Text 554, 70 rader
Skriven 2004-09-12 15:43:24 av Geo. (1:379/45)
    Kommentar till text 545 av John Beckett (1:379/45)
Ärende: Re: Spammers faster than the good guys....
==================================================
From: "Geo." <georger@nls.net>

"John Beckett" <FirstnameSurname@compuserve.com.omit> wrote in message
news:4144309b.40375046@216.144.1.254...

> However, no one has given any hint of a reason why SPF won't reduce a lot
> of back-scatter.

Ok you want it explained, I can do that.

What is the reason backscatter exists? I mean why don't spammers use domains
from their unlimited supply of domains instead of pretending to be from mike's
domain?

The reason is simple, many email servers have to accept an email for delivery
before they can run a spam filter on it. And for some reason many, once they
run a filter on it and decide it's spam they try to return it to the source
instead of just deleting it.

Now the spammers want to know if an address doesn't exist so they can keep
their lists up to date, but when a filter blocks spam that tells them nothing
about if the address exists or not so there is no value in accepting these
returns. In fact it's a waste of their bandwidth and cpu to even try to deal
with backscatter.

So they spam in a way that someone else has to deal with it. Up until SPF that
was quite simple, they just use a different domain name for the FROM address.

Ok now along comes SPF, what do you think the spammers are going to accept
their own backscatter now? Hardly, all they are going to do is set the SPF
record for their domain to point to the source of their spam so it's accepted
like before and then set the MX record to point to some mail server where they
can dump the backscatter. It's like hardly any extra work for them to do this
and all it costs them is a few DNS queries to DNS servers that are probably
hosted on compromised machines anyway.

What I'm saying is if SPF reaches a level of acceptance that it actually has an
annoyance factor to the spammers, they can make a simple change to their
methods and SPF becomes meaningless as far as a solution for backscatter

Here this is how difficult it is:

Entries for a domain bytemyshorts.info

txt record "v=spf1 ip4:1.1.1.1/1 ~all" MX records point to
131.107.3.125
131.107.3.124
131.107.3.122
131.107.3.123
131.107.3.126
131.107.3.121

Ok I just defined half the planet as a possible source for my spam so using all
my compromises hosts will be no problem and all my bounces are going back to
microsoft's mail servers just like I had used an @microsoft.com return email
address.

I can make the same entries for bytemyshorts1.info thru
bytemyshorts1000000.info

Now what protection has SPF provided for Microsoft? All I see is that it
protects the name "microsoft.com". It's a copyright/trademark protection
mechanism for high value domains and not much else. Nobody else can use
microsoft.com but beyond that it provides no significant protection of the
email system.

Geo.

--- BBBS/NT v4.01 Flag-5
 * Origin: Barktopia BBS Site http://HarborWebs.com:8081 (1:379/45)