Text 587, 99 rader
Skriven 2004-09-14 19:05:36 av Geo. (1:379/45)
    Kommentar till text 556 av Rich (1:379/45)
Ärende: Re: Spammers faster than the good guys....
==================================================
From: "Geo." <georger@nls.net>

How do you figure? You think a spammer doesn't have a hundred domains that
can't be tracked back to him?

Rich, have you (in the past year or two) even tried to track down a spammer?

Ok example, pretend for a minute the MX points to you and you don't know the
owner and track down the bounces from doh@theyscrewedusagain.com and that's a
.COM, you should try it with a .INFO

Geo.

"Rich" <@> wrote in message news:4144aa77$1@w3.nls.net...
   Again you make this silly suggestion.  Why would a spammer do something like
this that provides a tracable record that is a legal liability for them.  They
should just as easily have no MX record or an MX record that points to an
invalid IP.  Both of which have the same effect of mail to their domain not
being deliverable which is all you claim they want.  It's one thing to create a
liability by spammer for which they derive revenue.  It's another to create one
which provides liability only.

Rich

  "Geo." <georger@nls.net> wrote in message news:4144a563$1@w3.nls.net...
  "John Beckett" <FirstnameSurname@compuserve.com.omit> wrote in message
  news:4144309b.40375046@216.144.1.254...

  > However, no one has given any hint of a reason why SPF won't reduce a lot
  > of back-scatter.

  Ok you want it explained, I can do that.

  What is the reason backscatter exists? I mean why don't spammers use domains
  from their unlimited supply of domains instead of pretending to be from
mike's
  domain?

  The reason is simple, many email servers have to accept an email for delivery
  before they can run a spam filter on it. And for some reason many, once they
  run a filter on it and decide it's spam they try to return it to the source
  instead of just deleting it.

  Now the spammers want to know if an address doesn't exist so they can keep
  their lists up to date, but when a filter blocks spam that tells them nothing
  about if the address exists or not so there is no value in accepting these
  returns. In fact it's a waste of their bandwidth and cpu to even try to deal
  with backscatter.

  So they spam in a way that someone else has to deal with it. Up until SPF
that
  was quite simple, they just use a different domain name for the FROM address.

  Ok now along comes SPF, what do you think the spammers are going to accept
  their own backscatter now? Hardly, all they are going to do is set the SPF
  record for their domain to point to the source of their spam so it's accepted
  like before and then set the MX record to point to some mail server where
they
  can dump the backscatter. It's like hardly any extra work for them to do this
  and all it costs them is a few DNS queries to DNS servers that are probably
  hosted on compromised machines anyway.

  What I'm saying is if SPF reaches a level of acceptance that it actually has
an
  annoyance factor to the spammers, they can make a simple change to their
  methods and SPF becomes meaningless as far as a solution for backscatter

  Here this is how difficult it is:

  Entries for a domain bytemyshorts.info

  txt record "v=spf1 ip4:1.1.1.1/1 ~all"
  MX records point to
  131.107.3.125
  131.107.3.124
  131.107.3.122
  131.107.3.123
  131.107.3.126
  131.107.3.121

  Ok I just defined half the planet as a possible source for my spam so using
all
  my compromises hosts will be no problem and all my bounces are going back to
  microsoft's mail servers just like I had used an @microsoft.com return email
  address.

  I can make the same entries for bytemyshorts1.info
  thru bytemyshorts1000000.info

  Now what protection has SPF provided for Microsoft? All I see is that it
  protects the name "microsoft.com". It's a copyright/trademark protection
  mechanism for high value domains and not much else. Nobody else can use
  microsoft.com but beyond that it provides no significant protection of the
  email system.

  Geo.

--- BBBS/NT v4.01 Flag-5
 * Origin: Barktopia BBS Site http://HarborWebs.com:8081 (1:379/45)