have announced the new OWC USB-C Travel Dock, the latest addition to their line of connectivity solutions. The USB-C Travel Dock lets you connect its integrated USB-C cable to a Mac or PC laptop... Read more
Pelican Products, Inc. Unveils Cases For All...
Pelican Products, Inc. has announced the launch of its full line of cases including Voyager, Adventurer, Protector, Ambassador, Interceptor (for the Apple iPhone 8 and 8 Plus backwards compatible... Read more
$100 off new 2017 13-inch MacBook Airs
B&H Photo has 2017 13″ MacBook Airs on sale today for $100 off MSRP including free shipping. B&H charges NY & NJ sales tax only: – 13″ 1.8GHz/128GB MacBook Air (MQD32LL/A): $899, $100 off... Read more

Jobs Board

Development Operations and Site Reliability E...
Development Operations and Site Reliability Engineer, Apple Payment Gateway Job Number: 57572631 Santa Clara Valley, California, United States Posted: Jul. 27, 2017 Read more
Development Operations and Site Reliability E...
Development Operations and Site Reliability Engineer, Apple Payment Gateway Job Number: 57572631 Santa Clara Valley, California, United States Posted: Jul. 27, 2017 Read more
*Apple* Retail - Multiple Positions - Apple,...
Job Description: Sales Specialist - Retail Customer Service and Sales Transform Apple Store visitors into loyal Apple customers. When customers enter the store, Read more
Instructional Designer, *Apple* Product Doc...
Job Summary The Apple Product Documentation team is looking for an instructional designer or a video editor to write user documentation for its professional video Read more
*Apple* Retail - Multiple Positions - Apple,...
Job Description: Sales Specialist - Retail Customer Service and Sales Transform Apple Store visitors into loyal Apple customers. When customers enter the store, Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.