Slashdot Log In
Spam Hits 95% of All Email
Posted by
CmdrTaco
on Wed Oct 17, 2007 07:45 AM
from the thats-just-depressing dept.
from the thats-just-depressing dept.
An anonymous reader writes "Commtouch released its Email Threats Trend Report based on the automated analysis of billions of email messages weekly. The report examines the appearance of new kinds of attachment spamsuch as PDF spam and Excel spam together with the decline of image spam, as well as the growing threat of innocent appearing spam containing links to malicious web sites. Image spam declined to a level of less than 5% of all spam, down from 30% in the first quarter of 2007; also, image pump-and-dump spam has all but disappeared, with pornographic images taking its place."
Related Stories
Firehose:Spam reaches all-time high of 95% of all email by Anonymous Coward
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Summary only link (Score:5, Informative)
My spam is still lame :-P (Score:5, Funny)
(http://homepage.mac.com/danaris/anaris.html | Last Journal: Monday February 14 2005, @03:58PM)
Huh? Where? Man, all I ever get are stupid Viagra spam and "O3M S0FTWARE!" (and variants thereupon).
Humpfh. Everyone gets pr0n spam but me.
Dan Aris
Re:My spam is still lame :-P (Score:5, Funny)
(http://www.ducktapeandglue.com/)
Re:My spam is still lame :-P (Score:5, Funny)
Re:My spam is still lame :-P (Score:5, Funny)
(http://www.crash-override.net/)
Do you recognise the canine? Then yes, that's bad.
SPAM @ 95%?! (Score:5, Informative)
Re:SPAM @ 95%?! (Score:4, Funny)
(http://www.crash-override.net/)
Re:SPAM @ 95%?! (Score:4, Funny)
Re:SPAM @ 95%?! (Score:4, Insightful)
(http://slashdot.org/ | Last Journal: Monday November 03 2003, @03:59PM)
Bizarrely, they should be easy to identify. Most of them are in Russian. Whatever bayesian network they're doing should have figured out by now that I don't read Russian.
The other one is the same template, over and over, all beginning with the same phrase. I have no idea why that one keeps getting through.
I'm sure not complaining; they're clearly filtering out a huge amount of sheer misery.
call me a cynic, but (Score:5, Insightful)
While I'm not denying spam etc. is an annoyance and does cause a lot of people some problems, do we really want to accept at face value some words from an organisation that could well have a vested interest in making the problem appear more threatening than it really is?
Personally I'd prefer to teach people how to avoid spam/virus infection - in the same way we teach people how to avoid clinical infection, than to go around wailing about how bad the problem is.
Re:call me a cynic, but (Score:5, Insightful)
That's not an unrealistic number (Score:5, Interesting)
(http://slashdot.org/)
The highest two-week percentage of rejected incoming email that I've seen broke 97% a few months ago. It's normally between 90% and 95%.
It's loads of fun dealing with this crap.
Re:call me a cynic, but (Score:4, Interesting)
(http://www.alexcurylo.com/)
Flirting.
Let us pick some text randomly off a googled link and exercise our imagination.
"First for Emailing - UK's only Emailing Academy
We are offering you two free e-courses value $45 each. One is our new success emailing communication programme and the other is our popular lifestyle coaching programme
SUCCESS EMAILING Communication Tips - series of 4 communication tips modules. Designed to get you connecting and interacting more easily and effectively plus monthly success emailing newsletter with tips, quotes and news..."
When there is a large industry which advertises itself in terms like that instead of the original [flirtzone.com] then perhaps there would be a point to be made that email communications are unusually inefficient. In the meantime, well, sure looks to me like anyone who has ever interacted with the opposite sex should have no problem imagining a form of communication in which 5% efficiency would be a striking -- well nigh unbelievable actually -- increase, and somehow that communication medium has not died out in several millions of years.
*looks around* Ah
OK, another data point (Score:5, Interesting)
(http://gathman.org/ | Last Journal: Friday January 20 2006, @01:41PM)
Re:call me a cynic, but (Score:4, Informative)
(http://l0b0.net/)
doubtful (Score:2, Interesting)
Did they track private networks? Encrypted Email?
Mine is full of spam... (Score:3, Funny)
Most of the subjects are as follows:(filtered for privacy)
Courses next term
[Course name here] Grades
IMPORTANT: Calculus Final Exam Time
Hello from [Relative name here]
[Subscribe newsletter here]
Funny pictures
Why wont it stop?
Those were my organization's summer levels (Score:2)
Not new. (Score:2, Informative)
And Security Focus has a great article [securityfocus.com] that shows how all of these numbers are totally made up.
Spam?? (Score:1)
(http://www.jasongreb.com/)
penalize the seller not the messenger (Score:2, Insightful)
The entity initiating the process is identifiable ( the contact information must be accurate in order to effect the sale ) unlike the spammer that can utilize many techniques to avoid identification.
Any different? (Score:3, Insightful)
And we have seen the huge (cough) progress made in removing that snail mail spam from the system.
Honestly, there seems to have been more progress in weeding out the digital spam then the paper sort.
Even vague sort of laws and protections and such.
Been there for years (Score:2)
That's an AVERAGE?? (Score:2)
Anecdotally, I don't think mine is an unusual scenario, which causes me to wonder: how many people are getting 96-100% spam, in order for this average to hold true? I mean, are there folks out there being inundated with a daily 100%-spam diet, just on the off-chance that they get a spot of lean steak one day?
Poor bastards.
Yahoo Mail welcome spam and block real email (Score:1)
(http://www.teenzoit.com/)
The brute force style of filtering spam disappointed me alot as it makes innocent websites completely helpless to communicate with their members who use yahoo mail. Now that all my important messages go into spam folder and spam mails go into my inbox, the effectiveness of Yahoo spam filter becomes 0. (Yes I know I can unblock my website in my own account settings, but how about mails being sent to other people?)
Yahoo Mail sux and I am switching to GMail.
So where's the invisible hand? (Score:3, Interesting)
We've seen some "free market" solutions which basically required that you pay a fee to every mail provider so they don't trash your email. And this didn't particularly help spam either.
I come to the conclusion that spam as an issue is one of two things, or both of those things:
1) Not that big of a problem (hard to believe if you are a mail provider / ISP yourself)
2) Impossible to solve by means of free market solutions, and requires cooperation and standardization of new technology.
Point 2 is hard to happen since every little startup that comes with a mini solution, trumpet it on their own and hence they are only a nuissance to deal with in the big picture (due to lack of a single standard, it's impossible to have clients which make the process of whitelisting easier and even half automatic).
Here are couple of solution which would get us half-there, but are only quarter-implemented right now:
1) Whitelist SMTP servers by talking back to the supposed mail of origin and comparing IP-s. The SMTP may return list of IP-s this host responds from. This is then cached and used for further authentication on this domain. It *may* lead to DoS if many hosts do a first-time check simultaneously, but it's unlikely (and less problematic, given we're eliminating 95% of bad emails this way).
2) Test-for-human-intelligence in your first email to a new email. Such as, I don't know, some sort of CAPTCHA you fill-in? Once this is done, communication can proceed without further tests between those two emails. The receiver still has the option to block you, lest you employ a mechanical turk.
Those solutions are boring, they're incomplete in a way, they introduce hassle, but if we *all* agree on those, they can be made less of a hassle, and still not lose their efficacy.
That would require the likes of AOL, Hotmail, Gmail and so on free mail providers to cooperate with the likes of Microsoft, Apple, Linux devs and so on, to implement this on both the clients and servers.
Right now, I could see Hotmail cooperating with Microsoft (.. wink, wink..
Spam auf deutsch? (Score:2)
(http://boonedocks.net/mike | Last Journal: Wednesday May 08 2002, @08:11AM)
Why we can't stop spam with our current techniques (Score:5, Interesting)
(Last Journal: Sunday September 30, @09:20PM)
If you want to stop spam, you have to remove the economic incentive. To do that, you need to cut off the co-conspirators that are allowing the spamvertised domains to be established and hosted. If you can either prevent them from getting a cut off the action, or punish them severely for taking their cut, then you can stop spam.
Until then, if all we do is try to filter spam out, we'll just continue to see the costs of inaction. Beyond that, we're ignoring the fact that filtering has real costs, as well. Filtering doesn't prevent the spam from traversing the internet, and furthermore it requires human time to update as the spammers change their tactics.
Email is dead, long live Email (Score:5, Interesting)
Only a few more percentage points to go... (Score:3, Interesting)
(http://sponeil.net/)
Greylisting to the rescue! (Score:5, Informative)
(http://bonesmoses.org/)
I hate to bring up anecdotal evidence, but, while I still get spam, my flood has gone down to a relative trickle simply by plugging postgrey into postfix. I could probably reduce it to zero with a bayesian filter, but I won't bother. Scanning through my logs, my server rejects literally thousands of spams every day, and I'm just one guy with two email addresses and a handful of aliases.
So, it would come as no surprise to me that spam volume is that high, I just never see it. I almost want to turn off my filter for a day just to see what would happen.
Well, maybe not.
Re:Greylisting to the rescue! (or not) (Score:4, Interesting)
(http://anti-trend.org/ | Last Journal: Saturday November 18 2006, @07:06PM)
Basically, greylisting is putting an email transaction on hold to see if the sender will retry. The idea is that if the sender is illigitimate, they won't bother resending. However, spammers have been onto this method for as long as it's existed, much moreso lately. All they have to do is take greylisted hosts and move them to the end of their script for later processing. The second time around, the spam gets through anyway. Even with its meager benefits, most organizations want email to come through as quickly as possible, and greylisting delays email by its very nature. It's also much less effective than existing technology that won't hinder most legitimate mail like DNSBL and/or SPF, spamwords+OCR (for image spam), and blocking on unknown recipients.
To summate, if greylisting makes you happy, then don't let me dissuade you from using it. it does indeed stop some spam. But please don't give the false impression that it's a magic bullet; most of the complaints we receive are from clients who've enabled greylisting and can't figure out why their mail is delayed.
[1] I am also a consultant to another firm who hosts manged email with spam filtering. Due to the complaints above, we have also disabled greylisting there. It was only effective at stopping about 5% of spam reliably, but a delay is put on all mail that isn't otherwise whitelisted. There are plenty of other methods which are both more effective and don't slow down the mailflow or tie up much resources on the MTA.
Some real spam numbers (Score:1)
(Last Journal: Monday December 30 2002, @04:18PM)
-Lok
So, it's not the Russians (Score:2)
(http://hatemytory.com/)
My point is not that Americans are evil, but rather than we need to look a lot closer to home in tackling these problems rather than looking for some grand criminal conspiracy to crack.
The conspiracy may exist but if local ISPs simply refused to route packets from zombied boxes then their owners would soon work out they had to do something.
one of the way to avoid spam =) (Score:1)
Even trustworthy people/companies sell you out. (Score:2)
I have a personal email address on my own domain that used to NEVER get spam. I moved into my own apartment a month ago and I signed up a new phone number with Bell Canada and a new account with my local city utility company. I gave that email address to both without thinking- usually I give one of my alternates. Well, now that address is getting tons of spam of the worst kind.
So, either Bell or my local utility sold my address. Two companies that are supposed to be reputable and trustworthy. They both have privacy policies that say they don't sell or share your personal info. Apparently that's bull.
Oh wait, the other option is that I was sent an evite from evite.com to that address. The spam might be coming from them. Gee, you can't even trust your friends not to give out your address.
I'm not impressed. In fact I'm pissed. If I can't avoid spam by being selective about who I give my address to, then I'm not sure there's anyway to avoid it. If I wasn't a web developer, I think I'd give up email permanently. As it is I have about 10-15 addresses for various things, yuk.
IE vulnerabilities (Score:2)
(http://www.lightandmatter.com/)
Sometimes true, sometimes not (Score:2)
The first day on my new job with a brand new email, it got barraged with spam. Instantly. The company has spam filtering and when I checked the spam folder they dated back to my start date. So somehow the spammers had access to the company directory. I configured Outlook to turn off the preview pane because that is how embedded executables run when you open an email.
My personal email account gets zero spam. ZERO. The personal address is given only to friends and family, never to a website or business. I have auxilary accounts that are reserved for those websites that insist on an email to join, or when I place an order over the net with a business. Sort of a layer between potential spam and me. None of my friends/family have those account addresses so I check them far less often, and on the rare occasion there is an email that requires my attention, I forward it to my personal account.
That has been very effective in keeping spam out of my inbox. My webmail is also effective in that it is text based and I never see HTML or embedded images, a popular tactic with spammers. It also can't autorun embedded viruses.
I can confirm that Yahoo! is the worse offender. I have a special account that only Yahoo! has. Their TOS claims they will not spam my account or sell the email address to 3rd parties. Either they are lying or someone has access to their email address database because that account has been barraged with spam and only Yahoo! has that address.
Maybe it's about time we got rid of email. (Score:1)
Hey, now there's an idea... if we start labelling spammers as terr'ists something might get done about it.
Stating the Obvious (Score:1)
The number is likely attempted deliveries only (Score:1)
(http://bsdly.blogspot.com/)
OpenBSD's spamd is a wonderful greylister, and it offers a few other options which will
make a dent in the reminaing few if you can be bothered to set it up. See my blog at
http://bsdly.blogspot.com/ [blogspot.com] and links from there for some examples.
The spam percentage will keep growing (Score:2)
(http://kasperd.net/~kasperd/ | Last Journal: Thursday July 08 2004, @10:18AM)
First of all when you sign up for a connection, the contract should state, that you are not allowed to send spam, and you are liable for the cost to track you down, if you do. It could be done by paying some reasonable deposit when signing up. And when ISPs make peering agreements, responsibility to track down the origin of spam has to be part of the agreement. If ISPs were willing to operate this way, it would just require one recipient of a spam message to contact his own ISP about it, and the source of that mail would be tracked down and disconnected from the net. (Same solution could be used for flooding and IP spoofing, which are also things that can only be stopped at the source).
It just ain't gonna happen. Because end users don't understand how it works. And as long as end users don't understand, they are going to choose the cheapest provider, which is the one who does not spend resources on fighting spam. Oh, maybe they have a socalled spam filter, which based on some heuristics throws away some of the messages to their own customers, and the customers will be happy (and blame the sender of messages, when the filter discards legitimate messages).
I feel we are now at the point, where the problems caused by spam filters blocking legitimate email are growing faster than the spam itself. And we will have to witness a total meltdown of the email system, before anybody will grab the problems by the root and solve it.
Egress filtering (Score:1)
signal to noise ratio (Score:2)
(http://home.earthlink.net/~johnrpenner/)
its gettin to be a mighty high signal to noise ratio,
but people will still keep using email, because...
The will is not set upon a surplus of pleasure, but upon
the amount of pleasure that remains after getting over the pain.
This is the essence of all genuine will... It reaches its goal
though the path be full of thorns. It lies in human nature to
pursue it so long as the displeasure connected with it
does not extinguish the desire altogether.
The question is not whether the pleasure to be gained is greater
than the pain, but whether the desire for the goal is greater
than the hindering effect of the pain involved... for the will
is not set upon a surplus of pleasure, but upon the amount of
pleasure that remains after getting over the pain.
This still appears as a goal worth striving for.
(R. Steiner, Philosphy of Freedom [wikipedia.org])
Use Cloudmark (Score:2)
(http://www.pureenerg...onnel/SterlingDAllan | Last Journal: Monday January 02 2006, @11:52PM)
How do they know? (Score:1)
(http://www.episode-iv.de/)
charon
MP3 spam (Score:1)
(http://hamsterrepublic.com/ | Last Journal: Thursday June 03 2004, @06:07PM)
95%?? (Score:1)
reduce spam (Score:1)
Re:white lists are the way to go (Score:4, Insightful)
(http://myatomic.com/ | Last Journal: Sunday November 19 2006, @12:31AM)
Re:Why can't we stop this shit ?? (Score:2)
(http://sitetheory.com/ | Last Journal: Friday October 24 2003, @10:59AM)
Re:Why can't we stop this shit ?? (Score:2)
ISPs should also be blocking outbound port 25 traffic from dynamic addresses (and if you need to use an external mail relay, use a tunnel or port 587.) Some ISPs do this already, many don't.
To all the whiners that don't like the port 25 blocking: Dynamic IP space is already "damaged goods", and you have multiple workarounds available to you. Any sane mail admin (including many large ISPs) already blacklist dynamic space therefor you can't effectively run a mail server on dynamic IP space.
The solution that stops 90%+ spam is out there, but it costs a little money to implement. It's still less money than what we currently are spending fighting spam. What are they waiting for - government mandates? Fines? Lawsuits? Getting their netblocks in 2,000,000 private blacklists that they have no chance in hell of getting out of?
Re:white lists are the way to go (Score:3, Insightful)
(http://www.feyknight.com/)
I can't even the use apparently moderately effective "blacklist Chinese and Russian IPs" technique. We correspond all over the world.
Re:Why can't we stop this shit ?? (Score:2)
Neutral carrier, (Score:2)
(Last Journal: Friday August 17, @05:34AM)
ISP's transmit data, I really don't want them to be starting to be clever. What next, RIAA requests that people are limited to X posts to usenet so they can't post large binaeries? Limit P2P traffic? Sniff traffic in general for undesired elements?
In a way, my PC becoming a spam zombie is part of the price of freedom. Do you really want the internet to be regulated?
Oh sure, you can start light, but in the end sooner or later someone will abuse it and push for ever more stringent restriction, all in the name of the common good.
For instance, limit each IP to no more then say 6 outbound connections, that should be enough, you can request more, and they will know you are a dirty P2Per who needs to be reported.
No my friend, let ISP's remain in their role as dumb data carriers, we got to fight spam another way then by given up freedom.
MOD PARENT UP (Score:2)
Re:E-mail stinks (Score:2)
Anything that is important may go by the snail mail, the email may work if it's signed.
It's just too bad that even big outfits has fallen to spam relaying even today. Checked the mail log and it contained an entry from mail5.warnerbros.com.
Re:E-mail stinks (Score:2)
(http://kehoes.org/ | Last Journal: Friday August 10, @04:32AM)
Letters get lost, and only become moderately reliable when you use a registered post system. Even then, you're only guaranteeing that the item has arrived at the address. You don't know if it'll be received or read by the intended recipient.
Faxes are subject to plenty of reliability issues. Wrong numbers, or poor print quality.
Email can be reliable so long as you use it correctly. If you require confirmation, ask for it in your mail. If you don't receive a reply within the time specified, email again or use an alternate contact method.